Use of HSM for coinjoin transactions

[uwuforever]

Intro

Wasabi currently requires coins to be stored in a hot wallet in order to be coinjoined. I understand why a traditional hardware wallet like Ledger couldn't be used, but it still makes me nervous having my wallet available on an Internet connected computer. I'm wondering if a HSM like the USB Armory Mk II could be used.

Like a hardware wallet, the wallet private key could be saved on here and it could offer an interface that only allows signing while keeping the private key secret, but unlike a traditional hardware wallet, it runs a full Linux environment so it could be set up to automatically sign valid coinjoin transactions. This HSM will not have Internet connectivity itself but will be plugged in via USB to an internet connected computer running the full Wasabi client. During coinjoins, the Wasabi client passes it an unsigned coinjoin transaction via USB interface, and if the transaction passes sanity checks, it automatically returns a signature. The Wasabi client would never have access to the private key itself, and the HSM will only sign valid coinjoin transactions that include the expected outputs, preventing an attacker who manages to break into my Wasabi client from emptying my wallet.

Proposal

Protocol:

• the coordinator would publish a public signing key that will be used to sign coinjoin transactions for authenticity - which the HSM will check. This key is only used to validate to the HSM that the transaction came from the real Wasabi coordinator and not used for any other purpose. The HSM will still perform additional sanity checks, so even if an attacker had this key and access to my Wasabi client, their payday is limited to sending fake coinjoin transactions paying the coordinator fee (capped by the rate limit) to themselves.
• the /api/v4/btc/ChaumianCoinJoin/coinjoin API endpoint would return both the unsigned Coinjoin transaction, as well as a coordinator signature verifying the authenticity of the coinjoin transaction.

The HSM:

• The HSM, once configured, will request a PIN only on startup, but otherwise work without any user input. This resolves the issue preventing a traditional hardware wallet from being used for coinjoin - the frequent need for user input to unlock/confirm transactions.
• The HSM, once configured, will interface with a Wasabi client via a USB interface. Wasabi sends it an unsigned transaction as well as the coordinator signature; the HSM does its sanity checks (looks like a coinjoin; expected outputs included & correct amounts; coordinator signature valid; within rate limit bounds) and either returns a signature automatically or a failure code. The private key is never made available. The sanity check & rate limit prevents an attacker from simply requesting the HSM sign a transaction that empties the wallet.

To implement:

• Generate and publish a public signing key
• Add the coordinator signature to the /coinjoin endpoint
• Write script to validate and sign transaction that runs on the HSM - this code could possibly be mostly taken from the Wasabi client itself
• Add a feature to the Wasabi client allowing HSM signed wallets; just replace the built-in transaction signing in the Coinjoin procedure with code to request a signature over the USB interface instead

Maybe offer an option to store the full wallet data/sensitive log data on the HSM memory; it could be a separate section of its memory that allows read/write, which is unlocked with the same PIN used to authenticate on startup. This would eliminate the need for wallet files and further limits the sensitive data that is stored on the Wasabi client itself, so I can maintain the privacy of the wallet even if I cannot easily encrypt the drive the Wasabi client is installed on. If the HSM is locked or removed - there is no trace of the wallet - not even log data or transaction history, only a clean Wasabi install.

[karozagorus]

Imagine this with WabiSabi.

[Transisto]

The Coldcard MK3 and MK4 have an HSM mode that can be talked to via CLI https://coldcard.com/docs/hsm/protocol

[BTCparadigm]

This discussion is now locked, as feature/enhancement requests are being moved to the Issues tab for further processing. Please use #9815 for future comments regarding this.
Thank you for your understanding.