As DIY stateless air-gapped signing devices become more popular, open-source hardware initiatives have matured into an essential component of Bitcoin DIY self-custody. This post is meant to dissect the technical design, main distinctions and threat models of the two best-known and most popular DIY signers, SeedSigner and Krux, as well as some hands-on testing metrics.
1. Architectural Design & StatelessnessPrivate keys or seed phrases are not stored on flash in either project, so neither can be considered as stateful. Whenever the box is powered off, all secret coding material is totally erased from RAM.
SeedSigner: This runs on top of both Raspberry Pi Zero (v1.3 or v2 W) from which the Wi-Fi/BT chips have been physically removed/disabled. It is run on a small version of the Linux operating system (OS) using custom-built MicroSD for this purpose.
Krux: Updated to work mainly for K210 dual core RISC-V microcontroller (such as Maix Amigo, Yahboom K210, M5StickV). It features software that is closer to the pure MicroPython, and therefore has faster boot time and fewer running delays.
2. Supply Chain Risks & Hardware SecuritySupply Chain Risks: Raspberry Pi as well as K210 boards are common hardware parts used in IoT. All of that makes supply-chain interception pretty tough, even if it is not impossible — and certainly impractical enough to merit bothering with, parts aren't purchased with the idea of creating a specific crypto hardware offering in mind.
+------------------------+------------------------------------+------------------------------------+
| Feature | SeedSigner | Krux (K210) |
+------------------------+------------------------------------+------------------------------------+
| Architecture | ARM (Raspberry Pi Zero) | RISC-V Dual-Core |
| Boot Time | ~45-60 seconds | ~3-5 seconds |
| Camera Resolution | Pi Camera Module (V1/V2) | Onboard OV2640 |
| Display/Input | 1.3" SPI LCD + Joystick | Touchscreen or LCD + Buttons |
| Primary Data Transfer | PSBT via Animated QR Codes | PSBT via QR / SD Card / Thermal |
| Randomness Generation | Dice Rolls / Camera Noise / System | Dice Rolls / Camera Noise / Hardware|
+------------------------+------------------------------------+------------------------------------+
Both devices are Air Gapped and even if comply with Partially Signed Bitcoin Transactions (PSBT) have moving UR/QR codes in a newBC-bitcoin payment format (BC-UR v2 format). The signing takes place without an Internet connection and without using any active USB or wireless connection.
3. Randomness & Seed Generation MechanicsAs there is no single point of failure (Secure Element (SE) or hardware RNG) in either device, user supplied randomness takes first place:
- Dice Roll Randomness: Both versions can enter 99 dice-rolls by hand to create 256 bits of mathematically derived randomness and then convert this to BIP-39 seed phrases with automatic error checking.
- Randomness from the camera taken within the camera in addition to the system randomness to make seed words.
4. Hands-On Benchmarks & Practical Field TestsTest with 2 signers side by side with a heavy 3 of 5 multisig set up (1200+ byte PSBT and many inputs/outputs):
Boot & Readiness Speed:- Krux (Maix Amigo / K210): boot to main operation menu in ~3.8sec from cold power on.
- SeedSigner (Pi Zero v1.3): Works! Successfully booted the custom buildroot image in ~52 sec with a 10 class microSD from SanDisk.
QR Code Scanning & Camera Response:- The Seedsigner: Pi-camera-part works very well for moving QR-codes which have a higher density in varying light conditions, namely with BC-UR v2. The frames were determined to be fast with no finetuning by hand.
- Krux: The built-in camera uses the OV2640 sensor and must always remain at a constant distance ( ~20cm ), and be well lit in order to be able to capture the moving QR code; if the QR code is too dense, there will be a frame drop.
Memory Wipe Verification:- Unplugged it during the session, and checked the RAM for the saved data – 0. Perfect Stateless Signers both!
5. Key Trade-offs & Conclusion- SeedSigner Strengths: This software system is very standard, and the buildroot security model is solid, has a very large community review footprint, and fits well with popular coordinators (Sparrow, Electrum, Specter).
- Krux Strengths: Boot the device instantly, not only boots using LLMNRP, but also uses touch screen navigation in Maix Amigo, a wide selection of hardware case options, and built-in support for printing of paper/thermal backup.
From a security point of view, both of the setups eliminate the need for keeping private, closed-source software and unsafe saved storage. It's a choice between Raspberry Pi Hardware and RISC-V boot speed.
