Dark Skippy: A New Attack on Bitcoin Hardware Wallets?

Hi everyone and welcome back to Stephan Livera podcast. Today we're gonna be talking about Dark Skippy, which is a new, or let's say, a, a better way to do an old kind of attack, let's say. so let's talk about that. And now, joining me today are the, let's say, the contributors on this particular attack vulnerability. Whatever we're calling it. So joining me, Nick, Faro, Robin, Linus, and Lloyd. so welcome back to the show, guys. Thanks very much. Thanks,

Stefan. Thanks

for having us. Great. Okay, so look, let's start with, you know, we gotta start with the beginning. Wasn't this an already known attack, and maybe one of you, maybe Nick, maybe you wanna set some of the context of like what this is compared to, you know, pre-what previously might have been called, let's say, the chosen nonce attack or something similar?

Yeah, sure. so Dark Skippy is a powerful new attack for a malicious signing device to leak its secret keys. and there have been methods in the past which a signing device can leak its secret keys, but the pre-previous versions of this attack were quite efficient, inefficient, often taking many, many signatures, to leak the entire secret, to an attacker

Great. And so, Robin, I think you were the one who, it sounds like you were talk- you know, you were kind of throwing some ideas on Twitter or X, and that's kind of how this i-idea came about. Do you wanna explain a little bit there for listeners?

maybe, maybe Lloyd can, jump in for like how we got onto this discussion in the first place. Sure, yeah.

Yeah, sure. I was, from my perspective, it all started when I was trying to, you know, procrastinate doing slides for a conference, right? And so there was, Bitcoin Alive in Australia, and we were doing, Nick and I were gonna do a security workshop there. And so I wanted to make it clear to people, I really wanted to demonstrate to people that, you know, doing your own, choosing your own seed words and all these kinds of things that you do extra, although it's fine, it doesn't actually protect you fully against a malicious signing device. So if that attacker even has put a malicious sign device in your setup, even if it's fully offline, fully air-gapped, that thing can still send your secret key out. With a little bit of difficulty, and I was trying to come up with the best one, and I thought I had something that was much better than the previous ones, right? people were writing blog articles about this attack, it's very theoretical, it would take like dozens of signatures to actually leak the key. I reckoned I could do it in like two signatures if certain conditions were met, like if it wasn't re-replaced by fee, I could do it, like if it was an address reuse, if you were re- making the same signature under the same key twice. You could finagle the, the algebra to actually extract a nice, bit of data out of it, but I couldn't just do it in general. The user would have to do something very specific, which they might do, but it wouldn't-- they wouldn't do it all the time. And so I still felt like the attack, you know, it was-- I thought I was pretty clever 'cause for coming up with this, but maybe the attack wasn't like such a general attack, and maybe not the attack that you would do if you were creating multisig devices still, even though I could

Saying like, sort of asking this question that I already thought I had the best answer to, and then I was gonna dunk on everyone with the better answer, and then, along came Robin, with a way, way better answer. So I can, Robin can give us the background how he came up with this, amazing solution.

yeah, I, I read Lloyd's thread on Twitter and, it felt like, like a code golf tournament, so, I jump in. And, yeah, I, I actually spent a lot of time on that website that, is like an on-chain bounty to break small discrete logarithms. And, yeah, I, I thought for, for many, many hours about how to break small logarithms somehow faster than what's the state of the art. I failed with that, but having that background, I had some ideas how to, improve Lloyd's attack and, Essentially then, I used some of these ideas to, extract the nonce a bit quicker. Okay.

Yeah. So let's, let's try to explain some of that, like, as I'm understanding, you know, even in like 2019 or around there, Stephan Livera, who was, you know, behind Specter Wallet and Specter DIY, I think he was talking about this kind of thing, and I think the, the frame of mind he was coming from Just to set the context, it was this idea of, "Oh, what if you could make it so that even if the device was compromised, that, you know, you would find a way with some of the other tools you were using, whether that was Electrum at the time or something else, that would tell the user?" And so this way, we can try to improve the security by, by making it so that even if the device is bad or malicious, you know, that you could still make it secure. And then that, that kind of advanced the conversation as well around things like multi-sig Devices, which obviously is, you know, I still think that's the best that you can get today, but many users today are still on a single signature hard-- are still on a single device, and so it's important to sort of talk about some of the security ramifications of this, and so, yeah, maybe one of you guys wants to sort of take it from there in terms of explaining a little bit about the way the security in Bitcoin has evolved over that time.

Yeah, so one of the things that we sort of strive for with hardware is we want to get it like as, as trustless as possible. and that's sort of what leads people to doing these things like rolling dice or picking their own seed words, and, and verifying, you know, the conversion of the entropy into public keys, into addresses. and, and along each step of the way, people are trying to make a more and more trustless setup that even if your device was compromised or even- If it was, you know, got some backdoor in it, whether that's from, you know, the vendor themselves or, you know, a nation state level attack, you want to be sure that you're, i-in no scenario that you'll have your money stolen from you. and so this is sort of some of the premise towards the workshop that Lloyd and I were working on, and, and we, we found that, yeah, these fiddling with the nonces and, and making them, you can actually use this in nefarious ways, to leak the secret key, very efficiently. Yeah.

And I guess I'll just add one more point here, which is that, I guess, I think maybe I'm, I'm recalling it now, I think one of the other things Stephan, Steven, and some of the other guys

Your coordinator was malicious, would your hardware wallet be able to, you know, detect that and tell you, "Oh, no, actually, do you wanna send this number of coins to this address?" Right? But now we're getting to another level which is even deeper than that, which is if the entropy that you were using and the firmware was malicious, now, you know, with the dark skippy attack, the idea is that your master private key, your, the, you know, the, the actual, you know, private key is being leaked out on the blockchain, literally. So it's like Like at an even deeper level that you're kind of getting the rug pulled out from underneath you.

Yeah, and, and in the past there have been some like, attacks on supply chains. I think it was the Trezor which had some-- there were some fake Trezors made, and these Trezors would give you, a pre-generated seed phrase that the attacker would control. And so this is like quite an effective attack, 'cause it's, you know, it's quite-- as a, as an inexperienced user, it's quite hard to verify or You know, creating a genuinely random seed phrase.

