<blockquote>
<p>The wallets can have a malicious random number generator.</p>
</blockquote>
<p>There are several ways to be malicious. Typically random number generators are considered malicious when they are
somehow predictable, so if you use them someone else can guess your &quot;random number&quot;.</p>
<p>But that doesn't seem like what your plan protects you from.</p>
<p>What you verify with your procedure is that your hardware wallet do not give you a different seed (when you do the initial setup or ask to export it) from the one it used to generate the private keys and related addresses, that it uses when you receive or send funds with him.
In this meaning, the seed (from which private and public keys are derived in HD wallets) would not be yours but belong only to your hardware wallet: you can receive and send using the device, but if you import the seed elsewhere there are no associated funds, because it's different from the one used by Trezor.<br>
However I have never heard of such a problem on any hardware wallet.<br><br></p>
<blockquote>
<p>The wallets can generate address for keys that are not mine</p>
</blockquote>
<p>This don't make sense to me, public addresses are derived from private keys, so the wallet need to have the private
keys to generate addresses  ... i'm not sure what you mean.</p>
<p>Furthermore, you can't verify that you are the sole owner of a seed or a private key, the most you can do is make
sure that this does not leak out, but if somehow someone manages to copy, predict or generate it randomly, you can't
notice until the money goes away.</p>
<p>So, all things considered, I think you can avoid having to verify the seeds that your wallets give you, because this
adds practically nothing to the security you already have using multisig addresses with 2 hardware wallets evaluated
as Trezor and Coldwallet, that are already heavily scrutinized, as you can see <a href="https://medium.com/@brandonarvanaghi/analyzing-trezor-firmware-mnemonic-seed-generation-for-bitcoin-and-ethereum-4b03fbaad24d" rel="nofollow noreferrer">here</a> for example.<br><br><br></p>
<blockquote>
<p>PS: I know that if the trezor has a malicious random number generator and it creates a private key that not only myself own, this is a privacy leak, but not a problem. And it's a privacy leak only when I spend from this address, revealing the public key on the blockchain.</p>
</blockquote>
<p>I'm not aware of troubles with Trezor rng (have you any reference for this?), but if your private keys are leaked you will lose your funds almost istantly, there is no need to wait you spend, as said before, public key and addresses derive from private key, so if you have this you don't need anything else</p>

