feat(zcash): add seed_fingerprint binding to FVK / address / sign messages - #27
Merged
Merged
Conversation
…sages
ZIP-32 §6.1 seed fingerprint:
SeedFingerprint := BLAKE2b-256("Zcash_HD_Seed_FP", seed)
A 32-byte stable identity of the device's seed. Adds optional bytes
seed_fingerprint fields across the existing zcash messages so hosts
and devices can bind FVKs, addresses, and signing sessions to a
specific seed identity.
Four new fields, all optional, fully backward compatible:
ZcashOrchardFVK.seed_fingerprint (4)
Returned alongside (ak, nk, rivk). Lets a host pin an FVK to
this device's seed.
ZcashAddress.seed_fingerprint (2)
Returned alongside the confirmed UA after on-device verification.
Lets a host record "this address is on this device's seed."
ZcashSignPCZT.expected_seed_fingerprint (31)
Sent by host. If present, device checks against its own
fingerprint and rejects with Failure on mismatch before signing.
Mirrors Keystone3's PCZT zip32_derivation seed_fingerprint check
at the session level (one tx = one seed, no per-action duplication
needed for our flow).
ZcashDisplayAddress.expected_seed_fingerprint (7)
Sent by host. Same rejection semantics as above before displaying.
Matching nanopb max_size:32 entries added to messages-zcash.options.
No existing fields modified. Devices and hosts that don't populate
the new fields continue to work unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds optional ZIP-32 §6.1 seed fingerprint fields across the existing zcash messages to enable seed-identity binding for FVKs, addresses, and signing sessions.
A 32-byte stable identifier of a device seed. Mirrors Keystone3's PCZT `zip32_derivation.seed_fingerprint` check, but at the session/response level rather than per-spend (one tx = one seed; per-spend duplication isn't needed for our flow).
Changes
Four optional fields, all additive, fully backward compatible:
ZcashOrchardFVKseed_fingerprint(4)(ak, nk, rivk). Lets host pin an FVK to a device's seed.ZcashAddressseed_fingerprint(2)ZcashSignPCZTexpected_seed_fingerprint(31)Failureon mismatch.ZcashDisplayAddressexpected_seed_fingerprint(7)Matching
messages-zcash.optionsentries (max_size:32) for each.Backward compatibility
All four fields are
optional. Existing devices and hosts that don't populate them continue to work without change. Devices that don't yet implement the validation will simply ignore theexpected_seed_fingerprintfields and skip the binding check.Review path
This is the fork-master review PR. Once merged, a follow-up PR will land the same commit on `keepkey/device-protocol:master` upstream for long-term external review.
Test plan
feature-zcashbranch onkeepkey-firmware) builds against new pin