But it's still pretty rare. there's one, one time it happened. I think there's some people in Russia who couldn't actually d-directly order? From the stores, they had to go through somebody else, and those, those people decided they didn't like Russians or something. the-- so the, the thing, the point you make, which is really important, Stephan, there is that like at the beginning, when people started out, like, there was maybe an intuitive understanding of security, but there wasn't really formally thought about that much, and so like the first, I think the first BitBox, like, didn't have a screen, like, the first Ledger didn't have a screen, and so when you actually sit What do we, what security are we getting from this device? it, and what do we mean by security? Like, it was before the first definition that you kind of suggested there, which is Okay, my internet connected device is malicious. Can we get security in that model? And the answer is yes, if we just take the secret keys out and put that onto another device. And that's just the signing device. Yeah, we can even get security, we can get some security even if your laptop's totally compromised, and the user follows some very specific steps, which is always important, right? Because you can have the secure signing device, but the coordinator- I don't know, shows you some pop-up and says, you know, "Okay, congratulations, you know, Sparrow Wallets doing a giveaway. send one BTC to this address, we'll send two back or something, right? Anything like this can still happen." Yeah. And

I'll, and I'll make a real-world example. There was a phoning of the Electrum software back, twenty eighteen or twenty nineteen, where the user got sent this message, "Oh, upgrade your, upgrade your Electrum," and they clicked it, and it was actually malicious firmware. And They just got pwned and they lost a lot of money, and so that's another real world example.

That's, in that case, the guy didn't have a hardware wallet, though, right? So that's actually, that guy actually had a seed word on the computer. That was like internet connected seed,

yeah. That was like typing your so seed words into the hot online computer.

Yeah, exactly. So you, so that we-- what we hope is that guy shouldn't have lost money if he had a hardware wallet, right? If he had, if he had a hardware wallet, like what the screen says, and he's not falling for dumb tricks that come up on the coordinator computer. Yeah. He should be okay, right? And so that was the, the motivation for that sort of shift in all the designs to always having a screen And telling the user to verify addresses, right, before you give them out, and also, verify that what the transaction is doing before you actually sign it. So this sign device came on, I was like, okay, we wanna get security in this malicious- Laptop slash malicious whatever scenario. And so now, what's the next frontier, right? and it's-- there are some objections to going to the next frontier, which is the malicious hardware signing device. Scenario, can we get security in, in the first instance with the malicious laptop or coordinating device as well as the malicious sign device? So as long as one of them is honest We will have security guarantees and the user is following this all the steps. Can you get some kind of security guarantee? Some people are objecting saying we don't need to go this far, it's too complicated to go this far. we disagree, and maybe not-- maybe it's not worth disagreeing at this price point, right? Because like, you know, there's one, been one attack against Russian tre-- you know, treza, right? There's been one attack so far, you know, but in Bitcoin at five hundred K or whatever Maybe people start going for this attack. Like the, the thing you need to point out, just so we take a step back before we get into which hardware wallets, you know, what's doing the right thing and what we're gonna do in the future and stuff, like how much money is this gonna save? Well, attackers mostly steal money by like calling up boomers. And getting them to like reset their Gmail to the wrong thing and then getting their Coinbase account or actually like getting them, yeah, getting them to actually read out their seed words on the phone call to them or hacking their, you know, their Google photo backup where they've stupidly taken a photo of them at some point. Like this is the way people actually lose money in this today. So, but we-- it is important to talk about what's, you know, do the research and figure out like, is there some coherent models that we can put forward that actually give security guarantees? And that's kind of where we're going there.

Back to the show in a moment. This show brought to you by CoinKite dot com, the creators of the best Bitcoin hardware security devices, such as the Coldcard Mark IV and the new Coldcard Q. Now, we use Bitcoin hardware security devices to keep our keys offline, our private keys offline. Now, the way these work is you can do that setup, write down your twelve or twenty-four words on those, the seed word cards, and keep that secure. Now, you can use this device to interact with the Bitcoin network using software such as Sparrow Wallet, Electrum, or Befiktor Desktop or Nunchuk, as a few examples. Now, you have a range of security features that you can use with these devices, such as passphrase You can use seed x or, or my favorite is multi-signature. Now, if you're starting in a basic way, just start with the device and the USB-C cable, plug it directly to the computer and use it that way, and then later improve your setup. But I believe these devices are great at helping secure your coins, especially as you start to migrate up into multi-signature security. But don't be disheartened or don't be, scared away, they are accessible, and I think you actually do learn about Bitcoin in the process. So to get yours Go to coincait dot com, use code livera to get a discount on your cold card. And now, back to the show. Yeah, look, so there's been this evolving paradigm, right? Like from the, you know, in early years, people were just doing things like have a air-gapped computer or have a computer where you keep, you know, like I remember, I used to do an offline armory setup, right? So you had like, this is pretty hardware wallets, right? Like you had this armory laptop, it's an offline laptop, and your online

At that time, and you would kind of use that together to kind of keep your private keys offline, right? And then later, it was like Trezor and Ledger were the first few hardware wallets, and obviously there were kind of-- then people would start phoning those devices and saying, "Oh, look, see, you're not using the secure element correctly, or this, that, and the other." Then it's getting to this level of, "Okay, what if the coordinator is malicious or it's been phoned in some way?" Then we're sort of getting to the level of like,

Entropy when we, create our private keys i- originally, and, and then also how do we go from that, that, you know, that, private key, master private key, to creating an xPub, having a master public key, and having the addresses, that we are, that are created off of that, and then we actually use those addresses. and so, yeah, so those are, I guess, some of the ways that, let's say, the, the industry has gone. So, can, can you guys maybe just- Spell out a little bit around the RFC sixty-nine, seventy-nine deterministic nonce generation and just explain a little bit about that as contrasted with this dark Skippy.

Yeah, maybe before that, Robin or Lloyd can explain like what an, what a nonce actually is in a, in a Schnorr signature. Right. Yeah, that's a good point. That'd be helpful.

Yeah, go, go ahead, Robin. What did you do here? What's the scheme?

The, the Schnorr signature scheme or the ECDSA signature scheme, both require like a random value for every signature, and, for every signature you have to create a fresh random value that has never been used before And, it's a bit of a fragile part of the signature scheme because in general in cryptography, it's hard to get proper randomness And that's why people, wanted to like get rid of the dependency on like some, yeah, random number generator, and they came up with like that deterministic scheme that, derives the nonce from the secret key and the message Essentially, it's hashing the secret key in the, in the message, and, that is the secret nonce. And the good thing about that is that, it is deterministically random. That means, it doesn't rely on, a random number generator that could be yeah, broken in some way. And,

there, there have been some attacks in the past where, people have used, you know, not very random, nonces in their transaction signatures, and there have been some papers and studies on this that you can go on the Bitcoin blockchain and you can do some very, very technical searches for these, these addresses, and you can actually find ones that you can actually, essentially solve for the private key. And if they're reusing that address or if they're, yeah, mostly if they're reusing that address, you can, you can solve for the private key and then steal any money that's remaining in there so yeah, it's, it's very important to use a, a very random nonce, for your signature, and that's, yeah, that's where the deterministic, signings, specification comes in.

