Bitcoin Hardware Security: An Interview with John Sirianni

Tropic Square CEO John Sirianni talks about the future of Bitcoin hardware security.

Hardware security

As my regular readers will know, I am taking a break from writing weekly articles and am focused on writing the book. Nevertheless, I did attend BTC Prague a few weeks back. I must say the event was excellent. I feel fortunate to have met a number of prominent Bitcoiners and was privy to a lot of great talks by eminent speakers.

One of those speakers, John Sirianni of Tropic Square, really stood out. His keynote speech, Do Not Trust, Verify. Hardware Included. was incredibly illuminating. Being a hardware neophyte, the introduction to the world of hardware security was an eye-opener for sure.

While I feel quite comfortable with logical and “meat-space” operational security, hardware security was something I very much took for granted. The fine folks at Tropic Square, however, are not taking it for granted.

They are doing their level best to bring an open-source, “do not trust, verify” model to the Bitcoin hardware space. So, today, on America’s birthday, I’m taking a little break from the book. Mr. Sirianni was kind enough to sit down with me for a nice chat.

What follows is my first interview. It was a really enjoyable experience. Mr. Sirianni is a busy man, but he was very gracious with his time and with me. I’m always eager to learn something new and this brief chat proved very illuminating.

John Sirianni Interview at BTC Prague

Daniel White: I was really fascinated by the discussion you had on the main stage and I thought it was tragically under attended by the way. There’s this whole world of cryptography — keeping keys safe with Bitcoin — and it never occurred to me to consider hardware issues.

I have a very lay understanding of the hardware manufacturing process. I’m familiar with issues like Chinese implants on chips and industrial espionage. But I was really fascinated by your talk around proprietary technology and not being able to see “under the hood.”

Can you tell me what you are doing that distinguishes Tropic Square from the current paradigm?

John Sirianni: So the genesis of Tropic Square really had to do with the early days of the development of hardware wallets. The team here at Satoshi Labs was developing one of the first hardware wallets to store your private keys offline. As they looked at various chips to put in a device they became very concerned.

They wanted to make sure that the chips they selected would be resistant to offline or physical attacks where attacker could get your your hardware wallet, break it and steal your keys. As they looked around at various chips, they found the ones that were supposed to be secure actually weren’t. They could hack them with no special equipment.

So they took a look at secure elements. This is a chip that’s supposed to be very, very secure. Its main job is to hold private data — customer data, private keys, private information. They found those chips were very weak. The issue really stems from the semiconductor industry. Back then they didn’t understand the types of attacks that people were willing to launch against cryptography keys and whatnot.

They continued to search and still couldn’t find chips that gave the solution they were looking for. With some innovation, they were actually able to make the wallets safe with some clever firmware techniques.

The wallets today are very, very secure.

DW: When you say the wallets today are secure from a hardware perspective, if you were going to pick one, would you say they’re all equally secure? Or are some doing it better than others?

JS: There are some that are doing much better than others.

DW: Care to drop any names or…?

JS: I won’t because the company I work for is owned by a company associated with Trezor. There are reviews out there. The larger brands tend to be the safer ones. If your hardware wallet falls into someone else’s hands these days, they’re not going to be able to get the keys. If it fell into an advanced government lab, like a nation-state actor, they might be able to get in.

So the developers of the hardware — they realized the real problem is the semiconductor industry wasn’t developing and testing chips specifically for this market, number one. Number two, a lot of the chips that were certified were for use cases that had nothing to do with this industry.

The most important thing is that chip companies compete on intellectual property — being more advanced or differentiated from other chip companies. To make that work, they need to keep that proprietary information secret. So the industry, for the most part, is closed when it comes to their intellectual property, which is what’s “under the hood” of the chip.

The embedded systems world today is largely open source software. RISC-V is a new hardware architecture and that’s an open hardware architecture. So there’s very little proprietary intellectual property in that ecosystem. It’s a bit of a new ecosystem.

Our developers decided they’re going to create their own semiconductor company and do it as open as possible. That’s what Tropic Square is. It’s a truly open, integrated chip. The philosophy of the company is to provide secure element chips that protect not only hardware wallets, but anything that’s involved with blockchain or the protection of private data.

What we’ve developed is an ultra-secure piece of hardware that has all of the latest intellectual property baked into it for security. If it does fall in someone else’s hands, no matter what techniques they’re using, they’re not going to be able to scan it and clone the information, even at the atomic level.

DW: Let’s talk about scanning. If someone, let’s say a highly sophisticated actor, gets a hold of a device that isn’t hardened by this technology, they could potentially clone the device and bypass the software security implementation? Or the hardware security?

JS: Actually both.

There’s something known as the PUF, the Physically Unclonable Function. It takes advantage of the variations in the chip and how it behaves at the atomic and subatomic level. So, essentially, we now have the technology to understand the uniqueness of a particular chip and then govern its methods for authenticity and attestation based on that uniqueness. We’re essentially “fingerprinting” the behavior of that chip and then that governs all of the other roots of trust in that chip.