CC BY-SA 4.0
2021-04-20T20:52:15.653Z
Yes but in the coldcard I'll generate my seed using dices, so I can be sure it's mine. I'll verify in a raspberry that the dices indeed generate that seed
Gatonito
CC BY-SA 4.0
2021-04-20T21:19:36.600Z
how private keys cannot be your? if a wallet can generate an address it must have its private key... seems to me you have some misconceptions, can you provide any links to which threat you try to prevent?
leevancleef
CC BY-SA 4.0
2021-04-20T21:23:40.113Z
I think the question assumes that firmware running in Hardware Wallet can actively try to display a different address than the one associated with the private key.
sanket1729
CC BY-SA 4.0
2021-04-20T21:50:07.857Z
So if you have 2 wallets that generate different addresses for the same seed how do you know which is the correct one? there is no easy way to have consensus on which address is right if you don't trust your wallet and you can't read the code.
leevancleef
CC BY-SA 4.0
2021-04-20T21:50:59.170Z
The reason because hardware wallet show address on its own display is exactly to avoid address tamper on an external software, but you need to trust at least your HW firmware and to do it, you are given the source code and its sign.
leevancleef
CC BY-SA 4.0
2021-04-21T01:16:19.807Z
The difference is that it's 2 wallets generating the same multisig address. One I cannot trust to have generated a truly random private key, the one I can.
Gatonito
CC BY-SA 4.0
2021-04-21T08:53:17.830Z
If you don't trust Trezor software why do you use it? use 2 Coldcard instead ... the rpi test is quite useless, if you can't trust the hardware wallet software you shouldn't trust the raspberry pi software also.
moreover there are more risk on using the wallet than on generating keys and addresses on it, as you can see here: https://thecharlatan.ch/List-Of-Hardware-Wallet-Hacks/ 
so you should address these risk as well, but multisig wallet are a good start :)
leevancleef
CC BY-SA 4.0
2021-04-20T20:48:26.247Z
2021-04-20T20:48:26.247Z
leevancleef
<p>My plan is to make a multisig between coldcard and trezor. I want to audit and verify that I indeed own the 2 keys of these wallets, using a raspberry pi zero (no wifi/bluetooth by definition) on a very old HDMI tv with no internet either, and using a virtual keyboard and simply a mouse on the pi zero.</p>
<p>These are the possible risks I want to mitigate:</p>
<ul>
<li><p>The wallets can have a malicious random number generator.</p>
</li>
<li><p>The wallets can generate address for keys that are not mine</p>
</li>
</ul>
<p>To eliminate the risk of the trezor generating a private key I don't own, I'm gonna put its key on the raspberry pi zero and see that it generates the same master pubkey and shown in trezor. This proves I own this key, but it might be a kew that someone already owns. No problem, that's why I'm doing multisig.</p>
<p>On the coldcard, I'll generate a seed using dices, and then verify on the raspberry pi that those dice rolls indeed generate the private key shown by coldcard. This proves that I own a private key that no one owns, because it was generated using dices.</p>
<p>Now that I have 2 private keys that I own, and at least one of them I'm the only owner, I can create a multisig wallet on Electrum or maybe BlueWallet. I'll annotate the first 10 addresses generated by the software wallet, and verify if they match on the coldcard and on the trezor. If the 3 show the same 10 set of addresses, I can consider these addresses safe for receiving Bitcoin.</p>
<p>I'll then receive some Bitcoin on one address, erase both wallets, restore them with the private keys, and then try to spend this Bitcoin, just to make sure I really owned the coins.</p>
<p>What are the possible problems I can encounter? Am I forgetting something important?</p>
<p>PS: I know that if the trezor has a malicious random number generator and it creates a private key that not only myself own, this is a privacy leak, but not a problem. And it's a privacy leak only when I spend from this address, revealing the public key on the blockchain.</p>
<p>I also plan to use just PBST air-gapped transactions on Coldcard, and a trusted computer to broadcast.</p>

<multi-signature><hardware-wallet><trezor><coldcard>
Is this scheme for multisig audit of Trezor + Coldcard ok?
Gatonito
# Is this scheme for multisig audit of Trezor + Coldcard ok?

(Asked by: username_0 on 2021-04-12)

My plan is to make a multisig between coldcard and trezor. I want to audit and verify that I indeed own the 2 keys of these wallets, using a raspberry pi zero (no wifi/bluetooth by definition) on a very old HDMI tv with no internet either, and using a virtual keyboard and simply a mouse on the pi zero.

These are the possible risks I want to mitigate:

* The wallets can have a malicious random number generator.
* The wallets can generate address for keys that are not mine

To eliminate the risk of the trezor generating a private key I don't own, I'm gonna put its key on the raspberry pi zero and see that it generates the same master pubkey and shown in trezor. This proves I own this key, but it might be a kew that someone already owns. No problem, that's why I'm doing multisig.

On the coldcard, I'll generate a seed using dices, and then verify on the raspberry pi that those dice rolls indeed generate the private key shown by coldcard. This proves that I own a private key that no one owns, because it was generated using dices.

Now that I have 2 private keys that I own, and at least one of them I'm the only owner, I can create a multisig wallet on Electrum or maybe BlueWallet. I'll annotate the first 10 addresses generated by the software wallet, and verify if they match on the coldcard and on the trezor. If the 3 show the same 10 set of addresses, I can consider these addresses safe for receiving Bitcoin.

I'll then receive some Bitcoin on one address, erase both wallets, restore them with the private keys, and then try to spend this Bitcoin, just to make sure I really owned the coins.

What are the possible problems I can encounter? Am I forgetting something important?

PS: I know that if the trezor has a malicious random number generator and it creates a private key that not only myself own, this is a privacy leak, but not a problem. And it's a privacy leak only when I spend from this address, revealing the public key on the blockchain.

I also plan to use just PBST air-gapped transactions on Coldcard, and a trusted computer to broadcast.

**Tags:** multi-signature, hardware-wallet, trezor, coldcard


---

## 1 answers

### Answer by username_1 on 2021-04-20. Score: 0

> The wallets can have a malicious random number generator.

There are several ways to be malicious. Typically random number generators are considered malicious when they are
somehow predictable, so if you use them someone else can guess your "random number".

But that doesn't seem like what your plan protects you from.

What you verify with your procedure is that your hardware wallet do not give you a different seed (when you do the initial setup or ask to export it) from the one it used to generate the private keys and related addresses, that it uses when you receive or send funds with him.
In this meaning, the seed (from which private and public keys are derived in HD wallets) would not be yours but belong only to your hardware wallet: you can receive and send using the device, but if you import the seed elsewhere there are no associated funds, because it's different from the one used by Trezor.  
However I have never heard of such a problem on any hardware wallet.

> The wallets can generate address for keys that are not mine

This don't make sense to me, public addresses are derived from private keys, so the wallet need to have the private
keys to generate addresses ... i'm not sure what you mean.

Furthermore, you can't verify that you are the sole owner of a seed or a private key, the most you can do is make
sure that this does not leak out, but if somehow someone manages to copy, predict or generate it randomly, you can't
notice until the money goes away.

So, all things considered, I think you can avoid having to verify the seeds that your wallets give you, because this
adds practically nothing to the security you already have using multisig addresses with 2 hardware wallets evaluated
as Trezor and Coldwallet, that are already heavily scrutinized, as you can see [here](https://medium.com/@brandonarvanaghi/analyzing-trezor-firmware-mnemonic-seed-generation-for-bitcoin-and-ethereum-4b03fbaad24d) for example.

> PS: I know that if the trezor has a malicious random number generator and it creates a private key that not only myself own, this is a privacy leak, but not a problem. And it's a privacy leak only when I spend from this address, revealing the public key on the blockchain.

I'm not aware of troubles with Trezor rng (have you any reference for this?), but if your private keys are leaked you will lose your funds almost istantly, there is no need to wait you spend, as said before, public key and addresses derive from private key, so if you have this you don't need anything else

> **Comments:**
> **username_0**: Yes but in the coldcard I'll generate my seed using dices, so I can be sure it's mine. I'll verify in a raspberry that the dices indeed generate that seed  
> **username_1**: how private keys cannot be your? if a wallet can generate an address it must have its private key... seems to me you have some misconceptions, can you provide any links to which threat you try to prevent?  
> **username_2**: I think the question assumes that firmware running in Hardware Wallet can actively try to display a different address than the one associated with the private key.  
> **username_1**: So if you have 2 wallets that generate different addresses for the same seed how do you know which is the correct one? there is no easy way to have consensus on which address is right if you don't trust your wallet and you can't read the code.  
> **username_1**: The reason because hardware wallet show address on its own display is exactly to avoid address tamper on an external software, but you need to trust at least your HW firmware and to do it, you are given the source code and its sign.  
> **username_0**: The difference is that it's 2 wallets generating the same multisig address. One I cannot trust to have generated a truly random private key, the one I can.  
> **username_1**: If you don't trust Trezor software why do you use it? use 2 Coldcard instead ... the rpi test is quite useless, if you can't trust the hardware wallet software you shouldn't trust the raspberry pi software also. moreover there are more risk on using the wallet than on generating keys and addresses on it, as you can see here: https://thecharlatan.ch/List-Of-Hardware-Wallet-Hacks/  so you should address these risk as well, but multisig wallet are a good start :)  

---

