Trezor and Keepkey require user interaction

[achow101]

The Trezor and Keepkey both require that the user respond to prompts and to enter things into the keyboard which are then sent to the device over USB. This is not ideal for us since HWI is intended to be a utility where everything the user needs to do is done in one command. I don't see any way around this though as all of the prompts require seeing something on the device's display which we are unable to see with software.

[instagibbs]

How is this different from transaction signing requiring prompts?

…

On Sat, Dec 29, 2018, 11:56 AM Andrew Chow ***@***.*** wrote: The Trezor and Keepkey both require that the user respond to prompts and to enter things into the keyboard which are then sent to the device over USB. This is not ideal for us since HWI is intended to be a utility where everything the user needs to do is done in one command. I don't see any way around this though as all of the prompts require seeing something on the device's display which we are unable to see with software. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#83>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFgC02UwphyBI-gTDmcb3Re-jR1-RaTvks5u9569gaJpZM4Zko9T> .

[achow101]

Transaction signing prompts require the user to interact with the device itself. These prompts require the user to interact with the computer the device is connected to.

[instagibbs]

Ah the host.

…

On Sat, Dec 29, 2018, 12:20 PM Andrew Chow ***@***.*** wrote: Transaction signing prompts require the user to interact with the device itself. These prompts require the user to interact with the computer the device is connected to. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#83 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFgC01zT2KK8Y8Y4AEMRj8IlBRFifiQSks5u96R0gaJpZM4Zko9T> .

[achow101]

If trezor/trezor-mcu#442 is accepted, the Trezor would let users enter the pin on device which fixes this issue for us for the Trezor.

[kewde]

I can attest to the difficulty of integrating it with bitcoin-core.
I've written the implementation primarily to support our integration (C++) into particl-core.

Essentially, as a workaround, I've opted to write a custom Open() handler.
When for example a signing request tries to open a handle to the usb device, it will initiate a full unlock of the device (if necessary).
The tricky thing is, during the user interaction, it can not maintain the handle, it has to release it and "poll the device at regular intervals".
The device caches the PIN and passphrase.
particl/particl-core#52

function Sign() {
    usb = OpenWithUnlock(); // get handle on usb device
   ...
}

function OpenWithUnlock() {
    sendPingMessageToTrezor(); // triggers unlock procedure
    stop = false;
    while (!stop) {
        usb = Open(); // Opens a real handle
        msg = Read(usb);
        if (msg === Success || Failure) {
            stop = true;
        } 
        Close(usb);
        Sleep();
    }
    return Open();
}

function Unlock() {
    usb = Open(); // Opens a real handle
    Send(usb, pin);
     // Do not Read() at this step, or the unlock loop will catch it.
}

[keepkeyjon]

trezorctl and go-keepkey solve this nicely by taking over the terminal & sending ansi escape sequences as appropriate to make the 'ui' work:

$ go-keepkey changePin
DebugLink established over WebUSB
Connected to 1 devices
  -- Serial#: , Label: 
Awaiting user button press
sending debug press
Enter your pin using the corresponding positions shown on your device
7 | 8 | 9
4 | 5 | 6
1 | 2 | 3

✔ Pin: ********█

If trezor/trezor-mcu#442 is accepted,

We're a bit limited since we've only got one button, which makes on-device PIN entry a pain in the ass. I've prototyped this for KeepKey, but the UX is awful. Passphrase would be even worse.

When for example a signing request tries to open a handle to the usb device, it will initiate a full unlock of the device (if necessary).... The device caches the PIN and passphrase.

Our device will fall for the same trick. Any command that involves key derivation will work (GetAddress without showing on the display is a good one). IMO though, it would have been better if there was a SessionRequest message that the device could use to prompt for it, preventing many of this kind of 'hack'... it should be difficult to do what you're trying to do here.

For Trezor's you need to avoid re-sending Initialize unless you're careful about maintaining the session bytes: https://github.com/trezor/trezor-mcu/blob/7dce7bd92d65726e08e0311f9821f6cc966b44a1/firmware/fsm_msg_common.h#L26. We don't have that yet, but should.