DW: How interesting. It comes from the subatomic fingerprint of the chip, which goes up through the security architecture. That’s fascinating.

JS: If we forgot about chips for a moment, and we’re talking to an IT security specialist, they would speak in terms of system roots of trust, right? So what we’ve done is take the root of trust down to an atomic level at the hardware.

So you’re confident that everything built on top of that can have these different layers of trust, given that we know on a subatomic level, this hardware base layer is secure and we fingerprinted everything else.

It’s probably a terrible analogy, but it’s like a blockchain of trust coming up from there.

DW: Like it’s interwoven trust layers?

JS: It is interwoven in the IT Enterprise Security model of zero trust. That is what we’ve brought security down into, if you will. If you think of a chip as a house with many rooms, all with different functions — we do not allow one room to talk to another room unless it’s encrypted with very advanced cryptography and it’s only if it needs to. So zero trust.

We’re one of the first ones bringing this to the Open RISC-V hardware ecosystem, which is very exciting. This is a big advancement for things like Bitcoin. A lot of the other crypto technologies are very different, but they’re all cryptographically secure systems. Underneath all of that is hardware that we’re openly securing.

The world is building more and more blockchain based systems, whether they’re private, corporate permissioned blockchain systems, or government systems. These systems themselves — the blockchain and the hashing and the protocol methodologies are very secure.

Where the issue could be in the future is that on-ramp, off-ramp to that world, which is the devices that sit at the end. As we move forward with more artificial intelligence, as we move forward with automation becoming autonomous systems, whether it’s taxis or robots, we want to ensure that the hardware is as secure as the blockchain layers riding on top of it.

DW: Which makes perfect sense. You didn’t mention attack vectors, but we were saying there were relatively simple attacks that can be carried out against existing hardware systems.

This was possible because they were hardening for uses that weren’t anticipated — uses desired by the crypto or the Bitcoin communities.

Is that right?

JS: Yes.

What we saw were the industries that needed security at the chip level, defense and aviation mostly. They understood certain attack vectors, which are not necessarily the same attack vectors that modern thieves would use to try and trick out a password or trick out a seed phrase.

Or, they knew the problems were there, but they didn’t think the crypto or privacy use cases were significant enough, or that the threat was big enough.

DW: So they had either misallocated resources because they didn’t see the problem, or if they did see the problem, they thought the problem was so small it wasn’t worth tackling.

JS: That’s pretty much it.

The industry did not innovate in a direction that this community needed it to. They needed an alignment with the Bitcoin community. That’s why Satoshi Labs decided to start Tropic Square in 2020 — to create an open as possible secure element for this industry.

Now that this industry is growing and mainstream secure IT infrastructure is looking at how to utilize blockchain and advanced crypto methods more effectively in those networking architectures, we’re starting to see a lot of interest.

As the former critical infrastructure of our day moves into the crypto-enabled and cryptography enabled, secure blockchain infrastructure. We need these new technologies.

DW: You need the hardware to keep up with that.

JS: Yes we do.

DW: It sounds like a caveat, “As open as we can be.” Is that a caveat?

JS: This is actually a common question we get, which is, “How do we as a provider of a chip know that the FAB (fabrication facility) in some other place in the world is fact doing what we need them to do?” So the RISC-V community is new and growing quickly. There are many FABs that have aligned to that philosophy.

We’re selecting FABs that we know are aligned to that openness, to that transparency. At some point, our audit of what we’ve provided in source code and design, and what we put out on GitHub, it’s there for the for the developer of a product to look at.

When it goes into that question of how do you know what the FAB is doing, we direct them to the FAB. Then they can go off and talk to a FAB and try to understand the governance and the openness of their process. A very large customer will go off and do that.

A smaller customer will say, “Well, how many times have you guys been through this?” And we’ll say, “Well, we’ve used this fab a lot of times.” But this is common for many other customers in automotive and aerospace at this level. At some point you run out of the ability to audit the trust trend.

The good news is that the information gets deeper and deeper and deeper with every year. This RISC-V ecosystem is really opening up that process for auditability and governance.

The other thing that’s happening as the industry moves from industry 4.0 to 5.0, which carries a lot of the ethos of the green movement — efficiency, equity and open governance. All of these are trending the same way, which is open source software, hardware, open decision making processes. It’s better. It’s a bit riskier on some level, but it’s also more innovative than the closed systems of the past. So this is a decade-long transition that we’re embarking on early.

DW: There was some guy on YouTube or X that lost XRP or something. They had one letter in their password wrong, but didn’t realize it. They took it to a hardware guy who was trying to open the device by glitching it.

He was applying current to the device to break in to it. And he was successful. He clearly bypassed in-built hardware design security systems to enable more password attempts.

