Hi Tibu,
I'd like to begin by congratulating you on this excellent project.
A recent media article caught my attention, which concerned the Bitcoin community. It detailed the extortion of Bitcoin owners in France and brought to mind earlier threats made against Hal Finney's family.
So I was wondering about the following feature.. is it possible for Seedkeeper to have Plausible Deniability / Duress PIN Implementation?
I am not specialised in this field. So I was just thinking, given the hardware constraints of Java Cards, what are the primary pitfalls of implementing a native duress PIN or hidden volume mechanism? For instance
1. Memory Management: How can a second seed/vault be stored without its existence being obvious via memory-mapping or remaining EEPROM capacity?
2. Wear Leveling/Forensics: Does writing a second PIN/seed create a physical footprint on the chip that could be detected through power analysis or side-channel attacks?
3. Applet Logic: What are the risks of state-corruption if the applet must toggle between "Main" and "Decoy" modes within the limited Java Card environment?
Is this a feature you would consider for the `Seedkeeper-Applet` or are there fundamental hardware limitations that make true plausible deniability unachievable on this platform?
all the best,
Sorry for the late reply and thanks for your thoughtful message and for raising these important points.
You are absolutely right, from a purely technical standpoint, a duress PIN mechanism is possible on a smartcard platform, including JavaCard. However, it is a complex feature to implement correctly and safely.
From a technical perspective, the main challenges are indeed related to secure memory handling, side-channel resistance, and applet state management. Storing a secondary seed or vault in a way that leaves no distinguishable footprint, whether in EEPROM usage patterns, memory layout, or power analysis signatures, is non-trivial. While careful design can mitigate many risks, achieving true plausible deniability at the hardware level is extremely difficult. Smartcards are constrained environments, and their deterministic memory architecture makes perfect concealment challenging.
That said, beyond the technical hurdles, there is also a practical security consideration.
Providing a visibly different “decoy vault” under duress may appear to be a good solution against a wrench attack. However, if such a feature becomes widely known for a given product, an attacker may immediately suspect that the first access is a decoy. In that case, the user could be placed under even greater pressure to reveal the “real” access. In other words, plausible deniability can sometimes fail precisely because it is expected.
For this reason, we chose a different emergency approach.
Seedkeeper implements a secure wipe mechanism: after five incorrect PIN attempts, the card is automatically factory reset and all data is erased. In a coercion scenario, a user can plausibly “fail” to recall the correct PIN while attempting to cooperate. This allows the device to wipe itself without explicitly signaling the presence of a hidden vault.
Both approaches are viable and have their trade-offs. However, in our assessment, a deterministic secure wipe mechanism provides clearer security guarantees and avoids the risk of escalating coercion due to a suspected hidden mode.
Ultimately, though, the real solution should not rely solely on technical countermeasures. Strong legal enforcement and meaningful consequences for extortion and physical coercion are essential. Technology can mitigate risk, but it cannot replace the rule of law.
My 2 sats of course...
