Quantum Computing Threat to Bitcoin and Next Generation Bitcoin Hardware Wallets

Hi and welcome to the Stefan Livera podcast focused on Bitcoin and Austrian economics. Today, I've got a fascinating interview with the brilliant Stepan Snigirev, CTO of Crypto Advance. But first, let me introduce the podcast sponsors. So firstly, Kraken. They are one of the longest standing Bitcoin exchanges, they're consistently rated the best, they've got a really high High quality platform offering the best liquidity in the industry. They also have a very strong focus on security, offering things like two factor authentication, no phone or SMS account recovery, so your account stays in your hands. They've got PGP signed and encrypted email for secure communication if you wish. They've also got high priority twenty four seven live chat and email support for urgent concerns. On the institutional and business solution side, they're very popular there too, with customers from funds and asset management to trading firms to crypto businesses. They offer the highest available API rate limits, there's also a Kraken OTC desk. Kraken offer five fiat currencies and they also offer margin and futures trading. So if you wanna learn more and sign up, go to the Kraken link in the show notes. My second sponsor is Unchained Capital, so they're a Bitcoin financial services company and they've got two main products, one of which is a two of three keys multi-signature vault product, and this is really good because it can help you distribute your keys and help protect you against that. proverbial five dollar wrench attack, and you can still maintain control with your two keys and reduce that single point of failure risk, and this can work well for individuals or for institutions. I've set up a vault with Unchained, I found it super simple and easy. If you create an Unchained vault, you also get three free months of access to SafetyNetMuse's Bitcoin Standard Research Bulletin. Unchained also offers Bitcoin collateralized loans, allowing you to get USD liquidity without selling your bitcoins and not triggering a capital gains event. So this could be tax efficient For a hodler, enabling you to continue hodling rather than selling bitcoins. So to learn more and sign up, go to the Unchained Capital link in the show notes. So this interview with Stepan Snigirev was recorded just prior to the Bitcoin 2019 conference in San Francisco, and it's a really interesting conversation because Stepan is able to credibly explain why the quantum computing threat to Bitcoin is overblown, and we also talk about some of the work that he's doing on hardware wallets. We talk about some of the challenges faced by hardware wallets Today and the opportunities with hardware wallets going forward, and then we also talk a little bit about what he's doing with Crypto Advance. So with that said, onto the interview. Okay, we're live. Welcome to the show, Stepan.

Thanks. Thanks for having me.

Yeah, so look, let's just start maybe just give yourself a bit of a, an intro just for the listeners.

Well, so I, work, in the, Munich-based company that, is trying to build a, hardware platform for Bitcoin and Before, I used to be a quantum physicist, so like I spent my whole life in, experimental quantum physics, doing quantum simulators, quantum computers and so on, and, last year I moved to, to Bitcoin full time because, well It's so exciting, sometimes even more exciting than quantum physics, yeah? Yeah,

fantastic. So look, I, I know, that has been, common topic in Bitcoin. People have a bit of fear around this whole idea of, oh no, quantum computing is gonna come and is it gonna destroy Bitcoin and so on. And I thought it might be good to obviously talk with you about that. And I know you recently, appeared on Peter McCormack's show as well, talking about some of these topics. Yeah. so we'll see about if we sort of certain aspects in a little bit more detail, because obviously you, you, you know, we've got the expert in the room. so I suppose could you maybe just outline what is, what is the basic, the so-called threat?

okay, so what people are scared of, is mostly that the, classical cryptography will be badly broken with quantum computers. and in theory it is true, because there are certain quantum algorithms that are much more efficient than classical ones. and, if we could have a, a general purpose quantum computer that is powerful enough to do this, then, yeah, all the, RSA, elliptic curve, and other public key cryptography It will be badly broken.

Right. So let's break that down a little bit. So part of it is Bitcoin security is reliant on certain cryptographic assumptions, let's say, and some of that, there's different components of that. So one of them relates to mining, so that's double SHA two fifty-six, and the, the other kind of interesting one is around transactions, so that's, as I understand it, that's ripe MD one sixty and then a SHA two fifty-six hashing.

well, you're on I'm, talking about the hashing functions, but also another important assumption on, for security of Bitcoin is this, private and public key, and so discrete log assumption. So basically, if someone knows your public key, they shouldn't be able to, calculate your private key. Right. and, this is kind of the one that is, very important for Bitcoin, because, mining, and hashing, well, we already have ASICs that are much faster than- than, than classical normal, general purpose computers. And then if the quantum computers will appear, yeah, it will be a slightly, larger mining hash and power, but, eventually it isn't super crucial. So, yeah. the thing is with hashing, and with this elliptic curves, there are two different quantum algorithms. And, if you look at how efficient a quantum computer is compared to classical computers, it strongly depends On the algorithm that is used. So for example, for, hashing for SHA-256, double SHA-256 or RMD or whatever hashing algorithm you use, there is an algorithm, Grover algorithm that is, kinda more efficient than classical, but not super efficient. So if we are talking about the complexity, normally with, hashing functions, to guess the, well, to mine the right block, you need to brute force, and, with quantum computer, you You can parallelize this brute force using this entanglement stuff, and it becomes a little bit faster. But basically, instead of two to the two fifty-six, you will need to have the, number of calculations that is two to square root of, two fifty-six. So it is an improvement, but it's not like, badly broken hash function. So it's just a bit faster.

