n_signer NFC Card / Ring Signer
Status: Concept — open-ended brainstorming. No plan yet.
A contactless signer in a card or ring form factor that is powered and communicates via NFC (13.56 MHz). You place it on a reader (USB NFC reader or a phone); the reader's RF field powers the device and exchanges data. No battery, no wire, no radio beyond the 4 cm NFC zone.
This directory also explores passive RFID/NFC tag ideas that don't do signing on-device — they store keys or seed material that a host reads and uses.
Concept A: NFC-powered active signer (card with display + button)
flowchart LR
Host[Host: laptop/phone<br/>n_signer client] -->|USB or built-in NFC| Reader[NFC reader<br/>ACR122U or phone]
Reader -->|13.56 MHz RF field<br/>powers + communicates| Card[Signer card<br/>nRF52840 + e-paper + button]
Card -->|NFC response| Reader
Reader -->|USB| Host
The card has a tiny e-paper display + one button. The reader powers the card; the card shows the approval prompt on its own display; the user presses the button to approve; the card signs and sends the response over NFC. The card does not trust the reader for display — it shows what it's signing.
Hardware (preliminary)
| Component | Candidate | Notes |
|---|---|---|
| MCU | nRF52840 (WLCSP) | Cortex-M4, NFC-A tag mode built in, secp256k1/ed25519 in software. Needs a thin-film battery (not fully passive). |
| or NXP JCOP 4 (Java Card) | Fully passive, hardware secp256k1, tamper-resistant. Requires NDA + Java Card applet. Not DIY. | |
| Display | 1.1" e-paper segment display | Shows "approve kind 1? caller: ". Zero power when static. |
| Input | One capacitive touch button | Press to approve, timeout = deny. |
| Power | Thin-film battery (like payment cards with displays) + NFC harvesting | |
| Antenna | Etched into flex PCB around card perimeter | Standard smart card manufacturing. |
Security
- Attack radius ~4 cm — an attacker must touch your card with their reader.
- No emissions when not on a reader — the card is invisible to remote attackers.
- Self-contained approval — the card's display shows what it's signing. The reader can't lie.
- Physical possession = authorization — same model as a payment card.
Build difficulty
- DIY prototype: nRF52840 dev board + wire-wound NFC antenna + ACR122U reader + small OLED. Prove NFC-powered signing works.
- Production: custom flex PCB + etched antenna + thin battery + e-paper segment. Standard smart card manufacturing, but not DIY.
Concept B: NFC ring (tap-to-sign, no display)
A ring with an NFC tag + MCU inside. No display, no button. You tap it on a reader; the reader displays the approval prompt; you tap again to confirm (two-tap protocol) or the ring signs immediately (single-tap, trusts the reader).
Hardware
| Component | Candidate | Notes |
|---|---|---|
| MCU | Secure element (JCOP / Infineon) or nRF52840 (WLCSP) | Must be tiny (2×3 mm package). |
| Power | Fully passive (harvested from reader) if using a secure element. nRF52840 needs a battery. | |
| Antenna | Coil wound into the ring body | Custom manufacturing. |
| Display | None | No room. |
| Input | None | Pure tap-to-sign. |
Security
- Two-tap protocol: tap to receive the request, reader displays it, tap again to sign. Forces deliberate action but still trusts the reader's display.
- Single-tap: anyone who taps your ring with a reader can sign. Only safe if the ring is always in your physical possession and the reader is trusted.
- No display = reader-trusted approval. Weaker than Concept A but much more portable.
Build difficulty
- Very hard — custom antenna winding, tiny chip placement, ring-form-factor PCB. Not DIY without specialized equipment.
Concept C: Passive NFC tag that stores keys (no on-device signing)
This is a fundamentally different idea: the tag does not sign anything. It stores key material (a mnemonic seed, a private key, or a derived key) that a host reads over NFC and uses to sign. The tag is a portable key storage device, not a signer.
How it would work
- The user taps the tag on a phone or USB NFC reader.
- The host reads the stored key material over NFC (ISO 14443 / NDEF).
- The host uses the key material to sign (the host runs the n_signer crypto).
- The tag is just storage — it has no MCU, no crypto, no battery.
