From 81246f8000fa09099db5c3c0feaa54ed4516fe86 Mon Sep 17 00:00:00 2001 From: Sun Knudsen Date: Fri, 9 Apr 2021 13:57:09 -0400 Subject: [PATCH] Implemented Electrum mnemonic feature --- .../README.md | 111 ++++++++++++++---- ...reate-seed.py => create-bip39-mnemonic.py} | 0 .../create-bip39-mnemonic.py.sig | 16 +++ .../create-seed.py.sig | 16 --- .../qr-backup.sh | 54 ++++++--- .../qr-backup.sh.sig | 26 ++-- .../qr-clone.sh.sig | 26 ++-- .../qr-restore.sh.sig | 26 ++-- .../secure-erase.sh.sig | 26 ++-- ...ate-seed.py => validate-bip39-mnemonic.py} | 0 .../validate-bip39-mnemonic.py.sig | 16 +++ .../validate-seed.py.sig | 16 --- 12 files changed, 210 insertions(+), 123 deletions(-) rename how-to-create-encrypted-paper-backup/{create-seed.py => create-bip39-mnemonic.py} (100%) create mode 100644 how-to-create-encrypted-paper-backup/create-bip39-mnemonic.py.sig delete mode 100644 how-to-create-encrypted-paper-backup/create-seed.py.sig rename how-to-create-encrypted-paper-backup/{validate-seed.py => validate-bip39-mnemonic.py} (100%) create mode 100644 how-to-create-encrypted-paper-backup/validate-bip39-mnemonic.py.sig delete mode 100644 how-to-create-encrypted-paper-backup/validate-seed.py.sig diff --git a/how-to-create-encrypted-paper-backup/README.md b/how-to-create-encrypted-paper-backup/README.md index f054f3f..e3354fc 100644 --- a/how-to-create-encrypted-paper-backup/README.md +++ b/how-to-create-encrypted-paper-backup/README.md @@ -94,9 +94,72 @@ $ echo -e "export GPG_TTY=\"\$(tty)\"\nexport PATH=\$PATH:/home/pi/.local/bin" > $ source ~/.bashrc ``` -### Step 5 (optional): install `screen` and [Trezor](https://trezor.io/)’s [trezorcrl](https://wiki.trezor.io/Using_trezorctl_commands_with_Trezor) +### Step 5 (optional): install [Electrum](https://electrum.org/#home) (required to generate Electrum mnemonic) -> Heads-up: we will likely use `screen` and `trezorcrl` command line utilities in the future and this guide is designed to configure a [read-only](#step-12-make-filesystem-read-only) Raspberry Pi. +#### Install Electrum dependencies + +```shell +apt install -y libsecp256k1-0 python3-cryptography +``` + +#### Set Electrum release semver environment variable + +> Heads-up: replace `4.1.2` with [latest release](https://electrum.org/#download). + +```shell +ELECTRUM_RELEASE_SEMVER=4.1.2 +``` + +#### Download Electrum release and PGP signature + +```shell +curl -O "https://download.electrum.org/$ELECTRUM_RELEASE_SEMVER/Electrum-$ELECTRUM_RELEASE_SEMVER.tar.gz" +curl -O "https://download.electrum.org/$ELECTRUM_RELEASE_SEMVER/Electrum-$ELECTRUM_RELEASE_SEMVER.tar.gz.asc" +``` + +#### Import ThomasV’s PGP public key + +```console +$ curl https://raw.githubusercontent.com/spesmilo/electrum/master/pubkeys/ThomasV.asc | gpg --import + % Total % Received % Xferd Average Speed Time Time Time Current + Dload Upload Total Spent Left Speed +100 4739 100 4739 0 0 22459 0 --:--:-- --:--:-- --:--:-- 22459 +gpg: /home/pi/.gnupg/trustdb.gpg: trustdb created +gpg: key 2BD5824B7F9470E6: public key "Thomas Voegtlin (https://electrum.org) " imported +gpg: Total number processed: 1 +gpg: imported: 1 +``` + +imported: 1 + +👍 + +#### Verify Electrum release using GnuPG (learn how [here](../how-to-verify-pgp-digital-signatures-using-gnupg-on-macos)) + +```console +$ gpg --verify Electrum-$ELECTRUM_RELEASE_SEMVER.tar.gz.asc +gpg: assuming signed data in 'Electrum-$ELECTRUM_RELEASE_SEMVER.tar.gz' +gpg: Signature made Thu 08 Apr 2021 09:47:30 EDT +gpg: using RSA key 6694D8DE7BE8EE5631BED9502BD5824B7F9470E6 +gpg: Good signature from "Thomas Voegtlin (https://electrum.org) " [unknown] +gpg: aka "ThomasV " [unknown] +gpg: aka "Thomas