Yeah. So if-- just to make sure I've got my understanding correct, and also just for the listeners. What you're saying there is part of Bitcoin security relies on there being this enormous search space and the fact that people must brute force, like literally just hunt, like kind of, trying to pick the needle out of a haystack, right? The equivalent of that. And what you're saying there is using, is it Grover's algorithm, we are able to theoretically reduce the size or like kind of search more efficiently rather than literally needle in a haystack searching, but essentially if I were to simplify What you're saying is, you-- while you can reduce that, it's just not to the level that somebody could, given your public key, figure out what is your private key, which would then enable them to spend your bitcoins.

Well, these are different problems. So, the hashing is determining this mining power and proof of work. Yeah. So with quantum computers, it will be more efficient, so probably all the mining pools will be replaced by the webs running quantum computers, and then quantum computers will compete with each other. Right. but- still it's fine. the other problem is, this, public-private key, problem. So and in here we have a quantum algorithm that is very efficient. So basically, if we have a reasonably large quantum computer and you give me your public key, I can calculate your private key, well Very fast, basically. So it's, like, all the assumptions that, public cryptography rely on doesn't work anymore. the problem is how easy, how hard it is to achieve and to build this machine. And, yeah, so I think that's, the, people overestimate the threat because damn, it's so freaking hard. I mean, you build a lab for five years, then hopefully it works, then you have some bright idea how to improve the This quantum computer a little bit, but still we are orders, orders, orders of magnitude, below what we really need for that. Right.

And so can you give us a sense of- Like where, what are the, what are the numbers that we're talking about here? And like, if it was even possible, how, how long would it, you know, would it be if there's, if you even have an idea of it, is it we just, we don't even know?

yeah. So, right now, the current kind of modern labs operate with quantum computers that have around, one hundred qubits and can, make around a thousand, ten thousand gates. So gate is basically an operation on the qubits, similar to C On, normal bits. So this is where we are, and we need to go to tens of thousand qubits and millions of gates, and we also need to reduce noise a lot, such that while we are operating this quantum computer, this, very complicated and, integral state doesn't, isn't destroyed. so I would say that, even if we, consider the Moore's law that, doesn't work on semiconductor industry anymore, and we assume that number of Of qubits will increase every couple years, then still we have at least a decade, I would say more realistically three, four decades before, the quantum computer will be built that can, break classical cryptography. So, because, well, yeah, there are breakthroughs that are happening every five years or so, but, still the field is very, very in, in the early stages. Plus, another thing, we will actually see how quantum computers arise. Because there will be other applications, that don't, require this, crazy amount of qubits. So we will see already a boost in artificial intelligence from Google and maybe some advances in, superconducting, field and material sciences and so on. So we will see that quantum computers arise and become useful, way earlier than they will be able to break classical computers.

Right. So you're saying in some sense we'll have warning signs. There'll be a canary in the coal mine before- Or the Bitcoin people would have to be worried at all because there'll be other things that break first.

well, not like break first, but actually there will be other things where quantum computers can be, very useful for society. So we will see these developments and, then we should, at this point probably start worrying. but I still think that, post-quantum cryptography needs to be developed because developing new cryptography is also very challenging. and this, probably what we should also talk about, like, post quantum crypto, is showing a lot of, progress recently, but the problem is that still it isn't ready for, pro-- in the production use. So it's still, more like a research. And if you try to use post quantum crypto now, then you'll be probably much more vulnerable, to normal classical attackers.

Right. And so the problem, I guess, the challenge that you're saying there is that if somebody wants to make a quantum-resistant crypto, coin and so on, the challenge then is that that coin may not be resistant against normal classical computer computation. Yes, yes,

exactly. so there was a competition, I think, by Neist, they, tried to, well, they code for post-quantum algorithms, and they think that, like ninety-five, ninety-nine percent of them were broken with normal classical computer- So just because developing new cryptography is extremely hard, and, yeah, we should work in this direction, but we shouldn't put real money on, quantum, altcoins. Because that's the

thing as well, right? There's a, there's a few people who, who try to drum up some fear, right? Because drumming up fear is a good way to sell things, obviously. And then they come out and they say, "Oh, Bitcoin's gonna fail because of this quantum problem," and now, here is my quantum shitcoin.

Yeah, and I, I think that better to, if you want to put money in post-quantum crypto, better to support some real academic research, and, with this, altcoins, I wouldn't consider them seriously, unless they have, an algorithm that is not broken for at least, I don't know, five, ten years, and that is also has efficient algorithms on classical computers such that, it is not vulnerable to side channels and all All other attacks, because, even if you have a very good theoretical algorithm, implementation is extremely hard. I mean, do we need then, if you want to use a post-quantum altcoin, do we need to put our private keys on the computer then? Because probably hardware wallets, for example, aren't capable of running that because it's, way too complicated, plus all the side channels and other kinds of attacks that are, pretty common even for existing classical, cryptographic algorithms. do they take this into account? I doubt that. Yeah. So, I wouldn't, put money on, post-quantum altcoins. Right.

And, another thing I was keen to ask you about around this whole idea of quantum is if there were to be these quantum computers out there, and I, I think part of it is you were touching on this earlier that we would know from other things, there would be breakthroughs in other advances of science, but hypothetically, if somebody had this sort of- computer and they were able to, you know, figure out your private key from your public key, we would have to change our whole model, right? Because in the past, people have spoken about this idea of, "Oh, if you don't- What's the word? If you don't kind of send your public key out, then that's a way to kind of help protect, you know, as though that would be a protection against quantum computers or at least some level of protection.