What the tag stores (options)
| Storage model | What's on the tag | Security | Notes |
|---|---|---|---|
| Encrypted seed | The mnemonic seed, encrypted with a passphrase (BIP-39 password). The host decrypts after the user types the passphrase. | Medium — if the tag is stolen, the attacker needs the passphrase. | Like an encrypted paper backup, but in NFC form. |
| Raw private key | The secp256k1 private key (32 bytes), stored in the tag's EEPROM. | Low — anyone who reads the tag has the key. Only safe if the tag is PIN-protected (needs a secure element, not a dumb tag). | Like storing a private key on a USB stick. |
| NDEF URI | A URI like nostr:npub1... (just the public key). The host uses it to identify which key to use (the actual private key is elsewhere). |
High (it's just a pubkey) | Not a signer — just an identity token. |
| Shamir shard | One share of a Shamir's Secret Sharing split of the seed. The tag holds 1 of N shares; you need M tags to reconstruct. | High — a single tag is useless. | Like a metal seed backup but in NFC form. Multiple tags = multiple shares. |
| HD wallet derivation path | Just the derivation path + a reference to a master seed stored elsewhere. The tag tells the host which key to derive. | Medium | The tag is a pointer, not the key itself. |
Hardware
| Component | Candidate | Notes |
|---|---|---|
| NTAG215 (NXP) | 504 bytes user memory, no crypto, ~$0.10 | The cheapest option. Stores an encrypted seed or NDEF URI. No MCU. |
| NTAG424 DNA (NXP) | 4 KB, AES-128, tamper detection, ~$0.50 | Has crypto — can do authenticated read (the host must present a key to read the data). Better security. |
| MIFARE DESFire EV3 | 32 KB, AES, secure applets, ~$1 | Smart card chip. Can store encrypted key material with PIN/mutual auth. |
| Java Card (JCOP) | Full smart card, runs applets, ~$3-5 | Could run a "key storage" applet that only releases the seed after a PIN is verified on the host. |
Security analysis
The passive tag as key storage is the weakest signer model (the host does the signing, so a compromised host can steal the key), but it has interesting niche uses:
- Encrypted seed backup: an NTAG215 storing an encrypted seed is a convenient portable backup — tap your phone to read it, type the passphrase to decrypt. More convenient than a metal plate, less secure than a hardware signer.
- Shamir shard carrier: each tag holds one SSS share. You need M of N tags to reconstruct the seed. Distribute the tags to different locations/people. A single stolen tag is useless. This is a key-recovery tool, not a signer.
- Identity token: an NDEF URI tag with your npub. Tap to share your Nostr identity with a phone. Not a signer — just a business card for Nostr.
- PIN-protected key release: a DESFire or JCOP tag that only releases the seed after the host verifies a PIN. The host never sees the key until the PIN is correct. Better than a raw tag, but the host still gets the key after the PIN — so a compromised host can still steal it.
The fundamental limitation
A passive tag that stores keys cannot protect the key from a compromised host. Once the host reads the key, the host has it. This is the same problem as storing a private key in a file — the OS can steal it. The only way to protect the key from the host is to never release the raw key — which means the tag must do the signing itself (Concept A or B), or the tag must participate in a protocol where the host sends a hash to sign and the tag returns a signature (which requires an MCU + crypto = not a passive tag).
The one exception: a secure element (JCOP / Infineon) can do "sign inside, never release the key." The host sends the message hash; the secure element signs it internally and returns the signature. The private key never leaves the chip. This is how smart card signing works (e.g. FIDO2 keys, PIV cards). But this is Concept A (active signer), not a passive tag.
Open questions (all concepts)
- Is the goal a signer (does crypto on-device) or a key carrier (stores keys for a host to use)?
- Signer → Concept A (card with display) or B (ring). The key never leaves the device.
- Key carrier → Concept C (passive tag). The host gets the key. Simpler but less secure.
- Form factor: card (credit card size, room for display) vs ring (tiny, no display)?
- Power: passive (secure element, no battery) vs semi-passive (nRF52840 + thin battery)?
- Approval model: on-device display (secure, needs a screen) vs reader display (trusts the reader, no screen needed) vs two-tap (medium security, no screen)?
- Host reader: USB NFC reader (ACR122U, ~$15) vs phone NFC (universal, no dongle)?
- MCU/toolchain: nRF52840 + C (DIY-friendly) vs JCOP + Java Card (production, NDA)?
- Could a passive tag + a host-side n_signer be a useful "portable encrypted seed backup" even if it's not a signer? (Yes — for key recovery / Shamir shard distribution.)
Comparison across all three concepts (NFC, BLE, IR)
| NFC card (A) | NFC ring (B) | NFC tag (C) | BLE wearable | IR air-gap | |
|---|---|---|---|---|---|
| Does signing on-device? | Yes | Yes | No (host signs) | Yes | Yes |
| Key leaves device? | No | No | Yes (host reads it) | No | No |
| Power | Reader + thin battery | Reader (passive) or battery | Reader (passive) | Battery | Battery |
| Display | Tiny e-paper | None | None | Tiny OLED | Tiny OLED/e-paper |
| Approval | On-card display + button | Reader display (two-tap) | N/A (host decides) | On-device display + buttons | On-device display + buttons |
| Attack radius | ~4 cm | ~4 cm | ~4 cm | ~10 m | ~1 m (line-of-sight) |
| Host needs | NFC reader or phone NFC | NFC reader or phone NFC | NFC reader or phone NFC | BT (universal) | USB IR dongle |
| Form factor | Card | Ring | Tag/card/sticker | Wristband/pendant | Handheld |
| Build difficulty | Hard (flex PCB) | Very hard (custom ring) | Easy (off-the-shelf tag) | Moderate | Moderate |
| Best for | Daily signing | Quick tap-to-sign | Key backup / recovery | Wearable daily use | High-security air-gap |
Next steps
- Decide: signer (A/B) vs key carrier (C) vs both
- Decide: card vs ring vs tag
- Decide: DIY prototype (nRF52840 + ACR122U) vs production (secure element)
- Explore the Shamir-shard-on-NFC-tags idea as a key-recovery tool
- Explore the encrypted-seed-on-NTAG215 idea as a portable backup
- Write a plan for the chosen direction