 Show Posts
|
|
Pages: [1] 2 »
|
Awesome! Nice update. Cant wait to see the final product. Do you have price in mind?
Pretty badass tech i most say, I also wonder what would be the price range for this and will you be doing bulk orders has well, I'm defendly interested have you guys thought about getting a kickstarted going so maybe you could release a few prototypes before the official launch. Hi, The price will be determined by the hardware, thus dependent on the volume. Production in large quantities can dramatically reduce the price. We estimate that unit cost can be anywhere between 20$ to 250$. So we are definitely interested in bulk orders. The current first batch is for prototyping and getting feedback from the community. We are able to bootstrap the prototypes without relatively complicated Kickstarter campaign. Best Regards, Eliptibox Team www.EliptiBox.com |
|
|
|
Hi All, We are happy to share that the first batch of the hardware is working and blinking LED  . Also USB and BT are working well. The most critical milestone has passed OK. The boards have been assembled in June and we are in the middle of HW tests and drivers completion. Now we are focused on completing the software SDK for the board to enable open-source application development. You are welcome to watch the actual board assembly process in the following video: https://www.youtube.com/watch?v=MRVlSSbqaFgStay tuned on Twitter https://twitter.com/EliptiBox. Best Regards, EliptiBox Team www.EliptiBox.com |
|
|
|
You are spamming; advertising your product is off-topic for this thread, doubly so since its already been spamvertised once here; but since you've been so bold-- I inquired and found out that your product is based off the same weak, barely tested/reviewed, and slow as heck naive cryptographic code used in the product being discussed here. The information leak here is so severe that I am very doubtful that your (quite laudable) improved hardware isolation can prevent-- e.g. the code in question leaks several bits of information about the key from just the time it takes. Furthermore, Your "directly in silicon" is an FPGA with a loading procedure 'under the seal', this is potentially yet another back door vector, it sinks a lot of power, and really seems to be of dubious value. I would have preferably seen all the external interfaces over simple low-ish-speed serial interfaces with good electrical isolation, rather than a huge power sucking FPGA under the secure-area can. Use of a BGA probably also means you need a 4 layer board for signals routing and thus probably can't use an extra layer as a separate ground to complete the shield can. The FPGA just seems like a costly gimmick to me, and that you're misrepresenting this as a solution to bad cryptographic code (which you have made a similar failure by selecting to use it) doesn't bode well for the security of your product. Thank you for raising important issues. To refrain from spamming, the following prior link discusses the technical points raised here: https://bitcointalk.org/index.php?topic=970998.msg11295854#msg11295854EliptiBox Team |
|
|
|
We are glad that our solution is discussed in depth by community experts. This is the intention from the beginning - to open technical details of our design on our site and in the near future all SW source code, to the community review (especially harsh ones). We want to create the best solution for bitcoin storage and to answer any shortcomings before the product is ready for delivery. As for the issues raised by Greg Maxwell: - Until recently we were very focused on the system hardware and software design with the emphasis on modular easy to use architecture. We are using Trezor crypto libraries for now in the internal system tests, as it is embedded-friendly. Before releasing the product we were planning to review the crypto quality with the help of the community and achieve the best implementation. Greg's insight sharpens the issues with this library and great need for improvement. We intend to use EliptiBox by ourselves and do not want to "leak" money. - We spent a lot of time to plan highly energy-efficient power network. FPGA, BT modem and other components can be turned completely off to conserve battery. The FPGA is turned on only when needed to communicate transaction data for signing, so that the average power over time is negligible. Our power design allows the product to spend 2 years on standby or to sign 1000 transaction without charging. - PCB ground: Board design complies to the strict EM field leakage prevention, so that our board has 6 layers with complete ground layer to close the loop together with the metal RF cages. - Firewall: We've analysed many different approaches to secure decoupling between crypto HW and external world (including audio) and chose the FPGA as the most versatile and safe solution to prevent remote attacks on the HW. To ensure this, only RED crypto controller can load bitstream to FPGA. Remote attacker can not access the RED controller code through the firewall and can not change the bitstream. Moreover, we'll offer the HW as a development platform with complete description, so that anyone can play with it and audit it's features. Crypto algorithm has a crucial part in overall security. This is the reason we are going open source for feedback and swift adoption of all changes. We are always glad to read any comments and advice and implement the resulting improvements to be shared with the community. EliptiBox Team www.eliptibox.com |
|
|
|
Hope this gonna work!  Biometric verification could be awesome! Do you have a price in mind? The price will be determined by the hardware, thus dependent on the volume. Production in large quantities can dramatically reduce the price. Unit cost can be anywhere between 20$ to 250$. The volume of our next batch will be determined by the interest of the community and will have a large impact on the final price. Please subscribe on our site to help us reduce the price. EliptiBox Team www.eliptibox.com |
|
|
|
Hello All, We've started to sign transactions on the Testnet using our HW wallet prototype. We apologize for the lack of updates. Until this month we have been very busy with the board, which is now in the final production stages and should be ready soon for components placement. Now we are focused on the software side - both for the embedded and the mobile app. We'll publish demos of the new SW and wallet features as they become available. You can read more and see the transaction sign demo on our site: http://www.eliptibox.com/#!EliptiBox-Prototype-Signs-Transactions/cw4e/552ec7fc0cf213f72454bbb0You are welcome to contact us by our website anytime. EliptiBox Team www.eliptibox.com |
|
|
|
Hello All, We've started to sign transactions on the Testnet using our HW wallet prototype. We apologize for the lack of updates. Until this month we have been very busy with the board, which is now in the final production stages and should be ready soon for components placement. Now we are focused on the software side - both for the embedded and the mobile app. We'll publish demos of the new SW and wallet features as they become available. You can read more and see the transaction sign demo on our site: http://www.eliptibox.com/#!EliptiBox-Prototype-Signs-Transactions/cw4e/552ec7fc0cf213f72454bbb0You are welcome to contact us by our website anytime. EliptiBox Team www.eliptibox.com |
|
|
|
Do you exclusively rely on the community investment to start production ?
At what stage is your development ?
Why are you anonymous ?
Can you be able to show us proof, of the claims you make by some other entity other than yourselves. You just appear out of no where, with no sort of references from anyone else in the industry. This would certainly help, when it comes to developing hardware the most important thing is to know who you are. Can we be able to trust the person, etc... Its called consumer confidence, if you have a long track record of this, then you can be guaranteed people are going to pay attention. Is what you are offering open hardware specs? I forget if you mentioned that in your website. Thank you for great points. Indeed it seems we are coming from nowhere. However we've been working on this solution for the past two years "in the garage" and now ready to go public with the product. We will publish proof-of-work for each completed development stage, including pictures and video clips. Additionally, you can track our progress by blogs published on our site. The project is developed and funded only by us without any external investments. We have the means to bring EliptiBox to market. Actually, the first batch of the hardware is already in production and will be ready for release soon. Success of our croudfunding will enable us to work fulltime for EliptiBox and to go fully public with our ids. Just like you, we love to create and innovate and disrupt existing ways of thinking. Anyway, you will not have to trust us by using Eliptibox. We will open source all software, as expected by Bitcoin community, and provide full hardware description to enable public review and community development. We are the only ones to provide development kit with full access to the hardware. We'd love to hear from you about our product and support to create the best HW wallet. We invite you to think about other applications for our open hardware. We are committed to answer all questions and provide maximum information about our solution and the innovative FPGA firewall concept designed over the past two years. P.S. The case model at our site is only a first draft. Final case will look great. www.eliptibox.com |
|
|
|
You didn't see the advantages in the OP?
I see that it does more and that means it'll be costlier. Right now the hardware wallets we have are designed to be simple to reduce the attack surface. They only sign transactions. I don't see any great advantage over a simple hardware wallet if all you want is something that will store your private keys and sign transactions. Anything more than that can be done on a regular pc. Our wallet supplies much better security from the remote interface attacks by reducing the attack surface to a single point of entry, that does not include any software or standard interface vulnerabilities. Our wallet adds high-grade security to smartphones with firewall and biometric authentication and great usability of BT connection in a very small package. Simple hardware wallets are not safe enough for large amounts of BC - the only solution today is offline wallet (when done right). www.eliptibox.com |
|
|
|
These are all good points and our attempt to answer them resulted in a long explanation. So we've opened FAQ page on our site to share these and other questions with all. You are welcome to follow the link http://www.eliptibox.com/#!faq/c18gq . On the question of which FPGA we are planning to use, we chose the FPGA with the lowest price that is still large enough to contain our firewall with the provision for future updates. The part number will be published with the hardware documentation and will be available to our subscribers. www.eliptibox.com |
|
|
|
So how much will eliptibox be, and when is the 1st batch scheduled for ?
