* [bitcoindev] Draft BIPs: anti-exfil signing for BIP340 and ECDSA, with PSBT fields
@ 2026-11-05 21:08 Connor Avila
0 siblings, 0 replies; only message in thread
From: Connor Avila @ 2026-11-05 21:08 UTC (permalink / raw)
To: bitcoindev
Hi all,
A signing device picks the nonce in every signature, so a compromised
one can leak its seed through signatures that look normal. Anti-exfil
fixes this by having the host contribute to each nonce and check the
result. Devices already ship versions of it, but there's no agreed
specification and no standard PSBT field for it.
I've written two draft BIPs. One covers the protocol for BIP340 and
ECDSA, including what a host does when a device fails. The other adds
three PSBT input fields. The protocol follows Scheme 6 from Pieter
Wuille's 2020 overview, with a sign-to-contract tweak.
Sjors Provoost published an experimental draft in October for
single-signer Taproot key-path signing, with implementations for HWI
and several devices (https://github.com/Sjors/bips/pull/2). We've
talked (or emailed rather), and he plans to align those
implementations with this spec.
With the BIPs are test vectors, a reference in Python, a C module for
libsecp256k1, and a patch series adding it to Jade's `sign_psbt`, none
of it run on a device yet. One script reruns most of the checks.
No cryptographer has reviewed this and it hasn't been audited. The
security argument starts with what it doesn't prove, and the evidence
page lists what failed and what wasn't tested. I'm not a
cryptographer, so corrections to the argument are much appreciated!
Repository: https://github.com/AvilaLabs/anti-exfil
Handbook: https://anti-exfil.avilalabs.org
Connor Avila,
Avila Labs
--
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/CAOuFX60em-d%3DJW%2BFmQe6G6mP58Gs6kpwuRwVLC5nwT8oO9HsXg%40mail.gmail.com.
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-11-06 1:45 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-05 21:08 [bitcoindev] Draft BIPs: anti-exfil signing for BIP340 and ECDSA, with PSBT fields Connor Avila
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox