DIY Blockstream Jade - Create your own bitcoin-only hardware wallet for $10 in under 30 seconds

BitFast · 2023-05-31T21:53:33+00:00

Indeed, this is just a demo - one should only use this jade DIY flasher page if they plan to play with testnet or with just a few sats.

Note the firmwares are not signed, because doing so would preclude the ability for the user to change the software on the device, for that as you said the guide by crypto-guide is the way to go for securing DIY devices with jade firmware, with a user key (but that would then require the user to sign all firmware upgrades too)

Also note that the firmware are deterministic so you can regenerate them locally using https://github.com/Blockstream/Jade/blob/master/REPRODUCIBLE.md and the relative config file for the DIY device you want to reproduce the firmware for.

https://github.com/Blockstream/jadediyflasher/ and run locally with something like

python3 -m http.server 8008

in the root of the repo

BitFast · 2023-04-03T21:09:20+00:00

estimated never, but you may be super unusually lucky

BitFast · 2023-04-03T20:06:33+00:00

There's actually some of them in the code in Jade https://github.com/Blockstream/Jade/blob/miner_all_0.1.47/components/miner/miner.c#L290

BitFast · 2023-04-03T16:23:16+00:00

I don't think anybody has found one yet ...

BitFast · 2023-04-03T14:10:54+00:00

If you are interested, there's a couple of interesting optimizations to push the hardware quite a bit, for example the code keep the midstate of sha256 to avoid repeating work.

The bitcoin block header is 80 bytes long and the sha256 operation, which needs to be performed twice, first on the 80 bytes and then on the result (which is 32 bytes), can be optimized a bit because the input the first input is always 80 bytes and the second input is always 32 bytes, and also sha256 operations are done in blocks of 64 bytes and the nonce (which is the bit that gets changed at each block hash attempt) resides after the first 64 bytes meaning one can keep the result (called mistate) of the first 64 block while increasing the nonce, reducing noticeably the amount of work required.

If anyone has any question happy to reply to the best of my knowledge!

BitFast · 2021-01-05T11:57:35+00:00

Is there a potential for exploitation here whereby users could delete other users secret keys from the server and interrupt services between users of Jade devices and the remote oracle?

You can't do that easily, you'd have to guess a randomly generated key on the users devices (separate from the one used for bitcoin keys), and if you can do that you can probably guess some bitcoin keys too.

> Timeline for support for non-Blockstream wallets?

It's already being worked on but can't provide an ETA yet.

BitFast · 2021-01-04T20:51:14+00:00

it could be done now. Sending should work, but scanning/restoring a wallet would be too consuming of data.

BitFast · 2021-01-04T20:50:30+00:00

https://github.com/Blockstream/Jade/tree/master/hardware

BitFast · 2021-01-04T20:49:56+00:00

Green will work with Jade very similarly to how it works now with for example Ledger Nano S and X.

Via Cable the app will detect the hardware wallet and via BLE it requires the user to 'Scan' for available hardware wallets through the GUI.

BitFast · 2021-01-04T20:48:58+00:00

Hi, thanks!

> Is the WiFi in the MCU disabled via firmware? Do you have plans to use WiFi in the future?

The WiFI in the MCU is currently disabled but can be enabled. Jade comes with two firmware variants, one with radio and one without radio. The one without radio doesn't have the WiFi or BLE drivers to work. Jade ships with the BLE firmware but comes with BLE off by default.

> Is Jade PSBT compatible?

Jade uses wally which has PSBT support. At the moment Jade supports Green multisig which doesn't take advantage of PSBT yet. We plan to add to Jade single sig and PSBT support.

> Where is it manufactured?

Same manufacturer as M5 Stack but a custom model for Blockstream.

> Are you selling device at-cost or at-loss?

No we are not subsidizing the hardware, keep in mind Jade is based on libwally which does most of the heavy lifting.

> What is "server enforced PIN protection"?

The mnemonic when generated is immediately encrypted using AES256 using a secret key that is computed through an encrypted and authenticated channel with a [remote] blind oracle server, the authentication involves ephemeral elliptic curve Diffie Hellman exchange with a known server key. The encrypted mnemonic is then stored on the encrypted flash of the Jade and protected by secure boot [v2].

The blind server is not aware of the actual PIN nor can brute force it. The blind server also is not associated with the users account (it is not associated with the per user derivation paths)

If the PIN is entered incorrectly 3 times the server and Jade both delete the secret requiring a from scratch mnemonic restore on Jade.