Voegtlin " [unknown] +gpg: WARNING: This key is not certified with a trusted signature! +gpg: There is no indication that the signature belongs to the owner. +Primary key fingerprint: 6694 D8DE 7BE8 EE56 31BE D950 2BD5 824B 7F94 70E6 +``` + +Good signature + +👍 + +#### Install Electrum + +```shell +pip3 install --user Electrum-$ELECTRUM_RELEASE_SEMVER.tar.gz +``` + +### Step 6 (optional): install `screen` and [trezorcrl](https://wiki.trezor.io/Using_trezorctl_commands_with_Trezor) (required to validate integrity of [Trezor](https://trezor.io/) encrypted paper backups) ```console $ sudo apt install -y screen @@ -106,47 +169,47 @@ $ pip3 install attrs trezor --user $ sudo curl https://data.trezor.io/udev/51-trezor.rules -o /etc/udev/rules.d/51-trezor.rules ``` -### Step 6: download [create-seed.py](./create-seed.py) ([PGP signature](./create-seed.py.sig), [PGP public key](https://sunknudsen.com/sunknudsen.asc)) +### Step 7: download [create-bip39-mnemonic.py](./create-bip39-mnemonic.py) ([PGP signature](./create-bip39-mnemonic.py.sig), [PGP public key](https://sunknudsen.com/sunknudsen.asc)) ```shell -sudo curl -o /usr/local/sbin/create-seed.py https://sunknudsen.com/static/media/privacy-guides/how-to-create-encrypted-paper-backup/create-seed.py +sudo curl -o /usr/local/sbin/create-bip39-mnemonic.py https://sunknudsen.com/static/media/privacy-guides/how-to-create-encrypted-paper-backup/create-bip39-mnemonic.py ``` -### Step 7: download [validate-seed.py](./validate-seed.py) ([PGP signature](./validate-seed.py.sig), [PGP public key](https://sunknudsen.com/sunknudsen.asc)) +### Step 8: download [validate-bip39-mnemonic.py](./validate-bip39-mnemonic.py) ([PGP signature](./validate-bip39-mnemonic.py.sig), [PGP public key](https://sunknudsen.com/sunknudsen.asc)) ```shell -sudo curl -o /usr/local/sbin/validate-seed.py https://sunknudsen.com/static/media/privacy-guides/how-to-create-encrypted-paper-backup/validate-seed.py +sudo curl -o /usr/local/sbin/validate-bip39-mnemonic.py https://sunknudsen.com/static/media/privacy-guides/how-to-create-encrypted-paper-backup/validate-bip39-mnemonic.py ``` -### Step 8: download [qr-backup.sh](./qr-backup.sh) ([PGP signature](./qr-backup.sh.sig), [PGP public key](https://sunknudsen.com/sunknudsen.asc)) +### Step 9: download [qr-backup.sh](./qr-backup.sh) ([PGP signature](./qr-backup.sh.sig), [PGP public key](https://sunknudsen.com/sunknudsen.asc)) ```shell sudo curl -o /usr/local/sbin/qr-backup.sh https://sunknudsen.com/static/media/privacy-guides/how-to-create-encrypted-paper-backup/qr-backup.sh sudo chmod +x /usr/local/sbin/qr-backup.sh ``` -### Step 9: download [qr-restore.sh](./qr-restore.sh) ([PGP signature](./qr-restore.sh.sig), [PGP public key](https://sunknudsen.com/sunknudsen.asc)) +### Step 10: download [qr-restore.sh](./qr-restore.sh) ([PGP signature](./qr-restore.sh.sig), [PGP public key](https://sunknudsen.com/sunknudsen.asc)) ```shell sudo curl -o /usr/local/sbin/qr-restore.sh https://sunknudsen.com/static/media/privacy-guides/how-to-create-encrypted-paper-backup/qr-restore.sh sudo chmod +x /usr/local/sbin/qr-restore.sh ``` -### Step 10: download [qr-clone.sh](./qr-clone.sh) ([PGP signature](./qr-clone.sh.sig), [PGP public key](https://sunknudsen.com/sunknudsen.asc)) +### Step 11: download [qr-clone.sh](./qr-clone.sh) ([PGP signature](./qr-clone.sh.sig), [PGP public key](https://sunknudsen.com/sunknudsen.asc)) ```shell sudo curl -o /usr/local/sbin/qr-clone.sh https://sunknudsen.com/static/media/privacy-guides/how-to-create-encrypted-paper-backup/qr-clone.sh sudo chmod +x /usr/local/sbin/qr-clone.sh ``` -### Step 11: download [secure-erase.sh](./secure-erase.sh) ([PGP