{"id":22185006,"url":"https://github.com/sziller/_btc_cs_desktop","last_synced_at":"2026-04-27T16:33:01.492Z","repository":{"id":97803091,"uuid":"574605096","full_name":"sziller/_btc_cs_desktop","owner":"sziller","description":"Desktop application of the 2 part cold storage solution","archived":false,"fork":false,"pushed_at":"2023-02-24T23:08:59.000Z","size":26460,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-10-19T18:43:29.555Z","etag":null,"topics":["bitcoin","bitcoin-node","blockchain","desktop-application","linux","qr-code","transaction-manager","ubuntu","wallet","windows"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sziller.png","metadata":{"files":{"readme":"README.adoc","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2022-12-05T17:14:34.000Z","updated_at":"2025-09-11T16:01:30.000Z","dependencies_parsed_at":null,"dependency_job_id":"d505a249-d258-4f28-b15d-e7dea7c536b6","html_url":"https://github.com/sziller/_btc_cs_desktop","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/sziller/_btc_cs_desktop","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sziller%2F_btc_cs_desktop","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sziller%2F_btc_cs_desktop/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sziller%2F_btc_cs_desktop/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sziller%2F_btc_cs_desktop/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sziller","download_url":"https://codeload.github.com/sziller/_btc_cs_desktop/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sziller%2F_btc_cs_desktop/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32345804,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-26T23:26:28.701Z","status":"online","status_checked_at":"2026-04-27T02:00:06.769Z","response_time":128,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bitcoin","bitcoin-node","blockchain","desktop-application","linux","qr-code","transaction-manager","ubuntu","wallet","windows"],"created_at":"2024-12-02T10:14:50.992Z","updated_at":"2026-04-27T16:33:01.479Z","avatar_url":"https://github.com/sziller.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"= _btc_cs_desktop\n\n*Sallet* - it protects your head\n\nDesktop application of the 2 part cold storage solution system described below.\nCan be used as the frontend of my Raspi based Ice Cold wallet.\n\n== Cold storage system - *Sallet*\n*Sallet* is for users aware of the importance of low level data. Users who are able to make decisions close the TX and UTXO scope. +\n*Sallet* is meant for users who do not like when 'user-friendliness' abstracts\n  away important information and hides substantial data from the conscious user. +\n*Sallet* is also for users who want to keep their Satoshis close to the chest.\n  It is a cold storage system, meaning:\n \n - private keys (and all data private keys can be derived from) are kept off-line\n - signing happens off-line\n\n== Description\nI'll create a low-level off-line, off-chain bitcoin transaction handler. First and foremost a Cold storage system using up-to-date protocols.\n\n//[NOTE]\n____\n`Fundamental security assumption:` The signing device touching private keys, signing transactions or handling random numbers is at all times:\n\n- running flawed software, \n- infected by malicous code,\n- harboring null-day-backdoors,\n- not able to generate proper entropy.\nIn short, is an unpredictable and adversary actor on it's own. +\nObviously we still need to refine these assumptions, as a fully unpredictable machine can not be dealt with. We simply plan for the worst we can still handle.  \n____\n\n//[TIP]\n____\n`Proposed solution to the assumpltion:` we implement an air-gap after the adversary device. Anything is allowed to enter the device, nothing corrupted may leave it. The device is only allowed to communicate via analogue methods with the outside word. +\nData meant to exit the device is turned into QR codes later to be displayed on a dedicated screen. +\nEntropy is off analogue source.\nUmpredicibility is dealt with using probability: Results of key management can and will be checked on regular basis against external sources.\nAs we cannot handle all negative situations, we need to constantly audit possible worst cases, and adjust risk on higher levels by not creating transactions commanding more value, than what a possible attack on them may cost (even with the famous 'number-go-up' technology in mind!\n____\n\nIsolation in detail:: Signing device does not house hardware capable of wireless messaging, bluetooth, NFC or and mediumless data transfer methods.\nDevice can additionally be shielded mechanically. Device will receive input over a camera in QR format only.\nInput is not the issue. The problem are input methods, that may unbeknownst to the user communicate outwards:\nWe will not use UTP connections. Digital USB data transfer may only hapen using write protected SD cards. However write protection on most SD cards is OS (software) managed, it is not secure. Thus once used SD card should immediatelly be destroyed (Mission:Impossible).\nMost of the data entering the device AFTER installation is small enough to be represented as a small number of QR Codes.\n\nScope of the isolation:: Private keys, signatures, and random numbers are used, when Raw transactions are signed. Looking at the technical level, the adversary signing device only needs to receive Raw transactions and return signatures. +\nThis does not mean, we have to limit the features of the signing device as long as not limiting it has other security advantages or user friendly features not affecting security.\n\nRandom number generation:: Private keys are generated using\n\nTesting using probability:: project will include automated tests to constantly monitor results of key generators against results of different online key generators. These will also test if code uses user-provided entropy. The same method will be used to check if signature module uses proper entropy.\n\n== Building blocks\nThere are two devices we will develop for:\n\n=== 1. Signing device\nSensitive functions will be taken over by the isolated device\n\n=== 2. Desktop application\nIn order to still use the environment you know and love, all functions not needing special protection are handled on your desktop, or even by your phone.\n\n== Desktop application\nThis repository exclusivelly includes development for teh Desktop App.\nPlease note, your desktop will have to have a working camera connected to, as all data leaving the Signing Device enters your desktop app as a QR Code.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsziller%2F_btc_cs_desktop","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsziller%2F_btc_cs_desktop","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsziller%2F_btc_cs_desktop/lists"}