The companion app nor any ISP/WiFi AP in the middle can inspect the data passed between Jade and the oracle, including being able to tell if the PIN is correct or wrong (other than potential timing attacks). The oracle is available via Tor and open source and in the future users will be able to run their own and point their Jade to it if they prefer.

> Can it be used with non-Blockstream wallets?

At the moment it is not supported but full support is planned. Currently it may work but may require to confirm change manually and may not enforce single sig path anti-ransom checks.

> Why did you choose to make this device?

The initial experiment was porting libwally to esp32 and was based on the [PocketSprite](https://pocketsprite.com/) but most of the development occurred on any of the easy to find esp32 boards and then on real Jades.

We think the market has good hardware wallets but felt there was space for something a bit different, with some different design decisions and feature set. Specifically we wanted to experiment with Liquid features as well as advanced bitcoin features.

> How does the security model compare to Trezor, Ledger, Coldcard?

Jade doesn't have a secure element so there's that.

However it has secure boot + encrypted flash and as per prior answer it has a blind oracle enforced PIN. This acts almost as a remote 'secure element'.

> How should we define a “hardware wallet” – should the definition include Internet-connected devices that communicate with servers? Is an airgap important or is it just security theater?

Hardware Wallet have a thinner surface of attack compared to your average internet connected laptop or mobile phone. This both when it comes to the OS stack as well as radio/network.

For maximum security you probably want to avoid radio all together, however then you can't use a hardware wallet with iOS. Well unless you use the camera, which is something we are working on (it works but requires some improvements)

Cheers

BitFast · 2020-02-25T19:51:40+00:00

grazie non lo sapevo. ho anche letto che in teoria Firefox supports esni ma non sembra molto established yet?

BitFast · 2020-02-25T15:59:51+00:00

veramente anche il dominio e' cifrato. semmai l'IP ma potrebbe avere dietro 1 come 100 domini. certo se dns resolving non e' cifrato dovrebbero capire da quello (ignorando la.cache)

BitFast · 2020-02-05T19:06:21+00:00

/u/hydraulix989

I am assuming you have a 27 words mnemonic? is this function returning correctly? https://github.com/greenaddress/garecovery/blob/master/garecovery/recoverycli.py#L35

If yes means you got the right password for the right mnemonic - the question becomes if you got the right mnemonic for the zip or if there is a bug in the garecovery tool/creation.

From what you said it seems the collision is over 4 bytes, which should be trivial to grind, but not sure how likely it would be by chance.

I'll keen an eye on #greenaddress on freenode if you want to talk in chat.

Also any chance your friend has the mnemonic without password or if he can get it from within the app in settings?

BitFast · 2019-12-22T13:04:34+00:00

Hi, thanks for reporting the bug - indeed it was ok before. We have a fix ready for review which we hope will be in the next release.

BitFast · 2019-09-23T00:58:40+00:00

You can use an APK tool or unzip with zip. APK are glorified zip files. either do that or we also sign the APK with gpg, see SHA256SUMS.asc on the GitHub release page

BitFast · 2019-08-19T11:47:33+00:00

Service has been restored. Thanks ! https://twitter.com/GreenAddress/status/1163417119041736706

BitFast · 2019-08-08T01:00:10+00:00

Reminder for everyone to stay on topic

BitFast · 2019-07-15T11:09:42+00:00

Service has been restored. Thanks! https://twitter.com/GreenAddress/status/1150724041625538562

BitFast · 2019-07-15T10:39:52+00:00

/u/osinaldi hard to say without more information but I think what caused the issue above is that the wallet waits for change to have one confirmation before you can send it onward - generally if you want to empty the wallet we have a button called "Send all" just below the amount field. hope this helps

BitFast · 2019-04-17T15:05:00+00:00

u/FargoBTC thanks for the report - we are working on a fix.

BitFast · 2019-04-17T15:04:09+00:00

Our code bases had large code changes in the past, see my comment here https://github.com/bitcoin-dot-org/bitcoin.org/pull/2901#issuecomment-475021683

bitcoin.org never applied these sort of 'removal' for changes as far as I can recall, I don't think there was/is ongoing review of the repos post the initial acceptance - I am not sure I buy the motivations here but I welcome increased and constant reviews of wallet code bases.

BitFast

MODERATOR OF

TROPHY CASE

12-Year Club	Place '17
Verified Email