v0.1.0 - CYD firmware v0.0.2: algorithm-based API upgrade (all verbs, all algorithms), vendored Keccak/SHAKE + PSA ed25519/x25519 for IDF v5.4, Web Serial test page, CYD docs, Teensy 4.1 port plan (1TB SDXC OTP pad), brainstorming READMEs for BLE/IR/NFC/FPGA signer concepts
This commit is contained in:
Laan Tungir
192
firmware/nfc_card_signer/README.md
Normal file
192
firmware/nfc_card_signer/README.md
Normal file
@@ -0,0 +1,192 @@
|
||||
# n_signer NFC Card / Ring Signer
|
||||
|
||||
**Status:** Concept — open-ended brainstorming. No plan yet.
|
||||
|
||||
A contactless signer in a **card or ring form factor** that is powered and
|
||||
communicates via **NFC (13.56 MHz)**. You place it on a reader (USB NFC reader
|
||||
or a phone); the reader's RF field powers the device and exchanges data. No
|
||||
battery, no wire, no radio beyond the 4 cm NFC zone.
|
||||
|
||||
This directory also explores **passive RFID/NFC tag ideas** that don't do
|
||||
signing on-device — they store keys or seed material that a host reads and uses.
|
||||
|
||||
---
|
||||
|
||||
## Concept A: NFC-powered active signer (card with display + button)
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
Host[Host: laptop/phone<br/>n_signer client] -->|USB or built-in NFC| Reader[NFC reader<br/>ACR122U or phone]
|
||||
Reader -->|13.56 MHz RF field<br/>powers + communicates| Card[Signer card<br/>nRF52840 + e-paper + button]
|
||||
Card -->|NFC response| Reader
|
||||
Reader -->|USB| Host
|
||||
```
|
||||
|
||||
The card has a tiny e-paper display + one button. The reader powers the card;
|
||||
the card shows the approval prompt on its own display; the user presses the
|
||||
button to approve; the card signs and sends the response over NFC. The card
|
||||
does not trust the reader for display — it shows what it's signing.
|
||||
|
||||
### Hardware (preliminary)
|
||||
|
||||
| Component | Candidate | Notes |
|
||||
|---|---|---|
|
||||
| MCU | **nRF52840** (WLCSP) | Cortex-M4, NFC-A tag mode built in, secp256k1/ed25519 in software. Needs a thin-film battery (not fully passive). |
|
||||
| | or **NXP JCOP 4** (Java Card) | Fully passive, hardware secp256k1, tamper-resistant. Requires NDA + Java Card applet. Not DIY. |
|
||||
| Display | 1.1" e-paper segment display | Shows "approve kind 1? caller: <hex>". Zero power when static. |
|
||||
| Input | One capacitive touch button | Press to approve, timeout = deny. |
|
||||
| Power | Thin-film battery (like payment cards with displays) + NFC harvesting | |
|
||||
| Antenna | Etched into flex PCB around card perimeter | Standard smart card manufacturing. |
|
||||
|
||||
### Security
|
||||
|
||||
- **Attack radius ~4 cm** — an attacker must touch your card with their reader.
|
||||
- **No emissions when not on a reader** — the card is invisible to remote attackers.
|
||||
- **Self-contained approval** — the card's display shows what it's signing. The reader can't lie.
|
||||
- **Physical possession = authorization** — same model as a payment card.
|
||||
|
||||
### Build difficulty
|
||||
|
||||
- **DIY prototype:** nRF52840 dev board + wire-wound NFC antenna + ACR122U reader + small OLED. Prove NFC-powered signing works.
|
||||
- **Production:** custom flex PCB + etched antenna + thin battery + e-paper segment. Standard smart card manufacturing, but not DIY.
|
||||
|
||||
---
|
||||
|
||||
## Concept B: NFC ring (tap-to-sign, no display)
|
||||
|
||||
A ring with an NFC tag + MCU inside. No display, no button. You tap it on a
|
||||
reader; the reader displays the approval prompt; you tap again to confirm
|
||||
(two-tap protocol) or the ring signs immediately (single-tap, trusts the reader).
|
||||
|
||||
### Hardware
|
||||
|
||||
| Component | Candidate | Notes |
|
||||
|---|---|---|
|
||||
| MCU | Secure element (JCOP / Infineon) or nRF52840 (WLCSP) | Must be tiny (2×3 mm package). |
|
||||
| Power | **Fully passive** (harvested from reader) if using a secure element. nRF52840 needs a battery. |
|
||||
| Antenna | Coil wound into the ring body | Custom manufacturing. |
|
||||
| Display | **None** | No room. |
|
||||
| Input | **None** | Pure tap-to-sign. |
|
||||
|
||||
### Security
|
||||
|
||||
- **Two-tap protocol:** tap to receive the request, reader displays it, tap again to sign. Forces deliberate action but still trusts the reader's display.