Yeah. So a, a few things here. So first, yeah, we, have in the address not the, just our public key, but the hash of the public key. and, people think that it is a good protection or some kind of protection against quantum computers, but the problem is that But when you need to broadcast the transaction, you put there the signature and the public key. So you are telling to, to, the whole world what is your public key. And if there is a quantum computer that is efficient enough, then this would be enough to, calculate your private key and maybe replace the transaction with a larger fee or do some double spending, especially if it is a miner. And if there is a quantum computer doing this, they are probably the miners because, they will have the incentive. Yeah, you have, Additional mining power there. So what they can do, they can see your transaction with the public key, you tell it to the miner, they, calculate the private key and spend all the money to them instead of, instead of what you wanted. Right. they take all the money, they mine the block, and, yeah, so the whole, blockchain will be screwed. And, and this hashing, part doesn't help. And I think this is the reason why in Schnorr signatures we aren't getting this,

pay-to-public-key Because, this kind of protection against quantum computer doesn't really work, but it messes up a few applications, for example, this, Well, com- the Taproot and combining with, additional scripts, so it becomes hard with, hashing, and so we would better just use a public key and it's fine.

Right. And I suppose just to maybe replay some of that, just to make sure some of the listeners can follow along what you're saying, the theoretical attack in this quanti-- if, if say somebody's got a quantum computer and let's say, you know, Stepan, you put out a, you wanna pay somebody with a Bitcoin transaction, they would read that transaction and they would see it as you broadcast the transaction, but before it's been confirmed into a block, they would then use the quantum computer, so to speak, and try to, you know, reverse out the private key and craft- their own transaction spending, say, those bitcoins to their own wallet, and if they're a miner, then they can obviously have, give it, give their own transaction preference to come into a block, or they could alternatively give a really high mining fee, more than what you gave, to try and help their transaction be the one that gets mined into the block, and then therefore kind of-- Yes, that's the theoretical attack. But obviously, as you've outlined, there's many reasons why that's not a very realistic thing to think of. Of as any kind of fear right now, and then the other point I think you were touching on was around, essentially there are different UTXO types, and, you know, in, in the, the old days, in the first few Bitcoin transactions, I think they really were pay to public, hash. And then other time, without the hash yet, so just pay to public key. Yes, sorry, yeah.

I think, some of the Satoshi's, bitcoins are, on the addresses that are just pay to public key.

Yes, exactly. And TXO types, so we had, you know, pay to script hash, and we've got pay to public key hash, which is the one you mentioned there, and then some of the SegWit ones, which were, I think it's pay to witness public key, yeah. Right. And so then- Essentially what we're getting out there is that moving to this new Schnorr proposal, it's, it's sort of gonna be a, it's gonna be going back to the kind of pay-to-public-key model.

Yeah, but it will be, pay-to not just a public key, but a kind of smart public key, right? That also includes, any kind of, multi-signature policies there and also the scripts. so it is a pretty powerful update, I would say.

Yeah, in terms of the new functionality that's, Going to be enabled. Alright, I think that they're, they're most of the key things around kind of the quantum, computer aspect, but I'm also interested to talk with you about what you're working on with, you know, hardware wallets and crypto advance. So look, I think let's set some of the context a little bit and talk about some of the challenges that, as we record this today in June two thousand and nineteen, what are some of the issues that hardware wallets today are facing?

So So there are a few things I think that, well, hardware wallets are great and some of them are, amazing. So, you know, one short at Trezor, guys, I really like them, and they're doing a what-- Coldcard also very nice and, Ledger have very, very good hardware. but, as this field was developed, well, all these projects started, in a way that, okay, we just want to keep our private keys safe. And And we don't care about any complicated scripts, we just want our simple pay to public hash, functionality. And so, it kinda stayed this way for, for years, and now maximum that we can get from hardware wallets is normally, paying to, normal addresses using either normal, Normal scripts like pay to pubkey hash or maximum multi-signature, nothing else. But in reality, the, scripting language is pretty powerful, and now we have new applications that are used very often. For example, the coinjoin transactions, become pretty, important because no one want-wants to expose how much money they actually own. Lightning network is really, really rising and, becoming more powerful and like all the way to solutions basically. And they- They rely not on a simple script, but, on some complicated approaches. So in case of CoinJoin, you don't have just your own inputs in the transaction, you also have a bunch of, external inputs from other parties. on Lightning, you also have all these, time locks and, CSV, CSV, HTLCs and other things. And, also what is very controversial for hardware wallets and unusual for hardware wallets, in Lightning, you actually need to give out the secrets to the other parties Party whenever you update the channel state. So it's like, what from the hardware wallet perspective looks terrible, like you are actually sending out the private key out of there, yeah?

Yeah. So, sorry, let's just, break it down a little bit. So just for, the listeners who aren't as, knowledgeable, Bitcoin Think of it like when you have, a piece of a Bitcoin, a UTXO, an unspent transaction output, there are certain encumbrances placed upon that UTXO, and the way that you may spend that UTXO is by satisfying the script, the locking script. And so what you're getting at, Stepan, is that there are, you know, more advanced versions or advanced technologies that we're coming out with now that allow things like different more, you know, different trees of, spending. So, a, an example might be, you can either do a two of three multi-signature spend or, but that results in some kind of time-delayed, you know, Bitcoin transaction, or you can have maybe a three of three and it's automatically available now. So some of these more advanced scripting options. And I guess what you're getting at there is that Our hard-- the, the, the hardware wallets that are commonly available right now don't necessarily help the user do some of these more advanced functions.