Yeah, so the, the randomness is random from the, the, the pers-perspective of the attacker, indeterministic nonsense, but they're actually not random, so to speak. They don't actually get any randomness, but it just looks random to anyone who doesn't have the secret key. Since the signing device is the only one with the secret key, it should look random to everyone and just be just as good. Now, in our attack What we're doing is, we're choosing it non-deterministically as well. We're not using randomness, but we're, we're not doing it the right way, right? We're not using the al-the sa-same deterministic algorithm. We're actually shoving your, your, we're shoving your secret key into the nonce, okay? to, in try and get it out there onto the internet. So that's, that's the, that's the, I guess the, the comparison between the, the, the RFC, with the sort of numbers after it, forget which one it is yet, the, the, with the RFC that all these wallets implement And the, this algorithm that we're using, we're using a very malicious one, it's deterministic as well, but it's not the right kind of determinism, is the determinism that leaks your secret key onto the, into the actual signature, rather than hides your secret key in the actual signature, which is actually the purpose of the nonce.

Yeah, so maybe I should add that in, in, in the general scheme, in the classical scheme, there is no way to tell if the hardware wallet actually used the deterministic non-stereovation scheme or not. So from the outside, you can't tell if it actually used it. Only if it also prov-provides a zero knowledge proof, but no hardware wallet does that as far as I can tell. Yeah,

so the, the, the important point is, or the people, the reason people are bringing up this RFC, if you look at the Twitter discussion around this thing, is that if the wallet does that, you can verify it, right? So actually, this Dark Skippy attack, you can check whether you're being attacked If you have a second device and you load your seed words into it, and you check on every single signature, which no one is going to do, but I guess like it's kind of, it's, it is a kind of defense. I don't wanna say it's no defense at all, because it is kind of a defense in that we imagine there are like these expert users, and there are like these ultra mega super paranoid expert users, right? And they're like checking things, and because they exist, it's unlikely that anyone is doing like casting a wide- Net with, with this attack on everyone, because it eventually would end up in this ultra-nerd's, you know, setup, and he's got like, or she has got three Hardware wallets, she's checking the signatures are the same across each of them, and then would, would go immediately onto Reddit and start screaming if one of them were different. Like we're, like we're hoping this person exists. That person is definitely not me, by the way. I don't think it's anyone in this call. I'm not sure if that person actually exists anywhere. I think there probably are people who check a signature. Here and there who know enough to just check these signatures are the same, but in this attack you can sort of finagle it so you, you can detect whether maybe this is a check transaction. You can do it sort of randomly, every so often, you know, once every four signatures or whatever, so the person who-- unless they're checking it every single time. you, you can't really guarantee. And with security, you really wanna try to go for guarantees, not just 'cause guarantees are better, but it's also hard to explain what the security you're getting. Then you have to go in this long sort of, what's the probability and like, there's some social mechanism to make sure that this doesn't happen. And to some extent, like a lot of the security we use in Bitcoin is social. Like, I'm not reviewing Bitcoin cores every PR or whatever, none of, no, probably none of us here are. But there is some social But you don't wanna have it as like this explicit part of the security guarantees you're getting usually, and that's what I would say against this, you know, that this is the be-all and end-all of the, the solution here is just to, you know Hope that someone else is verifying it, you know?

Yeah, yeah. And just to spell that out, so as an example, that would mean you have, you know, maybe multiple of the same device, right? So as an example, you get multiple cold cards, and this hypothetical, you know, ex-super expert, paranoid user, maybe they're a whale, they've got a lot of coins, and they care about it. So every time there's like a new firmware update, they, they want, they're checking like, okay, I've, I've checked this with like And I can see that it's produced for the same transaction, the same signature, and that would be one way to sort of see, oh, okay, there's not, there's, there's, you know, less chance of funny business going on with the nonce in that example. Yeah, but

they would, they would say though, the ultra nerd if they were here, I-- we know one of them, I know, Nick and I know one guy, he, he would check it on a different hardware wallet, right? So it wouldn't be two cold cards, he would

check it In general, just, you know, because we're talking about this like at a, at a somewhat academic level, I don't want to scare users away from using a hardware wallet, right? Because ultimately, you know, I think, you, you know, you should, there are other risks to think about, right? Because it's important to, for people to understand that the way that most people lose coins, at least up until now, has been typically user error and, you know, lost coins and maybe, like you said, this kind of phishing attack or maybe- Maybe, somebody leaves their coins on an exchange and they get SIM swapped and then, you know, the, the coins are stolen out of the exchange that way. So, you know, for most users, if you buy a reputable hardware wallet, get it from the manufacturer You know, check the firmware, that gives you at least some level of protection here, even though it's not guaranteed. And do the thing

where you don't give them your real address or real email thing, you know, because that turns out in practice to be important. We know people who've lost money just 'cause they were on that ledger list, right? And then they get the re- a really nice looking phishing email. and they weren't sophisticated enough to detect that they downloaded the wrong software. and then they were restoring, they were putting their seed words in, they got told to put their seed words in to this new software they just downloaded.

Yeah, and I think the other thing is, obviously, all of us here on this call are less likely to fall victim to that, but imagine, you know, we get, we die or we get incapacitated, and then like our wives are like having to deal with this stuff. Like, do you think your wife is gonna be able to kind of make heads This kind of thing, you know, so you've gotta, you gotta think about the person who's, gonna have to come after you.

Totally. We're not trying to introduce in the scope of the discussion any kind of new user practice or something. They're complicated enough, it's hard enough we're definitely not trying to do that.

Yeah, you raise really good points to find that, yeah, there's a lot, there's many more easier ways to lose your Bitcoin, and so, yeah, Dark Skippy does require that your device gets corrupted, somewhere down the line, whether that's someone in the middle of the supply chain, whether that's, a dodgy update you get from, you know, a malicious website, whether that's, it could be even the vendor themselves, it's sort of like this, you know, idea of a retirement attack that, the hardware wallet manufacturer could be running this attack in secret, and then just sort of, you know, collecting seed phrases up until they're ready to retire and steal everything. but yes, it, it does require the signing device to be corrupted and be malicious. And now for, for some devices, it's a lot easier to corrupt some devices than other devices. so your, your Coldcard or your BitBox, for example, they will verify the- The firmware signatures on the device. so even if you downloaded a dodgy update and tried to install it, the device would complain, probably-- I think the cold card would give you, you know, the, the flashing red light or something, if you did that. Right. I think it

just-- I think it won't run on cold card, it just won't run at all. Like, I think that's the case. I think that's the case with most of them, just won't run at all.

Yeah, and so my understanding with that is, I don't know the correct term, I believe it's firmware attestation, but the idea is on the device- It's called secure boot. Oh, right, gotcha. And so the idea is you're downloading some software, that software theoretically should be signed by the manufacturer's key, and then your device is kind of running a check saying, "Hey, let me do a, like a PGP verify to

Use firmware like from, you know, some other person, your device is gonna realize that and be like, "Hey, this isn't signed by my manufacturer, therefore I'm not going to run this." So that's where some of the commercial hardware devices, like, you know, the Coldcard and the, you know, the Bitbox and some of these others, will have checks against that. Whereas, let's say a seed-- and it's not like an attack on Seedcoin, but it's like, let's say a Seedcoin won't have that check because it, it just fundamentally doesn't

Old laptop won't do that either, right? So if you're, like, if you've, if you've, in your threat model, you as a user, in your threat model, have someone who's gonna tamper with your device, like, I don't know, like a clever roommate or whatever, who's gonna have you mess around with your device. they know how to, you know, install Ubuntu or they know how to install your operating system, and then may, there may be like a bit of a, a bit of a hacker or, you know, they may be able without you knowing it, unless you know exactly how what you're doing and exactly how to test that, set that laptop up, there is, you know, I do see this advice coming around like just use an old laptop in response to like our disclosure, and I don't agree with, to the record, I don't agree with just use an old laptop. I think secu- the secure boot thing, where there's a signature on the firmware, is hugely important. just so it just narrows the number of people that-- it narrows the number of people that could be who are attacking you, which is literally only the people who are manufacturing the thing. Right? Unless they lost their key, but that-- hopefully they're, that's their one job, hopefully they're good at that, they, they can keep their keys secure. So if anything happens, you know exactly who it is, who did this to you. Another thing that helps with that is like a genuine check. So if you can check the device is genuine you can do that cryptographically also. You know, there are, you know, it doesn't, you can try, like, the advice has come out, we just order from directly from the vendor. I think that's a, it's like a decent, decent advice. It's, I, I think it's worth going the extra mile to also Have the software, like the, the coordinating software, be able to check, and that device can prove it it's actually genuine before you start using it. not everyone's there on, not, not everyone's there with me on that one, but I absolutely think that that's good, but I think that's kind of what you're getting from these hardware wallet companies at the moment is They are the only ones who could be at fault. If something goes wrong, as long as you follow the steps, the only thing, they should be the only ones who could be at fault. And what, what we're, what we're proposing, what we're saying is actually maybe we can even do better than that. if something goes wrong, something cannot go wrong, right? Even if they are fully malicious, like these, we could hold the, all these companies, which we are trying to be one of them, by the way, we're working on a product, and so we could, we, our de-our devices will have this property that even we couldn't attack you, as long as you're running the right software on the coordinator, and of course, getting the right software is a whole other issue, and that's actually difficult in practice to do it in theory fully correctly, but, you know, Well, but if that software in the coordinator is correct, the, the even the, the, the manufacturer couldn't do this attack on you, just if you're, if you're an expert user who doesn't fall for tricks, like no matter what you do, right? Your cold card or your-- any of these BitBox or any of these hardware wallets could still show up a thing saying, "Oh yeah, just, go to this URL and show a QR code on the device, right?" And you go, "Oh, go-- I need to get an update. This, this-- Like a URL, and the in the URL has your seed words, and you just send your seed words over to, like, you know, over to them, right? Over to the attacker, which in this case is the manufacturer. They can still do these attacks, so it's not perfect But they all have some element that you can notice, it's different from what it should be. There's some-- all these attacks will have to be noticeable that it's happened? And that is, that is where we're sort of drawing the line with our security model. We can't make it perfect, we can't do everything, but we can make it so that an expert user would definitely notice something different is happening than usual if the attack is happening. And then at that point, we clear no, no hardware wallet meets that, yeah,

yeah.

No hardware wallet meets that criteria right now, but in three years, five years, I think it could be that everyone meets that just through the competition of the, you know, the market

This show brought to you by mempool.space, the world's leading Bitcoin visualizer, and now they've got an accelerator program. So if you have a transaction that you sent at a fee that was too low to get confirmed, now you can fix this with the mempool accelerator. The way it works, you can go and search your transaction, scroll down, click accelerator, and you don't need an account, you can pay with Lightning, and then it'll show you it's now in the process of being accelerated, and then after a few minutes, it's confirmed. And so this is a great way If you are stuck, and this can happen where maybe your wallet doesn't have RBF or CPFP, or it might help you in situations where it's impractical to go and re-sign, so for example, multisig with keys in different locations. And thirdly, even in some Lightning scenarios, perhaps a forced close, you might not be able to use RBF, and so in this case, the mempool accelerator can help you out. So keep it in mind, and you can find out more over at mempool.space/slash-accelerator. And now back to the show. I see, So let's talk a little bit about some of the mitigations people were talking about. So as you said, I, I agree, I think the air gap computer thing is just, it's, it's a joke, right? Like people need to really understand that it's, it's incredibly difficult to secure, even if you went and found one of these old ThinkPads from twenty ten or whatever, like just the reality of it is that most people who try this will lose money. Even Luke Dasher, right? Core developer, been around for a long time, you know, I think he lost

Who are kind of more known in the software space, and they're not necessarily as strong on the hardware side of it, and then they give people bad recommendations, and I think to be honest, most people are better off just getting a hardware wallet. Now, of course, if you wanna be extra secure, I think it's multi-signature with multiple device types is really the kind of, the best that we have today. but other people are also-- there has been some discussion about anti-klepto, so maybe we should get into that also. So as I understand, the,

Klepto, as I'm aware. so maybe you guys wanna just discuss this whole topic of anti-klepto and, the relevance here.

Yeah. just before that, I'd like to mention that, yeah, some devices it's a lot easier to swap out the firmware, than other devices. So some of these DIY signing devices, you know, you could, you could leave one on your desk and someone could, you know, just sw- swap out the SD card, with a, with malicious firmware that's gonna run this dark Skippy and so there's a number of reasons why we think, the, this Dark Skippy attack would be most effective in that scenario, that it's even if you generate your seed phrase securely, even if you, you know, you roll dice, you draw seed words, you verify conversion from seed words to xPub's, you do all this properly, the moment you sign, your seed rate, seed phrase will get leaked out to an attacker, using the, the blockchain itself as the key- communication channel. and so, yeah, some devices have implemented this anti-exfil or anti-klepto, signing protocol which tries to disrupt these kind of attacks.

Lloyd or Robin, do you wanna go into the details of how, how those work?

I, I wanna say something first, like there was some, so this anti-XPub, before we go into it, is like, it is definitely, I don't think people who haven't implemented are incompetent or irresponsible, like at this point, and one of the main reasons is that The, even if you do this thing, you prevent Dark Skippy, right? Most of the device, all of the device designs still wouldn't be secure, actually, in the, in the, in the basic model because of the key generation, right? The, in fact, if I would have solved one problem first, I would solve the key generation thing. It's kind of due to some weird- Weird specification friction, I think, that we have s-- some companies or some, some systems have solved this, this nonce issue, and both the issues are really the same issue. You've got this trusted, this, this device that is, this has the, has the key on it, it's trusted to do signatures, but it's also trusted to generate keys, and actually both of those two things are the s-- trusting the same thing, which reduces to generating a random number or generating a random number Number correctly, right? So during key generation, if the device doesn't generate a truly random number and it just generates, you know, some, some seed words that are on the, the Excel spreadsheet of, you know, hardware wallet co HQ you're, you're tr- that's a trusted third party operation at that moment. The hardware wallet is basically just another trusted third party. it's not as bad as having your money on an exchange, okay? I don't wanna say that, make sure we understand it's not that because they're-- if they do, if it gets-- if they get it right the first time, you can't be hacked later on, right? If you have a good hardware wallet, right? So, so at least, but at that moment, during that operation, you're And what with Dark Skippy, what's showing is very unintuitively and unexpectedly, unless you follow the cryptography closely, there's a random number in the signature also that happens to, 'cause of Robin's invention here, it's hap-- it now basically is one to one. Like if you're generating the, the key generation, random number, you can lose all your money if it's malicious, and in, in during the signatures, if they choose that random number, it's also, it's also you losing all your money. They're a trusted party during the signature generation and during the Key generation. So this anti-XV thing is an approach to stopping that happening during the signature generation, but you also, if you want security, you also have to do it during the key generation And actually picking your own seed words doesn't stop it either. You still have to have another device, right, that you check that the xPub you get, that you actually give out addresses on, is actually the one from the seed words, right? So just 'cause you made your own seed words doesn't actually stop the key generation problem. So no device can do this by themselves, you always need a second device to check. So like, there is no-- there, at, at, in my, in my analysis or in my My security model, like all these devices have the same security, anyway. So there's no real-- there's no, the, putting to the side, there's no, there, there's no, there's no real, you know, no one's getting above the other one in my opinion here, okay? So The, the, the hardware wallets that have implemented the anti-XVill that stops the attack during signing, okay? Now, if you've done the, the, you've done the verify, now the way it does that is The, the coordinating device and the signing device, the signing device isn't allowed to generate the nonce by itself. It isn't not allowed to do the signature just, and just do it. The signing, the coordinating device Helps generate that nonce, and they play a little cryptographic game with each other, and that's why it only works with the USB, based devices that are plugged in. They play a little cryptographic game with each other to generate the nonce. And that, that is the nonce that ends up in the signature, and there's no way that nonce can contain any information then. That's basically what the anti-exfil, thing does.

And so yeah, one of the, the sort of, maybe the hesitancy for people to adopt this anti-exfil signing, as Lloyd mentioned, is that this, this cryptographic dance is, adds quite a bit of burden if you're doing air-gapped signing. so what it would look like is like an extra round of QR codes or SD cards, back and forth between Between your signing device and your, your wallet, for each signature. So instead of, you know, scanning the transaction, signing it, and showing the signed transaction back, you would have to, you know, scan in some, some nonce commitment, I think, then show something back, and then scan in the transaction, and then sign, and then show it back. So there's this extra round of QR codes, which is, a bit extra painful if you're doing air-gapped signing. so at the moment- And especially if you're talking

Like, let's say you're doing three of five or two of three, and they're in different locations, so now you're having to kind of go back and forth, or maybe you gotta bring a laptop to kinda do the extra rounds 'cause you're going into the mountain or wherever your extra, you know, your keys are. So it just, it's gonna be another whole round now. Impossible. I think listeners don't lose hope, I think in the future there's a hope that PSBT, can be upgraded, but, we're just kinda explaining where things are for

now

Figure out better ideas, but we're trying to figure out like, yes, what could you do on the PSBT? So just how could you do it in one round? So it really is just that QR code is enough? And the device itself cannot-- it has enough randomness or there is enough disruption of the nonce producing process that the device isn't left to it by itself, and then we can stop the attack in one round and actually have These air gap signing devices sort of reach that level of security, like can we do it in theory? And then we also have to fix the key generation problem, 'cause most, you know, most users aren't doing-- fixing that, and then maybe we could have actually all these devices Meet this higher standard, that, you know, of course it's not like a, a pants on fire problem today, but it could be, you know, once other problems are sorted out, this could be the worst problem in Bitcoin, personal Bitcoin security, like in a few years. So it's good to kind of start this conversation now amongst the developers. That's kind, that's

what we're trying to do here. Yeah. Robin, anything to add there or, you know?

I, I just thought that it's, funny that this is the reason why people like Andrew Polster work on stuff like Codex thirty-two, where you like compute the public key from hand.

But you still need something to sign with, so it's just not really, it's not gonna be very practical, right? You don't compute the public

key from hand in Codex thirty-two, do you? No, there's no way.

yeah, like not directing co-CODEX thirty-two, but he was also working on actually computing the public key by hand and like computing signatures by hand and stuff like that. Also the true altrnernauts. If you would work on it full-time, I think that

would take

a month or so. Full-time, it would take a month.

True low time preference Bitcoin, Bitcoin, but, yeah, I get the job for a month

and then you can spend your Bitcoin just there like crack, crack.