We are working hard on the product and making good progress. It's a complex project and we prefer not to set over-optimistic expectations. You are welcome to subscribe at our site to receive proof-of-work updates. We didn't set the price yet, however our intention is to distribute EliptiBox as a community platform with low margins. www.eliptibox.comDo you have a range idea yet? 50-100? 100-150? >50? The final price depends strongly on the quantity, thus on the community interest in our solution. During the following month we are advertising in order to determine the mass production volume and unit price. The price could be anywhere between 50 to 250$. www.eliptibox.com |
|
|
|
That is fine! Any vouch-copy? Like to test new wallets.
-MZ
We will create opportunities for getting our product samples. You are welcome to subscribe at our site to receive exclusive announcements. www.eliptibox.com |
|
|
|
So how much will eliptibox be, and when is the 1st batch scheduled for ?
We are working hard on the product and making good progress. It's a complex project and we prefer not to set over-optimistic expectations. You are welcome to subscribe at our site to receive proof-of-work updates. We didn't set the price yet, however our intention is to distribute EliptiBox as a community platform with low margins. www.eliptibox.com |
|
|
|
FPGAs are actually harder to secure than any other kind of hardware - they're designed for flexible & fast hardware emulation, not security (and add proprietary bitstreams on top of that, which make it harder to understand what the chip is actually doing - f.e. see https://eprint.iacr.org/2014/649.pdf). I fail to see what kind of added security an FPGA would bring, compared to another microcontroller performing the same checks using a totally different code base than the wallet code. FPGAs are used today in many markets instead of ASICs, such as 10-100 GbEthernet, wireless communication, high throughput encryption, even in smartphones (project ARA). As mentioned, their ability to implement any logic function is a great asset. But after the FPGA is configured at power-on, it is not possible to change it's function over the input-output pins. However, microcontroller is prone to attacks from it's input-output pins and dedicated interfaces (uart, usb, etc.). If a remote attacker was able to change the code on the microcontroller flash, only a single successful attack is needed. Afterwards the infected microcontroller can leak private keys, attack any device it is connected to (see recent usb vulnerability) and more without the user knowing it. (example: http://www.bunniestudios.com/blog/?p=3554) With FPGA a developer controls every single bit and logic gate inside the chip as a routine. With microcontroller you have to trust the compiler and effectively can not check the resulting binary code, because it is very different from the high-level C code written by developer. FPGA configuration can be done only over dedicated pins of the chip, which are not accessible from external interface. Moreover, we will publish the source code of the firewall, so that anyone can compile it on our development kit and validate the functionality. You are welcome to subscribe at our site to receive in-depth design documentation to be published gradually. www.eliptibox.com |
|
|
|
There is a new wallet concept - http://www.eliptibox.com/. First to talk about firewall on hardware and packed with features. Can be interesting platform for developers. Interesting concept, thanks for sharing. What does "fpga hardware firewall" means? Why do you need this if you do only offline signing? I don't assume that this wallet downloads the blockchain to let you view your transactions. I also was wondering why a field programable gate array would be used as a firewall. Apparently it does download block headers and stores tx info on the device, so says their site. FPGA enables complete decoupling between the communication messages wallet-external app and the wallet crypto code. With regular microcontoller (that all HW wallets use) the code you write in editor is not the code that runs on the device. Compiler optimizes (=rewrites) it and linker adds large blocks of 3rd party code automatically. Furthermore, usually the messages data is at the same physical memory as the code, so it is possible to change the code of the microcontroller by malicious message injection that exploits bugs in the chip design or the code. (buffer overflow as a common example). If the same microcontroller is connected directly to the external interface, like USB, Cellular or BT, remote attacker can gain control over the interface and base his attacks from inside the wallet. We often read about new interface breach, like in USB or GSM or weak BT. However, in FPGA you run exactly the code you've written and can verify it by looking at the final silicon configuration. There is no software or ability to change the FPGA code when running. So the code for the internal MCU can be upgraded and multiple external non-secure interfaces can be used without breaching the security. FPGA chip sits in-between and makes sure only "legal" data goes through. www.eliptibox.com |
|
|
|
|
