New Frontiers with Frostsnap

Hello, and welcome back to Freedom Tech Friday, a weekly live and interactive show hosted on the ungovernable Misfits feeds. We go live for one hour every Friday at 9AM usually, but today is 10AM, thanks to the daylight savings time,

eastern on The US, and 2PM UK time. You but you can always catch up later on the Ungovernable Misfits podcast feed. On Freedom Tech Friday, we'd like to cover the latest news, trends, and topics for anything relating to Freedom Technologies.

That could be anything from Bitcoin, Monero, encrypted messengers, privacy tools, and everything in between. Essentially, if there's a news item tool or topic that can help you take back some control in today's digital panopticon, then we wanna talk about it.

My name's Q and A and I'm head of customer experience at Foundation. And as always, I am joined by my good friends Max, the head honcho at the Ungovernable Empire, and Seth who is COO over at Cakewallet.

Freedom Tech Friday is a live and interactive show, and you can help steer the conversation by commenting live, pre submitting your questions, boosting the show via podcasting two point o apps, sending your tips, or just sharing the show with your friends and family.

Top support from last week's show with Zach Herbert comes from somebody who dislikes usernames because they've called themselves user one three six five zero six three eight at fountain dot f m. And they streamed us 1,900 sats. Thank you for your support whoever you are.

So without further ado, I'm gonna bring on our guests in a second. But first off, Max, Seth, how are you doing?

I am doing quite well this morning. Yeah. I'm looking forward to first work trip of the year, first conference. It's gonna be fun. Get together with a ton of the team. And,

honestly, I'm looking forward to today's chat. I feel like I say that every week, but frost nap has been one of those things I've been creepily watching from the corner,

and not following closely enough. So I've I've got a I've got a ton to learn today. So I'm I'm really excited about this thing. It's a fascinating combination of things. So I'm, yeah, I'm pumped for this.

Yeah. Very much the same. Also creepy corner watcher and excited for it. Yeah. Very excited for this and and to meet you both for the first time. So, yeah, welcome to the show. Cool. So today, we've got an exciting one. As I say, we've got two guests on the show. We have Nick Farrow and Lloyd Fournier.

I hope I haven't butchered that. Lloyd, you can tell me off in a minute. These guys are the cofounders of FrostSnap, a company built around building hardware and software solutions for what you could describe as the next generation of Bitcoin security.

Nick, Lloyd, welcome to the show. It's a pleasure to have you both join us. And before we dive into the tech, because I'm, also very excited to learn about that, let's start with you two. I know you guys have done multiple different podcasts before, so we'll keep, to the abbreviated version,

to save some time for the tech talk and the huge amount of listening to questions that we've got. People are very, very excited about what you guys are building. But to get kick us off, welcome to the show, by the way, and how did you guys end up working together and founding FrostSnap?

Thanks very much. Thanks for having us. Yes. So Lloyd and I met many years ago now, actually. I went to one of these Australian Bitcoin bushbashes, the first sort of big Bitcoin conference.

Not really. It was, like, probably 80 or so people in a regional town in Australia. And I was presenting a project I was working on at the time, which was SATSAIL, which is a a payment processor.

And I was sort of learning to program at the time, it was a bit janky and all over the place. And I remember this guy sitting up the back, with his hoodie on, sort of giving me some good some good advice from across the room saying, you know, you should be using WebSockets.

You should be doing this and that. And I had no idea what he was saying, but knew he was he's probably knew what he was talking about. And so Lloyd and I kept in touch, for a few months, and Lloyd invited me to work on his command line wallet, called gun.fund a few months after that.

And, eventually, we got, captivated by this academic research, which was Frost, and began implementing it. So, yeah, that's sort of the story of how we met. It would have been, yeah, I think, about five years ago now. So it's been a long time since then. And, thanks for having us on the show. Really looking forward to it.

Yeah. It's a pleasure to have you here. And and, Lloyd, I just wanna bring you on as well. Welcome to the show. Maybe just briefly, just I think you're, Nick probably won't shout at me for saying you're probably the more technical of the pairing of the two of you. What's give us a brief history of your background in and around Bitcoin.

Yeah. I think Nick's pretty technical. He's he's definitely a hacker. Shouldn't give him a story of anything to hack on, and he'll figure out a solution whether I like it or not, you know. It's good story. But yeah. I I my background, I've written software engineering for a long while, few decade

or more now. Then I got into Bitcoin engineering around 2018 as a sort of former shitcoiner, and then became it was really interesting cryptography, mostly because I was using knowledge of cryptography to figure out which shit coins to buy and which ones not to buy

because that that was the big thing in 2017, 2018. If you could figure out who was bullshitting and who was you know, had the good tech because it was about the tech then. So I was kind of in that confused confused outlook.

But I I did actually go to the textbooks and start reading about, you know, university crypto crypto textbooks and started going through the exercises and really trying to get to the bottom of it, reading crypto papers.

And so then I found out actually that a lot of the interesting cryptography work was actually done do being done by Bitcoin people and not by the shitcoin people. And so that enabled me to

work on with those people and on those things. So it's and then, yeah, it was a natural natural thing. When Nick was interested in the project, I sort of threw him frost, see if he could, yeah, sink his teeth into it. He did a good job, we ended up, you know, creating a company out of it with a with a few steps in that story missing.

But, yeah, that's how it is, basically. Nice. Nice. Alright. So the the the name of the company kind of alludes to those that know what you guys do. But for those that don't, FrostSnap, what you've mentioned,

you know, the the research paper that got you excited and clearly, you know, very excited because you named the company after it and kind of protocol. But let's take the listeners on a journey and and take them through, like, why was FrostSnap formed and what is Frost?

Like, you know, what are you guys doing that's different to to the rest of the Bitcoin wallets that are available currently? So, yeah, at first, it was just very it was, like, very exciting. It was very it's very elegant mathematics that lets you make a multi signature through,

yeah, through mathematics as opposed to Bitcoin script. So all the multi sigs that you're generally familiar with all use, you know, script to set spending conditions on how to spend that Bitcoin, how to unlock that Bitcoin.

But Frost lets us take a very different approach, and it lets you, have this threshold access, this three out of five or five out of eight or whatever you like. Allows you to do that, through mathematics.

And so at the start, it was just very interesting to us. We thought, oh, this would be something cool that, you know, we would like to use and, you know, have a a frost key on, you know, maybe a phone, laptop, and some other devices

on these command line wallets at the start. But, the more and more that we sort of thought about it and the advantages and and things like privacy and, transaction fees, and I'm sure we'll get into many of these later. But the more and more we thought about it, the more and more advantages we saw. And, eventually,

after meeting our our third cofounder, Adam, we realized that we could we could put this cryptography, on on hardware, and it gives us some really advanced Bitcoin security and some really elegant multi signature, tools, through through this use of Frost.

Yeah. I think there's kinda two things to unpack here. One is maybe to get into a little bit of what differentiates Frost from a regular multisig because it is multisig, but, obviously, it has some very different,

honestly, really just advantages. I think the only disadvantage is just more complex cryptography, but the actual, multisig experience you get out of it is is much better.

But, yeah, maybe just quickly break down, like, what is the core difference between somebody who's using a two of three multisig with a passport versus somebody who would use a two of three multisig with Frost?

And then I'm also just kinda curious, like, who do you expect to be using this sort of of tooling? Yeah. Sure. So the main if you're doing a traditional multisig, the biggest difference to your quality of life is that you wouldn't have to have a descriptive backup.

So with normal multisig, you have to keep around three keys on three different devices. If you're doing a threshold, two, two out of three. And you would have to keep up, a digital backup of the descriptor.

Otherwise, if even if you have two out of the three keys, if you've lost the third one, you actually lose the money, which is one of the main reasons I never did this with my family's setup is because this was too risky to me, and as too it was too convoluted to try and explain to to my wife.

And so I thought with this frosting, you can actually you can actually get rid of that. You can actually just have when you get two out of the three keys, you can just restore the whole thing without any extra information

on the side. That was probably the first thing you would notice about the setup flow and everything when you were when you when you're setting up FrostNap. The other things you'll notice is if you look on the the the Block Explorer, like mempool. Space, after you do a transaction, you'll see that no. You can't even tell it's a multisig.

So it actually has only a single signature on chain and a single public key on chain. And so you it looks like a single sig on chain. So it's an invisible multisig. So those are the two main things that you would that differentiates it from normal multisig. Yeah.