Yeah. Okay, so look, in practice, the idea that seems to be people are talking about is that perhaps there could be a new version of PSBT, Partially Signed Bitcoin Transactions, and that could include some info from the coordinating software, whether it's Sparrow or Specter or Electrum or Nunchuk or whatever, and that is another way to mitigate this, this issue around, as you said, around the signing part of it, but not necessarily the upfront key generation. Now, upfront key generation, I guess the main-- Well, I guess the main- Mitigation now is you could be di- doing dice rolls and verify it with two separate devices, or, of course, having kind of multisig with different devices also kind of helps you too, because like, what's the chance that somebody has pwned you across multiple devices?

Yeah,

exactly. Or, or the draw-drawing seed words out of a hat is another pretty common one, and then generating the twelfth word on, on a device, the check, the checksum word, yeah.

Gotcha. Gotcha. Yeah. And I think more and more hardware wallets are now having that feature. I remember back in the day, Speck the DIY was one of the first to have this kind of calculate the twenty-fourth word. So the idea is you could theoretically have, you know, you could print out the bip thirty-nine word list of two thousand and forty-eight Key three words and then type them into the device and it can calculate your twenty-fourth word, and then that would be your seed for that device. Now you could do that for, let's say, three devices or five devices, and now you've got multisig where you've picked the seed, so that helps you with your upfront key generation, but then we still have to solve the signature or the signing point when you go to spend, right?

You also have to do the xPub thing, yeah? You've got these extra devices, and that's the annoying thing about it, okay? Like, I think that the multisig point is a good point, that if you're doing multisig with multiple vendors, okay, what we're saying is, yes, these devices are trusted third parties at the time of key generation, at the time of signing, but if we split it into multiple trusted third parties, then it's not longer fully with one trusted third party, and I think that that's a hundred percent true. But also, it'd be good if they weren't trusted third parties. Like, even if you were doing multi-multi-sig, like it's better not to have the attack to have one of your keys just like accidentally. It's wa- it's, it removes the worst attack, which is I just sit here at my computer and watch the seed words come in, right? Watch the, watch the money accumulate, as I-- and then I wait a few years, I retire and go, disappear, fake my death, and then I take all the money, like if I'm a Then it's fantastic. But if I'm a hardware wallet manufacturer, we, we just exclude, we, we, we, we using multi-vendor, multi-sign, you exclude that awful, awful situation, which I definitely don't think is the, none of the hardware wallet manufacturers are doing this, one hundred percent I'm, I'm, I, I would put my life that like the, the ones we know, especially the Bitcoin only ones, none of them are doing any attack like this, no way. But it's still, like, it's still a thing 'cause we say don't trust, verify, but then we have these things that are like trust. So we store our money on things that are trust, and that's just where we are right now. I'm trying to convince people-- We're trying to convince people it's not where we could be, actually. We could do better than this. And so yeah, we've got to solve both problems, and I think both problems like are solvable, that's the key thing. These two random numbers, we don't have to let the device generate the random numbers themselves, and we don't also have to spend a month Doing math, either to, to do it by hand. We just have to say, okay, during key generation, it's gonna maybe get a little bit more complicated. That's the one, I don't, I don't know how to get rid of it, because in signing, you have this PSBT thing going on, right? And there's QR codes going back and forth. But I think we could make key generation like that also, like, I mean, it's just a one-time thing, right? And so we could make key generation go back and forth, like just, you know, I want to gen-generate a new key, go to my cold card, I go to my Sparrow wallet or whatever, and I want to say generate a new key, and it shows me a QR code and it kind of generates something together, kind of thing. Yeah, and then it goes, and then, and then it's done, just in like, in the same amount of work as it doing a signature. I think that that isn't, doesn't really add to the work overall. It's not that hard,

yeah. It's not that hard, but the big

problem is, the reason why no one has done it is it kills BIP thirty-nine seed words. That's the reason. So you can't use BIP thirty-nine seed words after that. You have to make a new- You can still use words, of course. There's nothing to stop you with words, but the BIP thirty-nine seed words specification will not work, is not compatible with any solution we have for that, and that's Lightning is fixed on some devices, but the key generation isn't, because everyone sticks to BIP39 seed words and no one wants to go away. And

in fairness, I think it's fair to point out, right? Like there is the security element, but there's also, you know, redundancy, backups, recoverability, verifiability. There are some benefits that come to us from using BIP39 and being able to kind of portably, you know, as an example, if you have a device failure, right? Like we need to think about that too, right? Imagine And it's ten years, fifteen years from now, there could be a device failure and people having the twelve or twenty-four words written down and able to just kind of, "Hey, if you need to recover this seed, just write the-- or enter these twelve words into a new device, now you can recover the device." You know?

Yeah. And there's even, there's even tools to like help you fix them, I think, like if you've, if you've messed up a word or whatever, like there's some infrastructure and some expertise that have gone into this particular, you know, backup format. And yes, if you've ma- if you've, we've mastered this backup format, it is, a spicy proposal, it's a risky proposal to change anything about that, right? backups. But if you want to, what we're saying is we wanna hit this level of security, we do

Bitcoin's gonna last a hundred years, and if this thing is gonna mean we're gonna last, it's gonna last a thousand years, or we're building it like we're building it on that assumption, right? we're gonna, we're gonna have to accept that at some year, maybe it's not year twenty twenty-four, that we probably wanna make it so that the keys Are not generated by a single device, but maybe not, you know, that's what we think. But you know, maybe there are other

mitigations there. Maybe there could be some other kind of, you know, pocket computer hardware wallet thing that helps you generate, you know, for other private key devices, you know, like there could be other ways to kind of do that while still keeping bip thirty nine and then do PSBT on the signing side, yeah.

You can verify it with something else. That's the, that's really the only thing we know how to do, or do a very, How you would use zero knowledge proofs in this setting? It's kind of like, right, there isn't a way to do it. The reason, I mean, I hate it, like, I hate that idea of using a second thing, and here's why. Like, you know, let's say we all had dice And we all, we, but some of our dice are loaded, so they're biased dice, right? How could we all come up with a single random dice roll together? Okay, so it's, we could choose one of us to roll, but then we might get a loaded dice, we might get a biased dice wrong, right? But there's a very simple way in mathematics that we can do this. We can all just roll our own dice, some of them loaded, some of them not, and add them together. And divide by like six, roughly, right? Okay? And then, and then just get the rema- get the remainder, okay? And that gives us, no matter who's loaded, we get this, this correct answer. Now, what the, the verify with the pocket computer kind of thing is saying, "Look, okay, we're just gonna roll one dice, and we're gonna use X-rays to detect whether the dice was loaded or not." And like, it, it's annoying to me just like that there is-- when there's this very elegant mathematical solution that just works, We should just roll the dice in the first place that is secure and not just not even deal with the loaded dice thing.