Yeah, so unfortunately at the moment, if you use a hardware wallet, you have to stick with the security model that the, manufacturers and designers of the hardware wallet decided is good. and, you know, the Bitcoin community, varies a lot, so some people are extremely paranoid and go really crazy with their private key management system systems and others are, kind of more ignorant and they are fine with having a simple hardware wallet or even maybe storing the private key on their phone. so, the problem is on this cypherpunk, paranoid, range of people. And actually, these are the people that also holdlers and holdlers of maybe large amounts, like maybe they are early adapters and they have the amount and they become actually already, scared Aired of storing it on just a hardware wallet, so they want something else and they need to build it by, by themselves because there are no tools available for doing it easily. Yeah. And that is, basically what we are trying to solve. we don't want to fix, to kind of force people to use a particular security model. We want them to, Make it according to their security. so, for example, provide a convenient toolbox that would allow people that aren't super sophisticated in the development still develop something, nice for themselves. also to make the applets or, or like apps for our hardware wallet to enable certain features. For example, we don't, think that we can support all types of applications that will be there in Bitcoin, we are planning to support CoinJoin, Lightning, but maybe there will be something else new, for example, state chains that recently appeared and other things, and, would be nice to allow developers of these technologies to Kind of extend the functionality of the hardware to support that, yeah. So that's why we decided to kind of name the project not a hardware wallet, but more like a hardware platform. Right. Okay. And

I think let's, let's talk a little bit. I'd, I, I want to hit some of those, common- Functions or pieces that go into making a good hardware wallet. So, so right now a lot of people talk about, you know, the secure element, right? So, and, and then there have been many attacks against hardware wallets, and people talk about, okay, but have a passphrase and so on. Can you just outline some of the Maybe some of the attacks that we've seen, the successful attacks against hardware wallets over the last year or so?

yeah, sure. So I think that recently when, I did this research, I counted like sixteen hacks over half a year. So like, not the hacks in the wild, but more like the vulnerabilities that were reported, and, it's pretty crazy. So it basically shows that, Even if you have awesome hardware, even if you have awesome software, probably there, there is still a way to hack your hardware wallet. So nothing is perfectly secure, and, you just need to, keep it in mind and actually be aware of the ways how exactly it can be hacked. so, yeah, there are currently like, two approaches. So what Trezor does, for example, they are completely open source, and, they are extremely good at developing the firmware and, actually the protocol, but, because of these, ideological reasons, they, as they want to stay open source, all the way, they have to work with the normal application microcontrollers, and it is a bit problematic because these microcontrollers weren't designed for security, so, they are designed to be put in the, I don't know Microwave or maybe your car, or in the, well, in all kinds of devices, but not on the security things. and, because of that, it is pretty vulnerable to hardware attacks. So basically this means that if, you have your treasure in the hands of the attacker, then probably there is a way to hack it, even though we may not know it the way right now. and that is why they introduced the passwords, and I think it is a very Very good mechanism for application microcontrollers, so, you don't store your full, mnemonic there. You have kind of your, mnemonic plus you have a password that you enter every time when you need to access the device. Yeah. So let me just explain

that just for the listeners as well. So typically on the Trezor, you might-- when you set that up, you might have a twenty-four word seed, and you may also have a PIN on the Trezor. But then in addition to that, there's another, if you go in the advanced section, there Like the twenty-fifth word, if you will. And so while the, automatically generated twenty-four word seed comes from a set dictionary, the twenty-fifth word or the passphrase that you write is just your own choice, right? And now my understanding from some of these wallet attacks is that typically one of the responses is, "Well, you should use a passphrase." And now there are various, there's potentially some problems with that as well, because the problem then is the user now has to remember a very long- Passphrase to kind of make the security kind of equivalent and then just can't do that. Yeah, then, then it

might, might be easier to remember, twelve or twenty-four word seed, and then every time when you need to make the transaction, you just, initialize your device, and then after transaction, you just wipe it. Right. Yeah. So this is, I think, that some people actually do. well, the passphrase is okay because there, well, you need, you can choose whatever you want. The problem is that users normally pick weak passwords. So like Statistics, yeah, random statistics shows that, the entropy of the passphrase is about, eleven bits only. So it is still, crackable with, dictionary, attacks and, maybe even brute force if the, password isn't long enough. so for me, for example, I just remember the whole, the whole seed, and I also don't use, existing hardware wallets though, so I, I, I'm kinda not a normal person in that sense. Right. Yeah. So, with this, microcontrollers that are based on application, oh, sorry, hardware wallets that are based on application Microcontrollers, passphrase, actually makes a lot of sense. then we have, hardware wallets like Ledger that have a secure element, and, Basically, these secure elements are industrial standard for, security chips. So they're extremely good, they are very well designed, they have a lot of countermeasures against all these hardware attacks, and in that sense, you don't really need a password, for Ledger, for example. So just having a PIN, is enough because, yeah, if you actually, enter wrong PIN three times or I don't know how many times, then it just wipes the device, right? Yeah. so the problem though is That, even if your hardware is, very good and perfectly secure against hardware attacks, if your protocol sucks, then you have problems. So if you introduce the bugs on the software, then it can be problematic. And this is what we, saw on the attacks on Ledger. so, there was one with this not verifying the change address, recently, and then there are, hacks that Ledger thinks is not a hack, with the footbabe thing, the, taking control of the, firmware that is running on the, microcontroller that drives the display. so there are still ways to hack even, the unhackable hardware just using software, like using maybe even a remote attack, so- Just don't think that if you're using Ledger or Trezor or some-something else, you're perfectly secure. You still need to, consider how to make it better. For example, maybe using the multisig is a good idea because, it is much harder to hack multiple devices than find a hack for one of them.

Right. And this is where, say, companies like Casa or Unchained, where they're offering this kind of thing, or you can do like a roll-your-own solution as well. And, you know, typically, a, a good Advice that you might hear from some Bitcoiners on this is that you might, you want to have multiple locations and you might want to try and vary your use of the different devices. Maybe you would use one Trezor and one Ledger and, you know, something else in your, or one Coldcard in your mix, of multi-signature to try and give yourself a bit more of a chance.