|
||||
- **Single-tap:** anyone who taps your ring with a reader can sign. Only safe if the ring is always in your physical possession and the reader is trusted.
|
||||
- **No display = reader-trusted approval.** Weaker than Concept A but much more portable.
|
||||
|
||||
### Build difficulty
|
||||
|
||||
- **Very hard** — custom antenna winding, tiny chip placement, ring-form-factor PCB. Not DIY without specialized equipment.
|
||||
|
||||
---
|
||||
|
||||
## Concept C: Passive NFC tag that stores keys (no on-device signing)
|
||||
|
||||
This is a fundamentally different idea: the tag **does not sign anything**. It
|
||||
stores key material (a mnemonic seed, a private key, or a derived key) that a
|
||||
host reads over NFC and uses to sign. The tag is a **portable key storage
|
||||
device**, not a signer.
|
||||
|
||||
### How it would work
|
||||
|
||||
1. The user taps the tag on a phone or USB NFC reader.
|
||||
2. The host reads the stored key material over NFC (ISO 14443 / NDEF).
|
||||
3. The host uses the key material to sign (the host runs the n_signer crypto).
|
||||
4. The tag is just storage — it has no MCU, no crypto, no battery.
|
||||
|
||||
### What the tag stores (options)
|
||||
|
||||
| Storage model | What's on the tag | Security | Notes |
|
||||
|---|---|---|---|
|
||||
| **Encrypted seed** | The mnemonic seed, encrypted with a passphrase (BIP-39 password). The host decrypts after the user types the passphrase. | Medium — if the tag is stolen, the attacker needs the passphrase. | Like an encrypted paper backup, but in NFC form. |
|
||||
| **Raw private key** | The secp256k1 private key (32 bytes), stored in the tag's EEPROM. | **Low** — anyone who reads the tag has the key. Only safe if the tag is PIN-protected (needs a secure element, not a dumb tag). | Like storing a private key on a USB stick. |
|
||||
| **NDEF URI** | A URI like `nostr:npub1...` (just the public key). The host uses it to identify which key to use (the actual private key is elsewhere). | High (it's just a pubkey) | Not a signer — just an identity token. |
|
||||
| **Shamir shard** | One share of a Shamir's Secret Sharing split of the seed. The tag holds 1 of N shares; you need M tags to reconstruct. | **High** — a single tag is useless. | Like a metal seed backup but in NFC form. Multiple tags = multiple shares. |
|
||||
| **HD wallet derivation path** | Just the derivation path + a reference to a master seed stored elsewhere. The tag tells the host *which* key to derive. | Medium | The tag is a pointer, not the key itself. |
|
||||
|
||||
### Hardware
|
||||
|
||||
| Component | Candidate | Notes |
|
||||
|---|---|---|
|
||||
| **NTAG215** (NXP) | 504 bytes user memory, no crypto, ~$0.10 | The cheapest option. Stores an encrypted seed or NDEF URI. No MCU. |
|
||||
| **NTAG424 DNA** (NXP) | 4 KB, AES-128, tamper detection, ~$0.50 | Has crypto — can do authenticated read (the host must present a key to read the data). Better security. |
|
||||
| **MIFARE DESFire EV3** | 32 KB, AES, secure applets, ~$1 | Smart card chip. Can store encrypted key material with PIN/mutual auth. |
|
||||
| **Java Card (JCOP)** | Full smart card, runs applets, ~$3-5 | Could run a "key storage" applet that only releases the seed after a PIN is verified on the host. |
|
||||
|
||||
### Security analysis
|
||||
|
||||
The **passive tag as key storage** is the weakest signer model (the host does
|
||||
the signing, so a compromised host can steal the key), but it has interesting
|
||||
niche uses:
|
||||
|
||||
- **Encrypted seed backup:** an NTAG215 storing an encrypted seed is a
|
||||
convenient portable backup — tap your phone to read it, type the passphrase
|
||||
to decrypt. More convenient than a metal plate, less secure than a hardware
|
||||
signer.
|
||||
- **Shamir shard carrier:** each tag holds one SSS share. You need M of N tags
|
||||
to reconstruct the seed. Distribute the tags to different locations/people.
|
||||
A single stolen tag is useless. This is a **key-recovery** tool, not a signer.
|
||||
- **Identity token:** an NDEF URI tag with your npub. Tap to share your Nostr
|
||||
identity with a phone. Not a signer — just a business card for Nostr.