Should we just not brush over that too quickly? That's pretty massive. There are two huge reasons I've had a big problem with multisig over the years, and I think maybe cue similar sort of concerns.

That's a big big change. Yeah. I mean, for me, it it definitely is. That was one of the main blocking things on actually adopting multisig. And otherwise, if you don't adopt multisig, have the problem of just having all your money in your house, basically,

which is quite risky. It's not a it's a historically quite risky thing to do. It's just that criminals have only more or less recently started cognaing onto this.

So I didn't I wasn't comfortable with that situation, but I also wasn't comfortable it depends what kind of wife you have, but I wasn't comfortable, like, going out in full freaky autistic nerd with all these, like, descriptor things and showing her sparrow wallet.

And so that's kind of, like, it's kind of, like, built to fully exploit the elegance of Frost for those things. Yeah. It is it is really good. But even though it sounds like a small thing maybe to some people, but, yeah, in practice, it is actually a real this descriptive backup issue

recovery issue is a big risk, actually, you know. You're trying to do multisigs and you're trying to be more secure and more safe, but actually you end up adding another risk, which is losing this backup

or having it the person who's inheriting it maybe haven't lost it. They don't really know how to get it or where it is or whatever. So it becomes a it becomes a risk. Yeah.

That's yeah. I think all three of us have just had the same realization that we we had no idea that you didn't need that additional descriptive backup. I can see Seth in the comments on Twitter saying the same thing, and I've just had that realization.

At the risk of taking us too technical too quickly, so try and keep your answer high level, but, like Uh-huh. How how is that achieved? That that because that seems like like Mark said, that's huge.

Yeah. So, with with script multisig, see, the way to think about it is you kind of have, like, three separate key keys. And the the spending conditions, you have to be able to recreate those spending conditions to unlock that Bitcoin.

And so because you've got even in a two out of three setup, those spending conditions still have those three public keys, in the scripts to unlock the Bitcoin. And so you still need to have knowledge of all three keys in order to unlock it. So that that's script multisig.

But with Frost, you actually only have one key, and the private or secret key for that that key is just distributed and shared across different devices. And because you only have one key, there's a very simple descriptor that you need to to reproduce to be able to unlock your Bitcoin.

So it's a single descriptor, with a with a pub a single public key in it, and that single public key can be reproduced by any two out of the three, secret shares or two out of the three devices.

And so, yeah, with just two out of three devices, you can reproduce your your XPRIV or your your descriptor as well, and you can spend your Bitcoin. On top of that, you actually don't need to bring the secret shares together.

So the secret shares can remain in totally different locations. So you never need to like, you don't have to add them together or anything and bring them to the same place. That's another cool thing. You see like with FrostNap, what you would do to recover

is you would go you got an let's say you got a new phone or something. It doesn't have the wallet loaded. You'd you'd download the app. You'd visit one device,

leave it where it is, go visit the other device, another location, leave it where it is. And once you get two out of the three or whatever the threshold is, you would have recovered the whole thing. And it's the same story if you had just seed words. So those

the you don't even need any metadata to recover the whole thing. Yeah. You just get the whole key, and you never have to put those seed words into, like, a single computer. They just go into one device, and the other seed words go to the other device.

Beautiful. That's incredible. I've just brought up on on screen a picture well, a snapshot of your guys' website. I just wanna walk us back just very slightly to you know, clearly, is this is multisig done differently.

So walk us through, like, the the setup process, the the user buys three devices from you, and then how do they go through the setup process? I'm sure lots of our listeners and viewers have have seen the the I won't use that term, the daisy chain.

Yeah. Perfect. Yeah. The daisy chain, as you can see on screen. So, like, walk us through that process. What does that look like? Because from the videos that I've seen, it does seem very, intuitive, and you guys have done a great job.

Yeah. Thank you. So, yeah, you buy three devices or five devices or whatever you want your, you know, your three out of five or two out of three. And, then you would download the Frosnap app. So you would download it on Android, macOS, Linux, or Windows.

And then, yeah, like you say, you connect your devices in a daisy chain. So they have, both a male and female USB c port on either end, so you can connect them, together in a daisy chain, pretty much as long as you like as as as much as as much power as the, the phone or laptop can provide.

