Skip to content
Archive
← r/Bitcoin
1
100%
u/lockduck1 8 hours ago

ERA Wallet + dice generated seed: is there any way to verify protection against Dark Skippy?

I’m seriously considering an ERA Wallet for long-term BTC storage. My intended setup is to generate the BIP39 entropy completely outside the device using physical dice, verify the resulting seed independently, and then import the seed into the ERA. I’d use it purely as an air-gapped signer with Sparrow, communicating only via QR/PSBT. So ERA would not be involved in seed generation at all. There are several things I really like about ERA for this use case: it’s completely QR-only with no USB or Bluetooth, supports up to 10 separate wallets/seeds on one device, has a Bitcoin-only firmware, and the form factor/transaction display make it very appealing as a dedicated signer. The fact that I can generate the seed myself externally is also a big plus for me. My main reservation at this point is actually the company itself and the fact that ERA is a relatively new wallet from a company based in Dubai/UAE. I’m trying to compensate for that lack of track record by understanding exactly what can be independently verified from the firmware and audits. The one thing that makes me hesitate technically is **Dark Skippy / nonce exfiltration**. Even with a perfectly generated external seed, a malicious or compromised signing firmware could potentially leak information about the private key through ECDSA signatures by manipulating the nonce. Since ERA doesn’t appear to advertise an Anti-Klepto/anti-exfil protocol like BitBox02 or Jade, I’m trying to understand whether there is actually a meaningful way to rule this out. Has anyone gone through the ERA firmware closely enough to determine **exactly how ECDSA/Schnorr nonces are generated**? Is it RFC6979, a CSPRNG, or some combination involving external randomness/commit-reveal? Is there any nonce commitment or other mechanism that would make a Dark Skippy-style attack impossible? I’ve looked at the Keylabs audit, but I don't see a specific analysis of nonce exfiltration. What I’m really trying to figure out is whether this can be **independently verified from the published firmware/source**, or whether that part of the signing implementation is still closed. If someone familiar with the ERA codebase, secp256k1, or the Keylabs audit can point me to the relevant code or explain the signing flow, that would be extremely useful.
4 comments held Reddit says 0 on reddit ↗
  1. u/Klutzy-Sea-4857 1 8 hours ago
    Dice seed is solid for eliminating supply chain risk on key generation. But Dark Skippy is about malicious nonce generation during signing, not seed creation. Your external entropy does not protect against that. You need to verify the firmware is using deterministic nonces (RFC 6979) and ideally that has been audited. Check if they publish reproducible builds so you can verify firmware yourself. If they do not, you are trusting them no matter what. Multisig across different vendors is the real answer here.
  2. u/confuzzledfather 1 7 hours ago
    And I guess confirming that those different vendors don't share the same nonce generationncode? 
  3. u/RevolutionaryPick241 1 8 hours ago
    afaik, bitcoin signatures should be deterministic. you should be able to sign with another device and check that they match.
  4. u/Fun-Analysis-182 1 7 hours ago
    Dice seed generation doesn't help against Dark Skippy, because it's a signing attack, not a seed-generation one. The whole trick is that a malicious signer leaks your seed through the nonces in the signatures it produces, so it can exfiltrate a seed you generated perfectly with dice, in as few as a couple of signatures. What actually blocks it is an anti-exfil (anti-klepto) protocol at signing time: your coordinator feeds its own entropy into the nonce and then verifies the device used it, so the signer has no room to hide bits. So the thing to check isn't the seed path, it's whether ERA and Sparrow support and enforce that anti-exfil handshake on every signature. Without it there's no reliable way to tell from the outside that a signer isn't leaking, since a rigged nonce looks exactly like an honest one.