|
||||
- **PIN-protected key release:** a DESFire or JCOP tag that only releases the
|
||||
seed after the host verifies a PIN. The host never sees the key until the PIN
|
||||
is correct. Better than a raw tag, but the host still gets the key after the
|
||||
PIN — so a compromised host can still steal it.
|
||||
|
||||
### The fundamental limitation
|
||||
|
||||
A passive tag that stores keys **cannot protect the key from a compromised
|
||||
host**. Once the host reads the key, the host has it. This is the same problem
|
||||
as storing a private key in a file — the OS can steal it. The only way to
|
||||
protect the key from the host is to **never release the raw key** — which means
|
||||
the tag must do the signing itself (Concept A or B), or the tag must participate
|
||||
in a protocol where the host sends a hash to sign and the tag returns a
|
||||
signature (which requires an MCU + crypto = not a passive tag).
|
||||
|
||||
**The one exception:** a **secure element** (JCOP / Infineon) can do
|
||||
"sign inside, never release the key." The host sends the message hash; the
|
||||
secure element signs it internally and returns the signature. The private key
|
||||
never leaves the chip. This is how smart card signing works (e.g. FIDO2 keys,
|
||||
PIV cards). But this is Concept A (active signer), not a passive tag.
|
||||
|
||||
---
|
||||
|
||||
## Open questions (all concepts)
|
||||
|
||||
- **Is the goal a signer (does crypto on-device) or a key carrier (stores keys for a host to use)?**
|
||||
- Signer → Concept A (card with display) or B (ring). The key never leaves the device.
|
||||
- Key carrier → Concept C (passive tag). The host gets the key. Simpler but less secure.
|
||||
- **Form factor:** card (credit card size, room for display) vs ring (tiny, no display)?
|
||||
- **Power:** passive (secure element, no battery) vs semi-passive (nRF52840 + thin battery)?
|
||||
- **Approval model:** on-device display (secure, needs a screen) vs reader display (trusts the reader, no screen needed) vs two-tap (medium security, no screen)?
|
||||
- **Host reader:** USB NFC reader (ACR122U, ~$15) vs phone NFC (universal, no dongle)?
|
||||
- **MCU/toolchain:** nRF52840 + C (DIY-friendly) vs JCOP + Java Card (production, NDA)?
|
||||
- **Could a passive tag + a host-side n_signer be a useful "portable encrypted seed backup" even if it's not a signer?** (Yes — for key recovery / Shamir shard distribution.)
|
||||
|
||||
---
|
||||
|
||||
## Comparison across all three concepts (NFC, BLE, IR)
|
||||
|
||||
| | NFC card (A) | NFC ring (B) | NFC tag (C) | BLE wearable | IR air-gap |
|
||||
|---|---|---|---|---|---|
|
||||
| Does signing on-device? | **Yes** | **Yes** | No (host signs) | Yes | Yes |
|
||||
| Key leaves device? | **No** | **No** | Yes (host reads it) | No | No |
|
||||
| Power | Reader + thin battery | Reader (passive) or battery | **Reader (passive)** | Battery | Battery |
|
||||
| Display | Tiny e-paper | None | None | Tiny OLED | Tiny OLED/e-paper |
|
||||
| Approval | On-card display + button | Reader display (two-tap) | N/A (host decides) | On-device display + buttons | On-device display + buttons |
|
||||
| Attack radius | ~4 cm | ~4 cm | ~4 cm | ~10 m | ~1 m (line-of-sight) |
|
||||
| Host needs | NFC reader or phone NFC | NFC reader or phone NFC | NFC reader or phone NFC | BT (universal) | USB IR dongle |
|
||||
| Form factor | Card | Ring | Tag/card/sticker | Wristband/pendant | Handheld |
|
||||
| Build difficulty | Hard (flex PCB) | Very hard (custom ring) | **Easy (off-the-shelf tag)** | Moderate | Moderate |
|
||||
| Best for | Daily signing | Quick tap-to-sign | Key backup / recovery | Wearable daily use | High-security air-gap |
|
||||
|
||||
---
|
||||
|
||||
## Next steps
|
||||
|
||||
- Decide: signer (A/B) vs key carrier (C) vs both
|
||||
- Decide: card vs ring vs tag
|
||||
- Decide: DIY prototype (nRF52840 + ACR122U) vs production (secure element)
|
||||
- Explore the Shamir-shard-on-NFC-tags idea as a key-recovery tool
|
||||
- Explore the encrypted-seed-on-NTAG215 idea as a portable backup
|
||||
- Write a plan for the chosen direction
|
||||
Reference in New Issue
Block a user