← Projects

Air-Gap TX Signer

Hardware arriving
EthereumHardwareSecurityCEmbedded

Keeps an Ethereum test key on a small offline signer. The computer prepares a transaction; the device confirms and returns a signature without joining a network.

Technical The host builds unsigned Sepolia transactions and signing digests; the RP2040 path uses C implementations of Keccak-256 and recoverable secp256k1 over USB serial. Desktop known-answer tests pass; Phase 2 firmware (USB serial PING/PONG, LED heartbeat) builds and waits for physical validation on a LAFVIN Pico starter kit.

Source
GitHub →
Air-Gap TX Signer screenshot

Case Study

Problem

I want a physically confirmable, air-gapped way to sign Ethereum transactions for learning and demo use, without putting a private key on a networked host.

What I designed and implemented

  • Portable Keccak-256 and secp256k1 path in C, verified against Python/Ethereum reference vectors
  • Host tooling to build unsigned Sepolia transactions, assemble signed raw txs, and talk USB serial
  • Firmware protocol for PING/PONG, VERSION, GET_ADDR, and confirm-gated SIGN
  • Phase 2 Pico bring-up firmware that builds via make firmware-build

Architecture

  • Host builds the unsigned transaction and signing digest
  • Pico holds the key, shows a summary, waits for Confirm/Cancel, returns r/s/v over USB
  • Host attaches the signature and can broadcast to Sepolia
  • Pico stays offline: no Wi-Fi or networking

Engineering decisions

  • Use Ethereum Keccak-256, not NIST SHA3-256
  • Keep Python as the reference generator and C as the implementation under test
  • Ship USB serial bring-up before LCD, buttons, and on-device secp256k1

Verification and testing

  • desktop test harness against vectors/known_answers.json: ALL PASS
  • Known-answer coverage for Keccak, key derivation, Ethereum address, recoverable ECDSA, and a legacy Sepolia signing hash
  • Firmware builds with make firmware-build; physical Pico validation still pending

Limitations and what is simulated

  • Physical hardware validation checklist still open
  • RP2040/libsecp256k1 on-device path is not validated yet
  • Demo key in vectors is public and must never be funded
  • Testnet/learning use only, not a mainnet-safe wallet

Production differences

  • Next hardware path: USB hello on device, LCD + buttons, crypto port, confirm UX, then Sepolia end-to-end