From: Connor Avila <connoravila@gmail.com>
To: bitcoindev@googlegroups.com
Subject: [bitcoindev] Draft BIPs: anti-exfil signing for BIP340 and ECDSA, with PSBT fields
Date: Thu, 5 Nov 2026 16:08:33 -0500 [thread overview]
Message-ID: <CAOuFX60em-d=JW+FmQe6G6mP58Gs6kpwuRwVLC5nwT8oO9HsXg@mail.gmail.com> (raw)
Hi all,
A signing device picks the nonce in every signature, so a compromised
one can leak its seed through signatures that look normal. Anti-exfil
fixes this by having the host contribute to each nonce and check the
result. Devices already ship versions of it, but there's no agreed
specification and no standard PSBT field for it.
I've written two draft BIPs. One covers the protocol for BIP340 and
ECDSA, including what a host does when a device fails. The other adds
three PSBT input fields. The protocol follows Scheme 6 from Pieter
Wuille's 2020 overview, with a sign-to-contract tweak.
Sjors Provoost published an experimental draft in October for
single-signer Taproot key-path signing, with implementations for HWI
and several devices (https://github.com/Sjors/bips/pull/2). We've
talked (or emailed rather), and he plans to align those
implementations with this spec.
With the BIPs are test vectors, a reference in Python, a C module for
libsecp256k1, and a patch series adding it to Jade's `sign_psbt`, none
of it run on a device yet. One script reruns most of the checks.
No cryptographer has reviewed this and it hasn't been audited. The
security argument starts with what it doesn't prove, and the evidence
page lists what failed and what wasn't tested. I'm not a
cryptographer, so corrections to the argument are much appreciated!
Repository: https://github.com/AvilaLabs/anti-exfil
Handbook: https://anti-exfil.avilalabs.org
Connor Avila,
Avila Labs
--
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/CAOuFX60em-d%3DJW%2BFmQe6G6mP58Gs6kpwuRwVLC5nwT8oO9HsXg%40mail.gmail.com.
reply other threads:[~2026-11-06 1:45 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAOuFX60em-d=JW+FmQe6G6mP58Gs6kpwuRwVLC5nwT8oO9HsXg@mail.gmail.com' \
--to=connoravila@gmail.com \
--cc=bitcoindev@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox