Ever Wondered What Your Hardware Wallet Inputs and Outputs?
Verifying-the-security-of-QR-code-transactions

Ever Wondered What Your Hardware Wallet Inputs and Outputs?

By Cobo Vault | Cobo Vault | 6 Dec 2019


In our article on whether hardware wallets should be open source, we explained why cold storage devices cannot benefit from open source development in the same way that more well-known projects are able to. Although open source code enables a kind of “audit” on your product’s security, benefits are highly dependent on the scale of community involvement and you are ultimately making it easier for cybercriminals to discover loopholes. Still worse for hardware wallets, vulnerabilities can be exploited to produce counterfeit products with malicious code that the majority of users won’t use open source code to verify the authenticity of.

In light of the security concerns inherent in releasing source code, Cobo Vault has introduced a different type of “auditability” through the transparency of QR codes. In excluding Bluetooth, Wi-Fi, USB, NFC, and other opaque means of data transmission from our product design, we have made it easy for users to verify that their hardware wallet is not revealing their private keys or other sensitive information in any way.

How Transactions Are Created with the Cobo Vault

The Cobo Vault is an offline storage device (cold end) that cannot construct transactions without the help of an online mobile device (hot end) running the Cobo Vault app. Because private keys are stored on the offline device and remain there the entire way through, the user’s assets won’t be affected if this mobile device is damaged or lost.

Transactions are constructed and signed through QR code communication between a mobile device and the Cobo Vault in the following way:

  1. The Cobo Vault mobile app generates a QR code containing the data of a newly created unsigned transaction.
  2. The camera on the Cobo Vault (cold end) scans the QR code to obtain the transaction data.
  3. The transaction is confirmed on the Cobo Vault touchscreen, signing the transaction and outputting the signed transaction data in the form of a QR code.
  4. The camera on the hot end mobile device scans the QR code on cold end to obtain the signed transaction data.
  5. The hot end broadcasts the transaction to the blockchain network.

QR-Code-Blockain-Transaction-Process

How to “Audit” QR Code Data Transmissions

We believe that QR codes, in addition to being safe, are the most transparent means of data transmission for air-gapped cold storage. Scanning the QR codes generated by the Cobo Vault and Cobo Vault mobile app with any ordinary QR code scanner not used in the transaction process allows you to view transaction data in JSON format. In the following example, we use a Litecoin transaction to demonstrate how every aspect of our QR code data transmission process can be examined.

First we use the mobile app to create a transaction sending 0.01 LTC to the address 3Qg4Jb6GJM2vk4eDwiyouPQRAukVa5Mbk7. The mobile app generates a single QR code containing the unsigned transaction data (if transaction data is large, multiple QR codes may be generated).

Hot-End-QR-Code

Let’s first examine the unsigned transaction data output by the Cobo Vault app. Using a QR code scanner, we can view the below JSON data of which “total” (indicating the number of QR codes) and “index” (indicating the sequence of QR codes) are human-readable, while the rest is encoded.

{

"total": 1,

"index": 0,

"checkSum": "e8a68d62be1f853e21f254c57fef28c5",

  "value": "H4sIAAAAAAAAA1VRy2obQRD8FbEXHyLQPHoerVsgEGwwsYPxJeQwPdNjLVprFO1KsTH69/QK7CTLHLZfVV3Vb92JD2Pfdt1aL7vCYz70++kSd7lRO6XjMC1+HXIrvNgf2tRyG7plt2nT48egCkrJcJpSt37rNuWhbXkGiFW5QLYq5JhcLVyjpgoRSrLOVG+N85p9KaGAT0xZQSgus2Gb2RnlSk3VWlM5UarFgXIxWxcq+5wQkvNIRjOClxISZUDykQQcdJRS5RAVJwjJVmmhUmYUyjHkYhm86Jhe9yybjv3TTqLc+t11kXjoJ54Dyc2lS459RA2BVAkIShWqaAP6pGrSteowu1Lu0rSR3tsV4NXKXK2UvJWaifpnIdIuiHy0HgFnv/txP6TXh0utM0rjSuuVCQsd1wrXBheflPzN8+/uTk067f0T3JD/enNrTlvgL7/713a8u//++bh9TO6WtvMypzQcZ0p1+ZbdMz/Ps1KpLHkLkhv3vCuJBh679Q8Bf7ko9eQcB2bMwIVKlWORB6rRiV606EFTcJ6z6GC00liKEYsj5KKNxr/kxqEBL+G343S9K/wi+5yXH0SIxtcoIMFzNYLhmZw16LyzCebL26iIyWBUDlxQmuUC6Mg7YpX/USkd3oP5j0mdf4pvx3F62Bx43LShvLtxPp//AAi78Ej5AgAA",

"compress": true

}

Note that “value” (if there is more than one QR code, data is spliced according to the serial number sequence indicated by “index”) is extracted from gzip compression and Base64 encoding, after which MD5 Checksum is calculated and verified against the checkSum field.

H4sIAAAAAAAAA1VRy2obQRD8FbEXHyLQPHoerVsgEGwwsYPxJeQwPdNjLVprFO1KsTH69/QK7CTLHLZfVV3Vb92JD2Pfdt1aL7vCYz70++kSd7lRO6XjMC1+HXIrvNgf2tRyG7plt2nT48egCkrJcJpSt37rNuWhbXkGiFW5QLYq5JhcLVyjpgoRSrLOVG+N85p9KaGAT0xZQSgus2Gb2RnlSk3VWlM5UarFgXIxWxcq+5wQkvNIRjOClxISZUDykQQcdJRS5RAVJwjJVmmhUmYUyjHkYhm86Jhe9yybjv3TTqLc+t11kXjoJ54Dyc2lS459RA2BVAkIShWqaAP6pGrSteowu1Lu0rSR3tsV4NXKXK2UvJWaifpnIdIuiHy0HgFnv/txP6TXh0utM0rjSuuVCQsd1wrXBheflPzN8+/uTk067f0T3JD/enNrTlvgL7/713a8u//++bh9TO6WtvMypzQcZ0p1+ZbdMz/Ps1KpLHkLkhv3vCuJBh679Q8Bf7ko9eQcB2bMwIVKlWORB6rRiV606EFTcJ6z6GC00liKEYsj5KKNxr/kxqEBL+G343S9K/wi+5yXH0SIxtcoIMFzNYLhmZw16LyzCebL26iIyWBUDlxQmuUC6Mg7YpX/USkd3oP5j0mdf4pvx3F62Bx43LShvLtxPp//AAi78Ej5AgAA

To view the unsigned transaction data in fully human-readable JSON format, we need to decode the above “value” by first decoding Base64 then unzipping. Doing so will obtain the below unsigned transaction data.

{

   ...

   "data": {

       "type": "sign",

       "coinId": "litecoin",

       "signId": "e689147b0d79400dbf93796a0fa1ff17",

       "hdPath": "M/49'/2'/0'/0/0",

       "time": 1574849369491,

       "displayTime": "2019/11/27 18:09:29 +08:00",

       "data": {

           "to": "3Qg4Jb6GJM2vk4eDwiyouPQRAukVa5Mbk7",

           "value": 1000000,

           "memo": "",

           "fee": 340,

           "spendables": [

               {

                   "txId": "6b55e7ee9c4edbdf352b64bf85796939641b756ec369e93ee9dd23f684cd1219",

                   "value": 259246,

                   "vOutIndex": 1

               },

               {

                   "txId": "9926f869e76ef2d236eb53295653a4332f380beb2980545701e14795b65be0c7",

                   "value": 2986642,

                   "vOutIndex": 0

               }

           ],

           "dustThreshold": 100000

       }

   }

}

We use essentially the same method to examine the Cobo Vault’s data output. Firing up the Cobo Vault’s built-in camera to scan the hot end QR code described above, we then use the touchscreen to confirm and sign the transaction. Once we touch ‘Sign’, the Cobo Vault generates another QR code (when transaction data is larger, more than one QR code may be generated) containing the signed transaction data.

Signed-Transaction-QR-Code

The above QR code can be scanned (again by a QR scanner not involved in the transaction process) to produce the below JSON data.

{

"total": 1,

"index": 0,

"checkSum": "82c85bb1088dbd157ea716adacbec45e",

"value": "H4sIAAAAAAAAA61Uy25dNwz8FeOus6DEh8j8QfdB9+JDhQEj17XdNEXgfw+vk6aPZVEtBB2BHHKGc/Tl8qmenu+vHy/vx7tL1nM83T++vH1f4urXu0/74beXu1+f4pp19/h0fbnG9eHSoftlX95/ubz88Vgd+3z/y8fKvr8dfsq+KVEbtBxyGQGkH8NlsuHscc5Yf8f4/JbBhiYcTizTQNUJM2dGyBak3GBwwBNhALKGFm/N6cbEuMOqEZ/27x8+NxRM+HMNmMPGjFQ6MhuxDKtMLFBq8XChLmvLlP0ITUfOk05lUdUBLN4Y36DWkN4pIA6z8mxiKNDdFQTSATlLfB8zNqJqmt9WrAJ2l+501YDBi0lhWjk46jyIuyncWDOWo+Q8U7q22NEpZj+o/Mf6MAlotnh/ibJ2D+fEiE44C1r6NMdwHTj2TBegM/N4JWHo2kE457/zdcLIaeEs6bZHNwSoh82Wao6K5ETVpas7WAhE0CBND4cwziNdH7sJQ5JU7rguHS2J0nBVPkAt0fGWixaJzUkn4YaBZumzDyzsy9ORqicoNjAnWbWNbqRSbzUlep7twHZWgk6SuWDM9sW6SV87Fg3tjs4awBDtgKqhxOf0MBpnkK81OTPGSdqrZjNuDfAfrFQKaGeUGxBToRxtc4VviM1tKNPk2LBWtBMiD60lw9bWForeWNEhrJ5BR6nLXr3jilOzx7KBF+3WduoBMxmQXE2Ct1sEuvYA/idW39fl9fVdvwEP+fOPF6J/K3n9ChB0Co4zBAAA",

"compress": true

}

As before, the following encoded signed transaction data is obtained in human-readable JSON format through the process of decoding “value”. Careful inspection shows that the Cobo Vault’s output has not revealed private keys or other sensitive information at any stage of the process.

{

   ...

"data": {

"type": "signed",

"signId": "e689147b0d79400dbf93796a0fa1ff17",

"data": {

"txId": "593965cb45629088b43dd2dcc6a634da090f0bd3010358c8e5a8d2b95453ac9e",

"rawTx": "020000000001021912cd84f623dde93ee969c36e751b6439697985bf642b35dfdb4e9ceee7556b0100000017160014c0cf55852940360a63e0c34f06f76baf995944e1ffffffffc7e05bb69547e10157548029eb0b382f33a453562953eb36d2f26ee769f826990000000017160014c0cf55852940360a63e0c34f06f76baf995944e1ffffffff0240420f000000000017a914fc1c76bf70593d9b3cb8131a2db604f2dfbed43c87ac4322000000000017a9148201d29cb56db9a1529038f599788d1ecd5d3887870247304402206d2316532f6c1c3fc19346d85787a2dcb38841b885f04eb0fb75447469224fd00220399db2220565b7bdb34e7986913d249e65c7059d804406cfdb00dcb4d082462701210272f33eac7418165f71050c2b3ee1845ffeb3c7014b7725ddc1fd4a7e2cb50013024730440220686e04adceb90454e36f81b6cba0ca5db498d5ca077cb69cdf4776197a81ec4002204f43ecb8ca08b6a708b37cfe2b81a0574af5928f099610d5e2105ab9cc3b8b9a01210272f33eac7418165f71050c2b3ee1845ffeb3c7014b7725ddc1fd4a7e2cb5001300000000"

       }

   },

   ...

}

Yet a further step can be taken in “auditing” Cobo Vault outputs if we place the “rawTx” value in the LTC raw transaction decoder, then use the JSON data format to represent the LTC raw transaction. This method is an easy way to confirm that 0.01 LTC will be sent to the address 3Qg4Jb6GJM2vk4eDwiyouPQRAukVa5Mbk7. After we’re happy with the transaction, we tap ‘Broadcast to network’ to complete the transaction.

You’ve doubtlessly heard you should have at least one hardware wallet, but the transparency of QR code data transmissions is a lesser-known aspect of cold storage that every Hodler should be aware of. Pass on the information and let us know what you think in the comments below!


Cobo Vault
Cobo Vault

Cobo Vault is a hardware wallet built to protect your digital assets from hacking attempts, hardware tampering, and physical damage. Our aim is to drive global cryptocurrency adoption by researching and educating people about crypto security. @CoboVaut


Cobo Vault
Cobo Vault

An air-gapped, QR-code enabled hardware wallet built to protect your digital assets from hacking attempts, hardware tampering, and physical damage.

Send a $0.01 microtip in crypto to the author, and earn yourself as you read!

20% to author / 80% to me.
We pay the tips from our rewards pool.