Ideally, you want to combine, products from different vendors because they have different, teams, and different bugs, hopefully, that will be probably not, discovered not at the same time, so, if you keep them up to date and if you use the products from different vendors, then you're fine. so there are still questions about, the support of multi-signature, for example, Coldcard is releasing, support of multi-signature pretty soon, and, that's great, then we will have something to pair with Trezor. Trezor supports multi-signature very nicely from the very beginning and the user- Oh, it's wonderful. Ledger, kinda supports multi-signature, it has some problems though, but, kinda okay-ish. yeah, but, it would be nice to see more hardware wallets that supports, multi-signature as well. Yeah, and hopefully we will be one of them.

Yeah, excellent. So, I think one other thing is that Depending on the manufacturer of that wallet, they may have different level, a different level of time and focus on Bitcoin. So for example, you know, Trezor and Ledger, I know that they have had to spend engineering time on other coins, and I think there's a bit of attention there because You know, the Bitcoiners of, like the kind of hardcore Bitcoiners, they just want a Bitcoin only firmware, and I know that, to my knowledge, I think the Trezor team are working on a Bitcoin only version as well.

Yeah, they're considering it seriously, so they, By talking to Treasure, I, found out that basically they are very Bitcoiners, so they, don't care about altcoins, so altcoins, they added support for altcoins when there were hard times and when it was profitable, and now it's just, very hard to- Drop them because, well, people will be mad at them, right? but I think that actually having Bitcoin only option of the firmware is a pretty good choice. they're also working a lot on, different additions, to the security and to the protocol. For example, they are adding the SD card, so hopefully they will also have a complete air-gapped mode, plus they are using this SD card for other reasons like, adding some extra entropy or, backing up. they're also working Working on Shamir's Secret Sharing scheme for your seed, that is also great because right now, actually, the, weakest point in the security of the hardware wallets is your paper backup. Because where do you store it? And it is like in the plaintext, either it is CryptoSteel or whatever, so it's just plaintext, and in one place. So this is the weakest point. And if we could have, Shamir's Secret Sharing support, that would help a lot because, yeah, then you two, you set to three of five or whatever, and then spread To, friends and family.

Right. now I recall, I think this was Andy, Andrew Polstra on Marty Ben's recent podcast is talking about how Maybe there's a certain way to apply it and do this, but my understanding from what he was saying is that it's actually not very-- People should be careful about using Shamir's because it might be more easily broken compared to using multi-signature, because say it's, you know, two of three pieces of one signature, does, does that, is there a big difference there from the security point of view for the user? Like multi-signature versus Shamir's basically.

Oh, well, so, as far as I understand, the difference is, that in Shamir you have a single key that you split, and then, whenever you need to sign with the normal ECDSA that we have right now, before Snor, right? you need to recombine it every time. So basically for every transaction, you still have a single point where your, full- Key exists, and this is the problem, with Schnorr it will be easier because there you can split the key into multiple, pieces and then you can combine, Pieces, kind of parts of the signature into a single one. So, still, this means that during the splitting at the first moment, at the setup phase, you will have a full, key somewhere, but, Well, yeah, there are obviously trade-offs. But on the other hand, if you have a multi-signature, then you also need to back up multiple keys, right? There are always trade-offs, you just need to see what fits better to your security model.

Right. Yeah. Sure. Okay. Look, so let's talk a little bit about your product. I know, you know, you've got a few different ideas that you're working on. Do you wanna just go into that?

Yeah. So, the first- What eventually we want, at the end that will take some time, but, still is to make a convenient, consumer hardware wallet like for, normal people maybe using the security model that we believe is fine, but it is easy to use, you just buy the device and use it as, as normal, plus you have some, extra functionality like QoE and Lightning Network, complete air gap, with, QR code scanner, so I think that, basically everything That we can, do to make the user ex-experience, easier and still supports, modern Bitcoin developments. also we want to allow people to write the, microPython scripts for, one of our microcontrollers in the hardware, so basically you'll be able to, put the, the apps from external developers there, but, without really compromising security. So what the- Apps can do, they can provide additional metadata to the transaction. So for example, let's say you, want to do the coin join, and, By default, the hardware wallet will show you just the full transaction that, okay, there are these fifty inputs, fifty outputs, I don't know how much you are spending, it just, looks like a mess. And so what this app can do, it can highlight certain inputs and outputs that, okay, these are your inputs and these are your outputs and this is what you are actually spending there. So just, to, make the user experience a little bit, easier without accessing secrets really.

Right. And I, and as I understand Understand it, it'll have like a touch screen.

yeah, yeah, yeah. So, I think the problem right now is that, the screens are too tiny on the hardware wallet. So what we have, we have a screen from, well, basically similar to what iPhone 4 has, I think that it is exactly the model that they had. so, it's enough to display your master public key, you, to display the signed transaction for the air gap mode. it also has a camera to scan, unsigned transaction, so, and you can fit a lot of data there, and well, you can actually have the experience that people normally have with smartphones, right? So you just scroll, navigate, and, do things like that. So this is from the, user experience perspective. Yeah. another thing that we are doing before we, release this product is, actually we are, we will release the developer board and the secure element. so that's our hope for the autumn, that we can, give the developers ability to make their own hardware, not only wallets, but any kind of Bitcoin-powered devices. so yeah, we, we are releasing the developer board and the, secure element from Infineon with our applet that, allows to do all the Bitcoin-related stuff like, Key derivations, signing transactions with ECDSA, with Schnorr, hopefully Shamir secret sharing will be there and, Oh no, Schmerziger, you don't really need to put there. Well, we will see. So we are defining the API right now, but hopefully it will be a tool that you can just put into your, developer board or your device and start using it, and that would provide all the convenient stuff, that Bitcoiners and Bitcoin developers actually need. Because, you know, there is a smart card from Infineon, that is, that they try to market as a, blockchain, starter kit or something, but it is completely useless Useless. I mean, they don't have the, key derivation, scheme there, so you can use only one key or maybe five, hundreds different keys. you don't have some advanced, signing features. Well, you, you don't have many things that you really need. So we hope that we can, make something useful for developers here, and, also it will help, to build the enterprise solution that we are also targeting. So like companies that need to store the private keys in a very, unique way and integrate the hardware to their, To their security kind of mechanisms.

