Draft BIPs: anti-exfil signing for BIP340 and ECDSA, with PSBT fields

Hi all,

A signing device picks the nonce in every signature, so a compromised one can leak its seed through signatures that look normal. Anti-exfil fixes this by having the host contribute to each nonce and check the result. Devices already ship versions of it, but there's no agreed specification and no standard PSBT field for it.

I've written two draft BIPs. One covers the protocol for BIP340 and ECDSA, including what a host does when a device fails. The other adds three PSBT input fields. The protocol follows Scheme 6 from Pieter Wuille's 2020 overview, with a sign-to-contract tweak.

Sjors Provoost published an experimental draft in October for single-signer Taproot key-path signing, with implementations for HWI and several devices (https://github.com/Sjors/bips/pull/2). We've talked (or emailed rather), and he plans to align those implementations with this spec.

With the BIPs are test vectors, a reference in Python, a C module for libsecp256k1, and a patch series adding it to Jade's `sign_psbt`, none of it run on a device yet. One script reruns most of the checks.

No cryptographer has reviewed this and it hasn't been audited. The security argument starts with what it doesn't prove, and the evidence page lists what failed and what wasn't tested. I'm not a cryptographer, so corrections to the argument are much appreciated!

Repository: https://github.com/AvilaLabs/anti-exfil Handbook: https://anti-exfil.avilalabs.org

Connor Avila, Avila Labs