Awesome project!

So if I understand correctly, the NFC interface lets you both retrieve the public key and the atomically-destroyed private key?

Are you going to integrate this with the Android wallet app? It already has some NFC support and syncs with the network every 24 hours.

However, I must admit I am not entirely sure of the purpose. If you accept a firmcoin without checking it with your smart phone, it might be empty, so that's dangerous. And if you have a working smartphone, you could just as well do a direct P2P payment. I suppose the difference is, the payer doesn't have to have a phone, just the receiver. But is that really an advantage?

I don't know how Firmcoins exactly works but I think there is a potential problem.

As you said, Firmcoin can export the private key to a smartphone through NFC. Is the following attack possible?

1. The phone requests the private key through NFC
2. Firmcoin sends the key through NFC
3. The phone receives the key but does not response
4. Firmcoin is not sure whether the key has been successfully sent, and does not delete the key. (If Firmcoin deletes they key without confirmation from the phone, the key may be lost if there is communication error)

Possible solution: the Firmcoin will always send a warning to the user if it had any unsuccessful key export attempt.

Seems to me what you really want is two states:

1) Private key NOT revealed

2) Private key revealed

Unless the coin is in the state of having never revealed the private key I shouldn't accept it from someone else. However there is no need to actually delete that key until the next private key is created.

Very innovative. Me likey!

OK


I don't see how it gives higher security level.

Can you please explain what attacks you consider and how Firmcoin protects against them. I.e. "attacker does this and this", "you can protect against that if you do this and this".

The LED along with other physical security features that can be quickly checked by a user of low skill seems critical. Otherwise we're back to needing a smart phone to check the validity of the firmcoin every time it changes hands. And then you may as well just use regular phone wallets.

This is ingenius, congrats.

I believe that trust is not a boolean variable. You may trust me to hold 1 BTC for you but not to hold 1000 BTC.
If we (the manufacturers) make all possible measures to help you identify authentic hardware from counterfeit, authentic firmware from counterfeit, and so on, then you will trust us a little bit more.

We've made every possible effort so that even if we are hacked the next month, and all our private keys are stolen, a hacker cannot create counterfeit Firmcoins that pass all the tests and tools we give you to verify them.

Keep in mind that:

1. If you change the firmware of a device, then the device won't pass an offline verification tests.
2. If you change the hardware of the device, then the device won't pass offline and online verification tests
3. If you change the look of the device, then the device won't pass offline and online verification tests.
4. If you create a perfect counterfeit device, and you handle it to someone else, you're giving him the proof of your criminal act.

Best regards, Sergio.

See the Q & A section of the Firmcoin page:

Q8. What stops me walking past someone holding one of these and stealing all their money?

A8. The Firmcoin has two capacitive buttons. You have to press only one to redeem the private key. If you press both, then the private key cannot be retrieved for a few seconds.

It's true that hackers are always finding new ways to crack crypto, but since we've hired hackers ourselves, and we follow the best security practices, and we follow closely the security research, we think we will be well protected.

Now, if you see the video, they are using two type of attacks:

1. An active attack to measure the power consumption of the device to extract some "master key".

Firmcoin do not have any master key, so there is nothing to extract in one Firmcoin that let you crack another FirmCoin. If you physically break your Firmcoin, nobody will accept it as payment.

2. A passive attack technique "Side Channel Attack" to compromise some information sent by RF (without breaking the device). This kind of attacks are based on the fact that the device performs cryptographic operations using private keys. The attacks presented require repeating the same operation over and over.

If you have a Firmcoin will only send its private key after entering the "no funds" state, so there no advantage on capturing the RF signals.

You could try to attack the function that a Firmcoin can execute a private-key proof of knowledge operation. This would be the weakest point of the Firmcoin security. Currently, to prevent side-channel attacks, we four protective measures:

A. We use a side-channel protected modular exponentiation algorithm
B. We use randomization techniques to make difficult to predict where an operation is taking place.
C. We limit the frequency of proofs the Firmcoin can execute, currently at 1 every 5 seconds (after the power is applied, you must wait 5 seconds before requesting such a proof).
D. We use an industry standard tamper-proof micro-controller, made by a company with more than 10 years of experience in smart cards.

Nevertheless we might remove the private-key proof of knowledge feature if we are not totally satisfied with our power analysis tests we'll perform on the final device we'll use for mass production.

Best regards, Sergio.