Some hardware wallet manufacturers think that going fully open source is the way forward, but getting there is not going to be easy.
“Not your keys, not your Bitcoin.” It’s a common refrain among cryptocurrency advocates; if you yourself don’t control the private keys to your crypto, it can be confiscated or stolen.
That’s where hardware wallets come in; they’re a vital part of the cryptocurrency ecosystem, enabling crypto holders to control their own private keys and “be their own bank”.
Hardware wallets are not without their own issues, though. The current generation of hardware wallets all use at least some closed-source design elements. That means users have to trust the manufacturer’s claims that the device is, in fact, secure; that hackers haven’t found a way to compromise its hardware and access the funds it holds.
Now, a new generation of cryptocurrency hardware projects are planning to use open source technology to break down this trust barrier once and for all.
The trust problem
Current hardware wallets all require some degree of trust. Trust that the manufacturers or others in the component supply chain haven’t inserted backdoors, trust that the wallet actually contains the security elements it claims, and trust that it can provide the security users are looking for. Users also have to trust that, in the event that proprietary secure elements are compromised, the manufacturer won’t simply cover up the vulnerability.
Newly-established firm Foundation Devices is one of a number of hardware wallet manufacturers who believe the way forward is to open-source the hardware—making the code and designs freely available to anybody.
We are beyond thrilled to officially launch Foundation Devices, a Bitcoin-focused open source hardware company. Read more on our blog! https://t.co/05ONi0kzqv
— FOUNDATION DEVICES (@FOUNDATIONdvcs) May 4, 2020
Although the company is still shrouded in mystery, it promises to launch a new Bitcoin hardware wallet this summer. Everything about the device, including “circuit schematics, design files, and firmware,” will be open source. That means anybody, anywhere will be able to review its design and code, helping to quickly identify any bugs, vulnerabilities, or even backdoors.
Is open-source the solution?
For Foundation Devices, simply stating a hardware element is secure is not enough. It argues that hardware wallet manufacturers should open-source their circuit schematics, firmware and more, so that they can be scrutinized and verified by the Bitcoin community.
“Hardware producers should seriously consider embracing open source,” Foundation Devices CEO Zach Herbert told Decrypt. “This would lead to a stronger brand and more active community, while giving customers added confidence that product offerings are secure and trustable.”
Read the full post for more details! https://t.co/kEFtHRc8m5
— FOUNDATION DEVICES (@FOUNDATIONdvcs) May 28, 2020
The firm encourages other hardware wallet producers to comply with the OSHWA criteria, a set of guidelines to help ensure that their hardware wallets truly are open-source. In addition to open-sourcing their hardware wallet under CERN OHL or a similar license, this should help to improve trust, while ensuring that any claims they make are accurate due to public scrutiny.
“Bitcoin only works because it is open source, allowing anyone to view the code and understand how it works,” said Herbert. “Today’s hardware is opaque and secretive—which is fundamentally incompatible with open-source software like Bitcoin.”
The open-source movement
Foundation Devices isn’t the first to suggest going the open-source route. Several hardware wallet producers, including SatoshiLabs, makers of the Trezor wallet, have already made at least part of their hardware or software stack open source.
SatoshiLabs has redoubled its commitment to open-source hardware with its new spinoff company, Tropic Square. The new firm aims to build an entirely open-source, fully auditable secure element—basically a microprocessor chip that has been certified as secure.
To achieve this, the firm plans to gradually open the code of its new secure element, until the whole thing is eventually open-source, without compromising on its security. “The goal is to provide access to design specifications, verification, and testing without obscurity,” said SatoshiLabs in a recent announcement. This new chip will also be integrated into a new hardware wallet from SatoshiLabs.
Going beyond certification
At the moment, the majority of hardware wallet manufacturers rely on their reputation and third-party security audits to market and sell their products as secure.
However, some question how reliable security certifications are. SatoshiLabs points out that “certifications test only against a known set of predefined scenarios,” whereas Foundation Devices argues that “certifications are not a replacement for independent reviews.”
“Today, if you need hardware built with security, you have no choice but to rely on proprietary secure elements,” Ruben Merre, co-founder and CEO of hardware wallet manufacturer NGRAVE, told Decrypt. “Those are deemed secure because they have been tested by certification bodies. This is a challenge, because the incentives are skewed: it might be argued that those certification bodies are on the side of the chip vendors as they are the ones that pay them.”
To mitigate the risk of a compromised secure element, NGRAVE instead opted to use its secure element to only partly seed the key creation; if its secure element is cracked, the attacker can’t extract the complete seed.
Ledger CTO Charles Guillemet succinctly shared his take on the subject in a recent Twitter thread. In the thread, Guillemet explained that the attack lab tasked with breaking the security of a chip carefully develops a test plan based on the code, and will often modify the initial test plan if their findings warrant it. This means it isn’t exactly set in stone how the chip will be attacked—making it difficult for chip makers to simply bulletproof the chip against these specific attacks to gain certification.
I’ve read several misconceptions about Common Criteria certifications. Typically:
– “Components producers pay for certification”
– “Certifications test only against a known set of predefined scenarios”
– “Certifications are not a replacement for independant review”Thread
— Charles Guillemet (@P3b7_) May 29, 2020
After testing, the lab will report any vulnerabilities it finds to the chip manufacturer, who will attempt to fix them. When the certification body is satisfied that the issues have been resolved, the chip will then be certified. Certifications, then, represent a simple way to demonstrate the security of a chip, but don’t necessarily mean they are impervious to attack. However, this isn’t the same as the mass independent reviews that would be possible with open-source hardware.
The challenge of going open-source
Although it’s clear that certifications are an imperfect solution, Ledger said that simply open sourcing the secure element is easier said than done.
“Creating an open-source SE [secure element] is a very exciting and ambitious project, though strewn with pitfalls, because it’s about transforming an entire industry by revolutionizing its conventions.” Ledger CMO Benoît Pellevoizin told Decrypt, adding that the company aims to be “as open-source as possible within the limits of what the industry allows.” The question, he added, is “how much efforts are needed to not make this aim wishful thinking.”
Since licensing the tools required for designing open-source cryptocurrency hardware wallets is an expensive process, it remains to be seen which firms have the type of capital necessary for such an undertaking—particularly when matching the security of already-established secure elements will also be a time-intensive task.
“It’s very difficult to build an open-source SE, from a cost, technical, patent and time point of view,” Pellevoizin said. The likelihood, then, is that we’re still several years away from seeing the first open-source secure elements for hardware wallets.
GIPHY App Key not set. Please check settings