arno/trezor-firmware
1
0
Fork 0
mirror of https://github.com/trezor/trezor-firmware.git synced 2025-06-27 18:32:34 +00:00
Code Issues Releases Wiki Activity

docs: document anti-exfil

Browse Source
This commit is contained in:
Ondřej Vejpustek 2025-03-28 18:02:24 +01:00
parent 13c3627211
commit 767774f479
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
docs/common/communication/bitcoin-signing.md
View File

@ -308,6 +308,15 @@ Trezor sets `request_type` to `TXPAYMENTREQ`, and `request_details.tx_hash` is u
The host must respond with a `TxAckPaymentRequest` message. The host must respond with a `TxAckPaymentRequest` message.
### Entropy request
This type of request is used if anti-exfiltration protocol is used.
Trezor sets `request_type` to `TXENTROPY`. `request_details.tx_hash` is unset.
`request_details.request_index` is the index of the input in the transaction: 0 is the
first input, 1 is second, etc. `request_details.nonce_commitment` is the commitment to
the signature nonce.
## Replacement transactions ## Replacement transactions
A replacement transaction is a transaction that uses the same inputs as one or more A replacement transaction is a transaction that uses the same inputs as one or more
@ -370,6 +379,16 @@ that has the given index.
All outputs belonging to one payment request must be consecutive in the transaction. All outputs belonging to one payment request must be consecutive in the transaction.
## Anti-exfiltration protocol
The purpose of the anti-exfiltration protocol is to prevent the device from leaking its secrets
through the signatures. The host can request the protocol by setting `entropy_commitment` in
the `TxInput` message. The device will respond with a `TxRequest` message, with `request_type`
set to `TXENTROPY` and the `request_details.nonce_commitment` field filled in. The host must then
reply with a `TxAckEntropy` message. The input signature will then commit to both the nonce and
the entropy, which is verified by the host. The full description of the protocol is [here]
(https://github.com/BlockstreamResearch/secp256k1-zkp/blob/6152622613fdf1c5af6f31f74c427c4e9ee120ce/include/secp256k1_ecdsa_s2c.h#L100).
## Implementation notes ## Implementation notes
### Pseudo-code ### Pseudo-code