Yeah, so we'll see what happens there. I think the other component is just to reflect some of the community discussion and some of the developers as well, people like, as an example, Red and Code, aka Brandon Black, he was talking about this idea that, look, the same threat actor probably has other ways to achieve similar ends right now today, right? That they could, as an example, create a malicious device with WiFi or 3G on To help exfiltrate the seed in some other way. So I guess what he's trying to say there is maybe not that, oh, this attack doesn't work, it's just that there are other lower hanging fruit in the attacker, the malicious person's toolkit that they might use first before getting to this dark Skippy level. Any thoughts on that, gentlemen?

Yeah, and like the, the pre-generated seed is a really good example of that. but the, the really powerful thing with dark Skippy is that it would affect even those users if they- They rolled their own dice and generated their own seed. It would still, if they use, end up using a malicious device, they bring their seed phrase to a malicious device, all their money will get stolen. and so there's, that's sort of one of the benefits, and it's, it's actually not too hard to implement. So it is kind of like, i-it kinda is still like low-hanging fruit, you know, it doesn't require any components on the device like, you know, a WiFi or radio transmitter, And all it requires is the existing communication channel of making Bitcoin transaction signatures to leak your seed phrase. And so there's no extra sort of component that you need to put onto the hardware, and that-- and you can do this, this leaking of the seed phrase can be very covert, so only the attacker will be able to look up the tran-- see the transaction on chain, and then chuck about a bunch of computing power at the signatures to, to exfiltrate the- the, the nonce out of the transa- so to exfiltrate the seed phrase out of the transaction. so we think it's still like quite low hanging fruit, and especially when you put, put in the context of, yeah, some of these more DIY signing devices which can easily have the firmware swapped out. you know, we've seen habits of people selling them at meetups or conferences, you know, you don't-- they're a little, quite a bit less trustworthy than the hardware wallet, manufacturers. they're, they're a bit more vulnerable to having, you know, you leave it on your desk and someone just comes and swaps out the SD card with malicious firmware, so that it is still quite a low-hanging attack I would say. I, I,

I think that, like, the, to address the, like, the Wi-Fi thing directly, I think that's, that's a great objection to adopting this model, right? Okay, so if, if we assume that, like, the person is in 3G, whatever, range or 4G range or LTE range you could fit a very small antenna into these devices, yet for-- and maybe probably get signal. and then, then it would make it, you would be even easier communication than needing to communicate with the blockchain, just, send it straight out. Right? So I think that that's a, a decent objection to it. Now, when you take it in combination with other things we've talked about, like, right, if it's-- we're doing the more, more important thing than Dark Skippy, which I think Nick is alluding to there with the DIY things, it, you really gotta have, like, someone's gotta be responsible for that thing, okay? So- If, if it's you, okay, but make sure no one can tamper with it. And I think Specter DIY has a way to do that. Actually, Specter DIY, you can do the secure boot thing. So you can build your own Specter DIY, you can make it so it will only ever run the signed Specter firmware. And then at least it's either you who messed it up or like you're attacking it, where you can't attack yourself, so that wouldn't make sense, but the Specter people making malicious firmware. And it's all open source and can be generated

Devices like the, the commercial ones, you, what the, the key thing we, I wanna say is like you gotta make, we want to do these genuine checks, we wanna do like the secure boot thing so we know who is at fault, right? And so if you, that's more impor-- like that's definitely more important than dark Skippy knowing, making the validity of that hardware is more important than protecting against, dark Skippy, I think. So checking, checking the validity of it now. If you're, you know, now we know that if we have something going wrong, it's definitely from Coldcard, right? Or it's definitely from BitBox, it's definitely from Blockstream's Jade, right? The guys manufacturing that. And now we're gonna, now they're gonna put like an extra WiFi chip, right? 'Cause no one else can do this attack apart from them at this point, right? 'Cause we've got that check. No one else can do that apart from them. So they're the ones putting on a malicious, antenna And 4G chip into this thing now, that's kind of like, that's something that would go through like many, many people within that organization, right? Like we here in a hardware wallet company, there's no way a hardware guy is slipping on an antenna that we can see on the PCB and see the chip and the thing. That's not happening. So like everyone as part of that manufacturing pipeline would have to be on board, like, "Yes, we're putting a 4G in your hardware wallet for some reason, right? " before it gets shipped out. And so that's what I would say against that. So like, Dark Skippy, like, whoever's loading the firmware could do it. If the, if the person loading the firmware and the person signing the firmware is the same person And so I guess your, your

counter argument there is it's more susceptible to whistleblowers inside the company raising the alarm, being like, "Hey, something malicious is happening, they're putting Wi-Fi onto the hard, onto the commercial hardware devices, and that's how you're gonna get pwned," compared to the firmware pwning.

Yeah, yeah, I think it is much, much more, and even like there are paranoid people who open up their devices, you know, and they're gonna see this extra component that, that does happen. I think that that's, That, I mean, but it is a good objection, like don't forget that in this whole conversation, don't forget that yes, you could just slam in a 4G thing and it's all much easier. You have malicious firmware and you have a malicious actual hardware component and you've also got the same attack. this what we-- what we're saying is they would have to go and do malicious hardware, right? They would actually have to go and add extra chips onto their PCB And that's, it's, it may be worth making them do that. Like, number one thing, make sure it's those guys who did it. Like, make sure we narrow the scope of who can do this attack on you. Then, once you've narrowed the scope, let's make sure that they have to actually add chips and stuff to the actual devices.

Gotcha. So let's try to spell it out then, in terms of concrete steps to improve the ecosystem security. So I guess what I'm hearing from you is secure boot, having some form of secure- Still boot across all the hardware devices, ideally upgrading the PSBT process at the s-- to help you at the signing process, and then also hopefully in the future some way to improve the randomness of the initial upfront key generation, whether that's having like some other pocket, pocket computer or some way to verify across devices, those, I guess, would be kind of three steps that would really help, right?

Absolutely, yeah, yeah. That, that would make things, the, the back-- We

will have ZKP's that are efficient enough. Robin, say again? I said at some point we will have ZKPs that are efficient enough to prove that the nonce was generated correctly. I see.

So that, that might also be another longer term answer.

Yeah, so that's something we didn't really mention much. Is so, at the moment, the idea of deterministic signatures is that you check, on, you sign on a second device and you compare the signatures to match. but there are, there are other ideas like, Lloyd shared with me, Purify from, Muzig DN, which it provides the, the signer will provide a proof that it's signed with a particular nonce, and you could give this proof Proof to a secondary device, be- that could be the companion app, and it could verify that actually it signed under, you know, a, a nonce that it was meant to sign under and not something malicious. and so w- one of the problems with deterministic nonces, as we mentioned, is that at the moment you need to have a second device that has your private key on it, to, to produce the sec- the, the same signature and verify that signature, but with, with some zero- Dodge proofs that you've of these deterministic non-deterministic nonces, you could, you don't need that, you could just sign and then send a proof over along with it, and anyone could verify that you're not doing anything dodgy. I see.

Yeah. So look, I think we're coming to the end of the episode, let's kind of wrap things up. I guess I'll kind of give my- Layman's summary in like a minute or two, and then you guys can have your closing thoughts as well. So essentially, Dark Skippy is a new way to quickly and easily extract people's Private keys and seed words in a really unknown and really secret way that you could theoretically get pwned, even if you were airgapped and even if you rolled dice and all these things, because it's kind of happening at a very base level of the cryptography in terms of the nonce and the way that they are kind of letting the, the seed words be exfiltrated through the blockchain. Now, I would also say listeners shouldn't, get overly scared, like today, right? Like if you're listening today in August 2020 Therefore, you shouldn't be thinking, "Oh no, I'm just gonna, you know, give up on Bitcoin security altogether." Like you are still better off getting, you know, a reputable commercial hardware wallet and using that. And of course, if you're able to, maybe learn to use multi-signature with multi-vendor, that would give you a decent level of security here that is probably the best that's available today. but the longer term answer is, yeah, maybe there needs to be certain mitigations and certain improvements to help, reduce Reduce the overall, risks of something like Dark Skippy and just other security risks in general. any other closing thoughts you guys wanna add?

Yeah, you raised a good point. So like Dark Skippy isn't something that we've seen in the wild. it took these two wizards to come up with it, and a lot of hours of coding from Lloyd to actually make, implement the attack, into software, That's more so on the attacker's side to actually in- to, to break the low entropy nonces that have your seed phrase in them, the, the code for that is, you know, it's, it's quite a high barrier of entry, so we, we don't think anyone's performing this attack at the moment. and if you, if you were really worried about it, there are, two devices which implement anti-XPhil at the moment, which is the Jade and the BitBox, so you can check those out. If we ha- we often get a lot of questions about, you know, does a, a passphrase protect me more? Does twenty-four words protect me more? and just, I'll just maybe comment on this quickly that they, they don't really help. instead of being one or two signatures to leak your seed phrase, it might be, you know, two or four signatures to leak your, your seed phrase. and if, if you've got any other questions, darkskippy dot com, has an FAQ where we, we try to answer pretty- Pretty much everything, even questions about multisig and such. So yeah, please check that out if you got other questions.

Yeah,

Robin, a little bit.

Yeah, I got, I mean, the closing thought, it is, there's, there's no, there's no nothing you need to do right now, certainly about Dark Skippy, there is nothing you need, it's not, probably not ever, like if you've got an honest hardware wallet Well, if you're happy with it, not-- if you're sure it's not malicious, right? if it w-- it definitely doesn't have this attack on it anyway, even if, even if it was. So it's more like maybe in a few, once we've released the code and stuff or going forward, Something you can maybe think about is that the tampering of your setup, right? There's a new way to tamper. If your device is easy to tamper with, and it doesn't check that it's got the genuine firmware The stakes were raised for getting malicious firmware on your device. To, to sum it against the paranoid dice-rolling, you know, user, right? If you were that user already. If you were just letting your device generate its own seed words, there is nothing you need to do absolutely guaranteed. That means you're already trusting the device, and that's fine. It's just, w-it's really nothing for any user to actually do. It's, it, it's just an interesting, it's, it's an interesting thing that people who are working on these products can put into their, their knowledge base, to users to some extent can use this information to assess their setup. but probably I can't imagine there is any user right now who needs to change anything, whatsoever. Nick and I are working on a hardware wallet called FrostSnap, and that's why we were interested in this topic. And the, the interesting thing about Frost is that it's much more sophisticated, and it-- oh, there they are, Nick's got holding them up. They're much more sophisticated, and you already need to kind of do all these things already. So during the key generation, it already has to be interactive just from the crypto- Cryptography we're using, which is like this compressed multisig, like this, new, new kind of multisig that I'm sure, you've probably done an, you've done an episode with Nick on it already, I'm sure. Yeah. So we, yeah, so we, we have this new multisig thing where you have single signatures for no matter how many part-- a single normal, it looks like a single normal signature, no matter how many participants are involved, and for that cryptography, you need to do the nonce protect, you basically get it for free basically, for

Protection, you basically get that for free, so maybe that's the way the things will come in to the market, maybe like, you know, all the hardware wallets will be doing frost in the future, and that's really the, the way things will change Once again, nothing you need to do, but hopefully, I think, I think that, that we should actually, as an industry, aim for that level of security that the hardware wallet manufacturer itself can't even attack you. you know, why should a device that should be only trusted to generate signatures be able to communicate through the internet, to other people, to people? It doesn't seem like that's the capability that kind of device should have. And you can see in the Seed Sigher, like the design of it The, like, the design language of the device seems to be that this is just a boring signing device, right? It's fully air-gapped, it can't do anything other than produce signatures And a lot of the products seem to have this kind of design language to them, I think we should make that a reality. I think it should just be this boring signing device, and I think we can get there. And so that's what we're trying, we're just making the campaign now, and we are working on ideas that we can make it easy, make it as easy as possible for the implementers, and nothing whatsoever needs to happen for the users.

Yeah, the- That's the goal. Yeah, the suggested mitigations that, that we have don't add any extra rounds of signing. That you can have an anti-exfil with like the user won't even notice it's happening and there's, there's actually nothing the accompanying wallet can do, you know, it can't do anything malicious, all it can do is like do the anti-exfil poorly, so it's like it's, it's, it's no real loss, for the user and it's actually, we think it looks quite easy to implement as well Yeah. So yeah.

Robin, anything, anything to close out from your side? No? Okay. Well, let's leave there. Listeners, check out the show, show notes, of course, darkskippy dot com, and to check out, what the boys are working on, frostsnap dot com is the site. Thanks, guys, for joining me today.

Thanks very much, Stefan. Really appreciate it.