Great. So essentially, you'll have an individual hardware wallet and some enterprise hardware wallet solutions that you're going to look at. And also

developer, toolbox for tinkers.

Yeah. And, let's talk a little bit about the air-gapped, idea that you're using, because it's a, it's a slightly different model to say the cold card air-ga- air-gapped model. Can you just outline a little bit of how that would work with your proposal?

So I think that there are actually some, hardware- Wallets that use something similar. So we aren't the first ones who are suggesting it, but the idea is very simple. So you, have your, hardware wallet completely disconnected from the computer and you never connect it. so you have your watch-only, software wallet on your computer or your phone. whenever you need to make a transaction, you just, prepare the transaction, display the PSBT as a QR code that you scan with the hardware wallet, hardware wallet displays then all the infor- Information for you to verify and to confirm, and you scan back the same transaction that you can broadcast. So basically it just, works as a flip, flip, and you're done. Yeah. So you don't need to enter the SD card into the slot and then find a laptop that supports SD cards. so I think it is already pretty challenging at the moment.

Right. Yeah. Let's, let's break that down actually. I think that's probably a little bit complicated. So just for some of the listeners who might not be familiar with, Those terms, let's just say the private key lives on the hardware wallet. Yes. But the challenge is you don't want that private key to get exposed onto a com-an internet com-connected computer. And so one way that you're proposing to do that is to say have a watching-only wallet, let's say on your phone, for example, and that, that's like, for example, where you put an xPub onto that phone, but so the phone can know the balance but not spend. Yeah. So

it, it, watch the blockchain, It, sees the incoming transaction, it can prepare the information for the hardware wallet to sign stuff. So like, it can say that, okay, these are the addresses, these are the amounts, this is, how to derive the key that you know, but I have no idea, about the, about the private key. The private key is, yeah. So this is some information that you may find useful to sign stuff and, also to display to the users, like, what is the change address, why it is a change address, so Wallet itself can use only this data without knowing anything about the blockchain to actually display everything properly and sign.

Right. And so what you, what you're getting at there is that the, let's say my phone that has the watching only wallet and it's got the xPub in there and it's watching the balances, and I can use that to craft a transaction, an unsigned transaction, and- Then it, what it can do is create a QR code that essentially contains that information saying, "Ah, Stefan, pay, you know, if you, you know, do you want to sign this transaction, and it's gonna pay to this address, you know, and this amount, yeah, showing you this amount." Essentially, then the hardware wallet has the camera, which I would then kind of hold over my phone to read, to scan in that QR code and take, kind of ingest that transaction through like a barcode scanner or a QR code scanner, and then on the hardware wallet, because it's got like a proper screen, now it's got a bit of a, it can show you, okay, do you want to pay X, Y, and Z number of bitcoins to this address? And, and it can kind of show you that. And then what you would do from the hardware wallet is- Is hit, you know, yes, sign that transaction, I wanna do it, and that will, use the private key to sign that transaction, and then again, you've got to transfer it back to the phone to broadcast that. So can you outline that? Yeah,

yeah. And, having a large screen actually matters here because you can actually, display the QR code with the signed transaction after that. So after you signed, you just, show a QR code, the full transaction that you can scan with your, with your phone and then broadcast.

Yeah. Fantastic. So yeah, that's a very different, model, and I think, that could also be another, you know, way that people can help keep themselves a little bit more secure. Yeah. So I think the other, another big one is Lightning. So I think most people, and most people would think, "Hang on, you can't do Lightning hardware wallet, like, don't you need to sign the, for whenever somebody is routing through your channel? How, how would it work?" So can you outline a little bit there?

Well, first, people will probably think that, "Why do you need a hardware wallet for Lightning anyways?" Because there are small amounts, so I have, I'm fine having one hundred euros or dollars, on my phone, on the, basically, maybe not so secure computer because it's not a big deal even if I lose it. But it is only like one side of the ecosystem, right? Because we also have people that are, liquidity providers to the network that, basically route all these payments, and also we have merchants that are accepting the payments. And for example, there are channels between, I think, Bitrefill and, I think, of one Bitcoin or even more. So and this already matters. I mean, I definitely don't want to, to store even one Bitcoin on- On the online server that is pointing, that has a public IP address, and, I'm, for example, not capable of, maintaining the infrastructure securely enough on the servers. so yeah, to do the Lightning hardware wallet, it is a little bit tricky because you need to be connected to the online computer. So, our approach is that, you have, let's say, watch-only, Lightning node, in the cloud or on your computer that can- Do, all the heavy, heavy stuff like networking, gossiping, getting the routing information and all other stuff that isn't touching the secrets, and then all the secrets live on the hardware wallet. But here the trade-off is that you do need to, keep the hardware wallet connected to the computer because every time when, you are routing the payment, on the network, you need to send this, pair of transactions to the hardware wallet, hardware wallet It needs to verify that, it is actually, the amount of money of the user increases, so we are earning some fees here or at least stays the same, and then it can automatically sign. So this is another thing that, we talked before, like automatic functionality of the hardware wallets. It becomes, more than just, press to confirm things. It, has to be, more like, moving into the direction of like, banking HSMs and commercial HSMs, So smarter things. so yeah, that's, what we are also working on. So two edge cases. either you are completely air-gapped and never connect the computer to, to the hardware wallet, or you kinda have a warm hardware wallet that still have a bi-directional communication with the computer, but, still the security, the attack surface is, very small in this case because, the hardware wallet, runs very small amount of code and, security