And then in the app, you can give your devices a name. You probably want to give them a name of a location or a person that you plan on leaving your device with, and then you choose, a threshold for your wallet. So how many devices are required to sign, in order to spend the funds.

And from there, you you press generate keys, and the devices will go through what's called a distributed key generation, ceremony. And this is just to create this Frost wallet in a distributed fashion where every device can can contribute randomness to this group private key that that never lives on any one device.

And so at the end of that, you each device has a share of the, the the overall group key, and you can display backups for each device. And from there, you're you're good to to geographically distribute your devices, leave them in different places or with different people, and you're ready to use your FrostNap wallet.

Awesome. Would it be a safe bet to say that your guys' app, phone app is the only one that supports this type of, cryptography at the moment? Yes. At the moment, it that that is the case. Yes. We look forward to, seeing some other other movers come into adopting Frost.

I'm sure we'll see some soon. Yep. Why do you think that that you guys are, like, the only ones out on your own doing this? Is it because it's, like, from a developmental perspective, it's it's like a big step up from traditional multisig?

What you take there?

Yeah. Lloyd Lloyd can probably answer this one a bit better, but, for for me, it's the implementation of the Frost itself, like, the cryptography is actually not so much the hard part. It's more all the things on, like, a level above it. So how do you manage, signers?

How do you manage these things called nuances that need to be agreed upon for signing sessions? And then really just building an entire sort of a wallet based on Frost sort of from the ground up.

So a lot of the user experience and also security design decisions we we made along the way were sort of we rethought them as we were building the the wallet and the hardware wallet.

Yeah. I think that's totally right. We started off the project, you know, more or less it's gonna be we can just make us yeah. Do it on our laptops, on our phones. We And started thinking, okay. We can do it on devices, but it'll be like a more like a seed sign of thing.

The main reason being it's kind of annoying to ask people to have, like, three phones and keep them charged all the time in different locations. You don't really want that. Some people maybe can handle it, but I can't handle keeping one phone charged barely.

So it's so then once you get into that space, you're like, we'll we'll do, a seed signer kind of thing, and we'll just make it easy, you know, to for people to make one from off the shelf parts from Alibaba, you know. And then eventually, we're like, oh, in order to do this properly and actually realize all the benefits

of Frost, you're gonna have to have a custom device. It's like for our our device, the, you know, the the signature thing is the distinctive design element is the the two, the USB male and the USB female on the back. So you plug them in together to do key generation.

That's really just a requirement of Frost to do it securely, is you kind of as an individual user, you have to be able to see that all the devices came up with the same result at the same time.

Otherwise, you'll be plugging in and plugging out a whole bunch of devices to do it on a phone, like, twice, each one, and we thought that that's just not gonna be good enough as a user experience. Once again, if I'm trying to show my wife what to do with this thing, I'm gonna be super embarrassed at that stage.

So so we in the end, we're, like, have to, you know, design this whole this whole hardware and software stack around, as Nick said, like, hiding all the complexity of the the protocol. And so if you don't do that properly, you can easily make things worse. Right? You can you can easily use new cryptography to make,

you know, a bad situation even worse if you're not extremely careful about how what you expose to the user and how you manage the problems that the the cryptography, know, presents to you.

And so we've we've done a really good job, I think, on that. I think we have have to say this has been all what we think about is how to hide hide that complexity. It's what I do pretty much every day. It's trying to think about how annoying can I be the user, and the answer is not very much?

You have to really try and design every workflow around what they're expecting and try to make it, you know, as simple as, you know, no worse than existing multisig and then just get all the the benefits on top of that. I can talk about, like, what maybe one example is

this nonce thing. There is a you know, this sounds like a magic word at the moment. But, like, one thing it does require you to do at the moment in Frosnap is you have to choose which devices you're gonna go to. That's one downside. So it's important to get that downside. Like, when you are signing a transaction

and you have Alice and Bob and Carl's FrostNaps, you have to choose are you gonna sign with Alice and Bob or are you gonna be starting with Carl and Bob upfront when you create the transaction?

And so that's because we need to know which devices are signing so we can properly finesse everything in the background.

There may be things in the future and more deeper cryptography we can do to get rid of that requirement, but that's the kind of thing. That's the one thing that seeps through to the user at the moment from the the lower level.