signature](./secure-erase.sh.sig), [PGP public key](https://sunknudsen.com/sunknudsen.asc)) +### Step 12: download [secure-erase.sh](./secure-erase.sh) ([PGP signature](./secure-erase.sh.sig), [PGP public key](https://sunknudsen.com/sunknudsen.asc)) ```shell sudo curl -o /usr/local/sbin/secure-erase.sh https://sunknudsen.com/static/media/privacy-guides/how-to-create-encrypted-paper-backup/secure-erase.sh sudo chmod +x /usr/local/sbin/secure-erase.sh ``` -### Step 12: make filesystem read-only +### Step 13: make filesystem read-only > Heads-up: shout-out to Nico Kaiser for his amazing [guide](https://gist.github.com/nicokaiser/08aa5b7b3958f171cf61549b70e8a34b) on how to configure a read-only Raspberry Pi. @@ -210,13 +273,13 @@ sudo sed -i -e 's/vfat\s*defaults\s/vfat defaults,ro/' /etc/fstab sudo sed -i -e 's/ext4\s*defaults,noatime\s/ext4 defaults,noatime,ro,noload/' /etc/fstab ``` -### Step 13: disable Wi-Fi (if not using ethernet) +### Step 14: disable Wi-Fi (if not using ethernet) ```shell echo "dtoverlay=disable-wifi" | sudo tee -a /boot/config.txt ``` -### Step 14: disable `dhcpcd`, `networking` and `wpa_supplicant` services and “fix” `rfkill` bug +### Step 15: disable `dhcpcd`, `networking` and `wpa_supplicant` services and “fix” `rfkill` bug ```console $ sudo systemctl disable dhcpcd networking wpa_supplicant @@ -224,13 +287,13 @@ $ sudo systemctl disable dhcpcd networking wpa_supplicant $ sudo rm /etc/profile.d/wifi-check.sh ``` -### Step 15: delete macOS hidden files (if present) +### Step 16: delete macOS hidden files (if present) ```shell sudo rm -fr /boot/.fseventsd /boot/.DS_Store /boot/.Spotlight-V100 ``` -### Step 16: reboot +### Step 17: reboot ```shell sudo systemctl reboot @@ -238,9 +301,9 @@ sudo systemctl reboot > WARNING: DO NOT CONNECT RASPBERRY PI TO NETWORK EVER AGAIN WITHOUT REINSTALLING RASPBERRY PI OS FIRST (DEVICE IS NOW "READ-ONLY" AND “COLD”). -### Step 17 (optional): disable auto-mount of `boot` volume (on macOS) +### Step 18 (optional): disable auto-mount of `boot` volume (on macOS) -> Heads-up: done to prevent macOS from writing [hidden files](#step-15-delete-macos-hidden-files-if-present) to `boot` volume which would invalidate stored SHA512 hash of micro SD card. +> Heads-up: done to prevent macOS from writing [hidden files](#step-16-delete-macos-hidden-files-if-present) to `boot` volume which would invalidate stored SHA512 hash of micro SD card. Insert micro SD card into macOS computer, run following and eject card. @@ -250,7 +313,7 @@ volume_uuid=$(diskutil info "$volume_path" | awk '/Volume UUID:/ { print $3 }') echo "UUID=$volume_uuid none msdos rw,noauto" | sudo tee -a /etc/fstab ``` -### Step 18 (optional): compute SHA512 hash of micro SD card and store in password manager (on macOS) +### Step 19 (optional): compute SHA512 hash of micro SD card and store in password manager (on macOS) Run `diskutil list` to find disk ID of micro SD card with “Raspberry Pi OS Lite” installed (`disk2` in the following example). @@ -293,16 +356,16 @@ SHA512(/dev/rdisk2)= 353af7e9bd78d7d98875f0e2a58da3d7cdfc494f2ab5474b2ab4a8fd212 ### Create encrypted paper backup -> Heads-up: use `--bip39` to test secret against BIP39 [word list](https://raw.githubusercontent.com/bitcoin/bips/master/bip-0039/english.txt). - ```console $ qr-backup.sh --help Usage: qr-backup.sh [options] Options: - --create-seed create 24-word BIP39 seed - --validate-seed validate if secret is BIP39 seed - -h, --help display help for command + --create-bip39-mnemonic create BIP39 mnemonic + --create-electrum-mnemonic create Electrum mnemonic + --validate-bip39-mnemonic validate if secret is valid BIP39 mnemonic + --label