Right. And so you, you see it like, you know, the business might have multiple different, you know, wallets, obviously. Now, I mean, that's how most bi-- Bitcoin businesses today operate, right? They've got a kind of deep cold storage, and then they might have like a somewhat cold storage, and then like the hot wallet. And so in-- what you're envisioning there is that maybe that hot wallet would be this Lightning hardware wallet.

Yeah, yeah. So you have a normal computer that, runs all the, kind of watch-only functionality and- Then next to it, in the same server rack, you have this hardware wallet that, works as a, a hardware security module to, sign the transaction automatically, do all the stuff. so and in this case, for enterprises, for example, you don't even need a screen actually. so you-- well, you need to set it up according to certain policies, and then you just plug it in and it just works. Yeah, so there's a lot to

come for that because the-- a lot of these ideas are Things where, you know, for example, if you want to coin join, you pretty much, you've got to use Wasabi, Samurai, or Join Market. There's not really kind of other options, right? And then it's kind of like, if you want to do coin joins, well, now you can't do Lightning, because it's like none of the Lightning wallets have, you know, coin join on the coin join wallets have Lightning. At the moment,

you can't even do it, because, coin join, wants all the inputs and outputs to look the same, So you will be, easily visible in the, in the CoinJoin transaction. But you can, hopefully, in principle, you can do something like, CoinJoin for Lightning, channels, where all the participants are actually opening the Lightning channels and then they are again, all the same. but, yeah, the problem right now is that we are in a pretty early stage of development of these things, both Lightning and, CoinJoin, and, it's more like proof of concept, so we have software That works, but we don't have like a common API and, for example, for the Coinjoin, I can't just, write a software wallet to connect to, Vaspai Coinjoin server because, well, I don't know where to find the documentation. As far as I know, it is not very well documented at the moment. so I think that it would be nice to develop a certain standards on the, on this kind of split all the pieces, to different parts. So we already have a pretty good, isolation Of the hardware wallets, we have this HWI interface from Bitcoin Core that allows you to, talk only to this module and then it translates to all the hardware wallets. would be nice to have the same for software wallets and for the servers, so such that I could, connect to any CoinJoin server, for example, and register my transaction there.

Yeah, so I think it's some of this is like, even with PSBT, right? So PSBT is more of a recent thing. In the past, there were individual- Companies or software solutions who did something similar, but now it's kind of trying to find a way that people can standardize and then multiple, multiple coinjoin type wallets might kind of share the coinjoining liquidity if that makes sense, because otherwise right now Wasabi's got their own pool, Samurai has their own pool, like obviously they're, they're running, they're running in different ways, but Potentially in the future, there is a possibility there that if there's a standard for this kind of thing, then you could be using different wallets but still in part of the same coin join pool, if that makes sense.

Yeah, I think that would be great. yeah, there are problems with like humans as usual, so like there is always some policy, politics and, kind of personal relationship between developers of different wallets that, may, Can that limit this communication and, development of common API? But, I definitely want to live in a world where everything, well, all different software, well, not all, but many different software, hardware and, servers, work together in a common way. Yeah. So that would be awesome.

Right. And I think you also, you were also just touching on a couple really interesting ideas before about- If we were to start doing things like, okay, an example would be you're doing a transaction and then the change could be opening a lightning channel, things like that, because obviously over time, like if we're both-- we're all bullish on Bitcoin and we think more people are gonna use it, blockchain is gonna get- More and more used, and we need to be very efficient in our use. And so I think you had a few interesting ideas. Do you want to touch on some of those on what, what could be done in the future around more efficient use?

Well, yeah. So the first, huge improvement, as I said, and that I am very excited about, is Schnorr signatures, right? When everything will look the same on the blockchain, so everything looks like spending to a single public key, so that is already very, very nice for privacy and for, the use of the The blockchain as well. then, regarding like, existing scripts, yeah, what I don't like currently at Lightning, that you, in most of the wallets, you have like a separate balance. This is your on-chain balance, this is your off-chain balance, and yeah, you can only do, Lightning up to this limit. You have to manage all these channels and stuff. so, would be nice to actually, use Yeah, the space efficiency. So when I'm spending the money to you, why do I need to have a change that is just returning me the money? Maybe I want to do it, to do something else with that. Either I can put the whole transaction in the coinjoin, transaction, or I can even use this output to open the lightning channel, and then, what I can have, I can have all my money in lightning channels, and whenever I need to send the money to you on chain, because you, I don't know, use Coinbase and you don I can just talk to my nodes, to my peers that I'm connected to, and say, "Okay, guys, I need to send some money there, and I will pay the fees. So let's just, close the channel and reopen it with the slightly smaller balance." so yeah, I'm sending you the money, and I still maintain the channels, and maybe I also rebalance it or make it a little bit more, efficient. so that would be really cool. but I think that, we still need some time to develop

you know, continue developing and we are fixing a few things like, how to make all these channels more efficient, how to pay without invoices or something else, so but the future will be really, really, really nice.