There’s also an Israeli security firm — I think that’s what they do with iPhones in criminal investigations — they somehow bypass the password restriction and they just brute force your four-digit passcode.

I’m guessing, but I imagine that’s what they do, assuming Apple is conscientious about their security. It’s probably some hardware glitch they figured out. So when we’re talking about this hardened architecture — that’s a big prelude to — does this provide protection against those sort of attacks?

JS: Yes.

We’ve got a lot in there to prevent against voltage glitching, which is what you’re referring to. Whether it’s electromagnetic listening, or laser scanning, or voltage glitching, there’s a lot of ways. It could be fault injection — there’s all of these techniques that are very well known, right?

Some hardware wallets have already protected against most of that. With this new generation of devices, we want to take a lot of those functions out of the commodity processor, the MCU or the CPU. We’ve put them in this special security element that protects against all of that. That’s the advantage of what we’re doing right now.

It protects against all of those known, very advanced techniques. Now in five years, will there be more attacks by other techniques? We can assume there will be, right? But this is the advantage of an open architecture. We put all the information out to the community on GitHub. We tell everyone what we’re doing.

Then researchers can play around and figure things out. And someone will say, “Hey, I found a really cool thing.” And we’ll ensure that our chip, at the firmware level, is customizable by the company that puts the chip in their device. So at any time in the future, if the community does in fact find a new attack vector, it’s much more likely to be able to be fixed quickly in a new firmware upgrade. We’re very aware of those techniques and counters to all of that. There is some IP out there that protects against that today in firmware.

There are many ways of doing it.

DW: I work in criminal justice and I’m aware of security architectures in the “meat space,” so to speak. What I’ve found is there are layers upon layers upon layers of security, right?

And in that world, I would see people go to extraordinary lengths to secure very un-valuable things. Or, they go through a lot of theater to secure one part, while right next to it they’ll basically leave the back door open.

Things like putting a massive lock on the door with a pane of glass pane built in. The security weak point is the pane of glass, regardless of the lock. That said, I’ve read about things like an Apple exploit that’s at the hardware level on the chip.

But then Apple says, “Well, if the guy has physical possession of your device and does several other complicated steps, they might be able to exploit this with 500,000 attempts.”

So the actual risk I’m trying to mitigate by ignoring this potential hardware exploit is trivial. It’s non-zero. But for most people, it’s never going to be an issue. How far does one go to mitigate these highly unlikely, but potentially catastrophic risks?

If I had a billion dollars in Bitcoin, how far do I need to go to secure it? Is a hardware wallet and a well protected passphrase enough? As an expert, how much further would you take that security?

JS: You’re absolutely right when you say security is always in layers. And what you’re trying to do is to make it really difficult for the average attacker. But if you’re sitting on a billion dollars, you’re not going to go out there on the Evening News and tell everybody because you just put a target on it.

DW: Yeah, exactly. So the level of security that one requires depends on quite a lot of factors, right?

JS: If you essentially tell the world, “I dare you.” OK, you better not even put it on one hardware wallet. You better spread it all over the place, right? Because people are coming for you. So, the first thing is, you get some security by obscurity. But if you promote yourself, you’re going to get attention.

So again, this is about layers and it’s about doing the best that you can all around. Certainly I would put it on the best hardware wallets that are available. I haven’t thought that through. I don’t see anybody giving me a billion dollars.

But you know, you could ask yourself some questions. Maybe you look at your purpose in life. And maybe at that point you’d give a lot of it away. Maybe you start your own company. Maybe you’ve always wanted to buy that island in the Pacific.

You know, at that level, that’s a different kind of question. But if you really care, if you’re an average person and you really care about keeping your coin safe, you go with the wallets that are the most trustworthy.

DW: That’s it. Keep it simple.

JS: Exactly.

A huge thank you to Mr. Sirianni for taking time out of his busy schedule to speak with me at the conference. Below is a little more about Tropic Square and their mission to create secure hardware infrastructure for the Bitcoin community.

From the Tropic Square website: We are a team of engineers & visionaries. We believe in cryptography and the importance of high standard data protection for everyone.

Our security needs have rapidly evolved in this digital age. While the majority of security institutions have not advanced in the same speed, we believe open collaboration is what can improve the hardware security world to keep up-to-date against emerging attack scenarios.

We are taking a bold step towards making that contribution.

You can learn more about Tropic Square here. They seem like a pretty cool company. It’s people like this that help make Bitcoin secure for all of us.

I hope you enjoyed this little break from the book. Now it’s back to the grindstone for me!

Visit us at *DataDrivenInvestor.com*

Subscribe to DDIntel *here*.

Join our creator ecosystem *here*.

DDI Official Telegram Channel: https://t.me/+tafUp6ecEys4YjQ1

Follow us on *LinkedIn, [Twitter](https://twitter.com/@DDInvestorHQ), [YouTube](https://www.youtube.com/c/datadriveninvestor), and [Facebook](https://www.facebook.com/datadriveninvestor)*.