Exactly. So look, let's talk a little bit about your vision with Crypto Advance. Tell us a little bit about what some typical- uses will be and like what you think it might look like, and maybe give us a view for the individual and a view for enterprise customers.

you mean the vision of the, of the product or of the future of the company of what's going on? Like for the

product as used by those people. So for an example, if you're a home user, you might have the node at home, but it's also coin joining for you or lightning at home, but you can control it with a remote control, that

sort of thing. Okay. okay, so like, the different For hodlers, this is the easiest one, for like people like myself. I would use, one hardware wallet, in a completely airgap mode, that is probably, also using the multisig with some other vendors where I store most of my life savings. then I take some, I don't know, ten percent of that and put it into this warm hardware wallet that is connected to my node that, is hosted somewhere in the cloud. and I earn a little bit of fees on the Lightning Network, routing, or maybe if there are businesses, then yeah, it stores the private key, and allows you to accept Lightning payments as well, because I think that, everything will be done in over Lightning afterwards, in the nearest future. But right now, also like the, normal on-chain transactions with like large transactions also makes sense to put on-chain. yeah. So the cold storage plus The warm storage, this is like for me, then for more like normal people and that are just entering the field, what I would probably like to have, and that is what we are also working on, that, okay, at least, the custodian wallets that provide all the service and, that maintain the infrastructure for the channels and everything, they have to run, secure hardware. So basically, they can have the, HSM hardware wallet on the servers and, the user can just register on his normal app, and, yeah, store some bitcoins in there because this really helps, to onboard people. They don't want to, buy a bunch of hardware, learn about the private keys at least at first. So as soon as they get more, more deeper in the field, they will start educate themselves and then probably they will buy their own hardware wallet and so on. so that is another thing. then enterprises, enterprises So it's like completely different, and, I feel really bad that many enterprises and companies are currently using like normal existing hardware wallets that are just lying somewhere in the safe, and this means that there is a person who knows the pin code for this device that basically controls all the money So our hope is actually to, develop a, thing that can be integrated into their existing security model. For example, some companies use these smart cards to authenticate the users, and they have different departments and user groups and these policies. so why don't we use the same structure, to authorize Bitcoin transactions? So basically, you can have a hardware wallet, that stores the private keys, but in order to spend, you don't- Don't enter the pin code, but instead, you provide authentication from different people. For example, some accountant, confirms the transaction by pressing his UBI key button, and another, some security guard also comes and enters some security pin in there. So then you can have multiple, yeah, so internal controls for the company, internal controls and you define who can do what. Yeah. So that's the hope for the enterprise solution. Yeah, they all have very different, security models, and that's why we are developing all this toolbox because, the same works for developers. Developers want something custom, like tinkers, makers, but also like, developers of the protocol as well, and they want a tool to play with new stuff. So, it perfectly works for both, enterprises and developers, yeah. hopefully, if we are profitable in the, in the future We will also be able to make an, open source, secure element like, really, open source or like manufacture ourselves. Unfortunately, it takes a lot of money, but it's my, my hope that we can take the, open source risk, risk five core, for example, and what the problem with this risk five, at the moment is that even though the core is open source All the companies that manufacture these chips, they put a bunch of peripherals on top that is proprietary. So in total, you have a chip that is half open, half closed. so we would like to have a really like- Security focused chip, completely open source, ideally verifiable, even if it requires web equipment, but, it's like further in the future. Yeah. I think that, with Bitcoin, and, with all this, community, we can actually change the status of the industry, status of the security industry that is screwed and, kinda obfuscated by design. So Yeah, we can make a difference. That would be awesome.

Fantastic. So look, who are you looking to hear from and what's the next steps? How can they get involved with the developer boards and so on? So we

are, hopefully releasing the developer board, boards toolbox and the secure element, in autumn, October maybe, something like this. so it will be pretty minimal and it will be also pretty expensive because, you know, low volumes cost money. but, we would really like to have developers and community to start playing with this stuff and provide us with the feedback so that we can, make it better and more convenient. Then, what else? if you have, if someone has interesting ideas, yeah, everyone should write me, just write me. I, I am so happy to discuss all this stuff over Twitter, Telegram, whatever. Regarding investors that are maybe interested in, in our company, also makes sense to, to talk a bit, but, like if you really, see the, Our goal and share our ideas because, well, not like random, invest and then quit, but, more like, from the community people, yeah. Right. what else? On this part, I would have better Moritz here, but too bad he's not here. That's fine, no, we can

put the, the details in the show notes, so that's, that's fine. Listeners can, find you and Moritz from there. Anything else you wanted to add or that's pretty much it? I think, I think that's pretty much, the key points.

I think that's, that's more or less it. Yeah. Alright, well, look, thanks very much

Really happy to chat about all this stuff. Yeah.

I hope you guys enjoyed that chat with Stepan of Crypto Advance. Make sure you go chat with him and check out what Crypto Advance are doing. Also, just a quick shout out for one of my long-time listeners, Andrew DiMarcoAngelo. He's running Bloom Audio Store, which has really high-quality audio gear. Andrew sent me a pro-level pair of headphones, the Audio Technica ATH-M70x, and they are truly a joy to use when I'm doing the editing for this podcast or just listening to music with a very balanced audio response. The sound quality is just on another level, so make sure you check out his store at bloomaudio.com. And obviously, he takes Bitcoin for payment. If you wanna support my podcast, make sure you rate and review the podcast on iTunes, five star reviews are very much appreciated. You can see the show notes on stephanlivera dot com and subscribe there as well. Share the podcast out with your friends. If you wanna advertise, contact me, stephanlivera at pm dot me. Otherwise, that's it from me. Thanks guys, see you next time.