Yeah. I'm I'm actually really curious. This is one thing that jumped into my head when checking out Yale's website because I know that that shift in build your own to, hey. You can actually buy premade hardware.

It makes a lot of sense for people to get them that way. They're just gonna work. It's gonna be a better user experience. Just that's the way 99% of people would buy them. But does that diminish at all the the benefits that you get by using a system like this if all three FrostNaps are from the same vendor and the coordinator,

the wallet app that you use, is also from the same vendor? Is that are there still risks there, or is there some some way that FrostNap specifically combats that through attestation or something else?

Yeah. We do we do try and combat or deal with the situation, and it's but it's obviously the first the point is that no one will do this unless we do this. And so we have to we have to do both at the start to at least bring other people into the into the, you know, review and building process of this protocol.

But we do we on top of doing Frost, we did take the time to sort of redesign how fro you know, the relationship, the user to the device. So we do have on the website there, like, where the first hardware wall is not not a trusted third party.

The reason we claim that is that the devices are never trusted by themselves to do anything that is security sensitive.

They do have a secret on them, but they're not able to generate that secret by themselves. So unlike a traditional hardware wallet, you turn it on and it'll probably generate a seed, or you can do some dice throwing, and then you do some extra verification steps on other devices to make sure the device is, you know,

taking your dice throws correctly. With FrostNet, we don't allow it to randomly generate its own anything. We make when we do that key generation, all those devices plugged in together, and that phone, which is running our app, but that but that app is fully open source, and you can you can verify and bill it yourself if you're keen.

And so that phone app that let's say you're you're very paranoid and you built it yourself, that phone app is actually introducing randomness into that key generation as well. So even if we ship you all malicious devices, we cannot take the money, actually, which is not

which is which is the which is the first hardware wallet to do that. Every other hardware wallet you you get shipped malicious devices, you lose the money.

You know? If you okay. Okay. If you do multisig, you have different vendors, but if all the vendors are malicious, you lose you lose the or a threshold number of them, you lose the money. FrostNet, we can ship you fully malicious hardware as long as you've looked at that app, you know, and compiled it yourself.

Of course, it's very early days. Very few people, realistically can do the kind of review you need. But, with AI and stuff, we can make that that easier.

But once you compile that yourself, you're guaranteed no matter what we ship you that you cannot lose the money actually. And I think that's a really nice property. I think it's a property that every hardware wallet you try and have.

I know some, you can get that property yourself if you do pick your own seed words on other hardware wallets, but then you have the problem of, you know, verifying that this the x pub is generated, and it's really quite it's quite involved to actually verify that, like, any any other kind of hardware wallet does it correctly.

With with FrostNap, that that phone you have is automatically disrupting any kind of attacks. And in not just during key generation, but also during signing during letting a device sign its own transaction is actually a security risk.

If that device is not meant to be able to communicate to the outside world, we did an attack called dark Skippy to demonstrate this. So if you haven't heard of it, definitely check out darkskippy.com and see how you can actually exfiltrate a full 12 word seed in a single transaction from fully offline devices.

So, yeah, with the with FrostNap, you can't do that. The devices will not be able to exfiltrate any data either during key generation or signing. So we we do that as a guarantee from the from the app itself.

Doesn't mean there's nothing we can do if we evil we can do if we give you malicious devices, but those two crucial things we can't do. Like, exfiltrating the seed easily, we can't do. Yeah. No. I think it's a it's a fantastic approach and definitely minimizes that. I guess that's also another reason why it'd be good for other wallet apps

to add support so that even if you worship three malicious devices, you're at least using an app that's not by the same entity as well. So there's even even less trust necessary at that point. I I actually got a quick question about that.

Do you have, like is there a a good SDK out there if Wallet Developer wanted to implement this? Is that something that y'all have plans to build out? Like, what what what is kind of the the road map look like in terms of making it easier for other wallets to act as a coordinator for Froster?

Oh, that's a good question. So there's a there's a few parts to it. So there's there's, like, the key generation process, which there's a bit for the Blockstream guys who made a chill DKG bit, and we have adapted our Frost key generation implementation, to match that BIP, quite closely.

And then there'll be there'll be other standards for signing, which are also in in progress.

So at the moment, there's not really any SDKs. I I guess the one that I'll point you to is our own implementation, which is the SECP fun implementation of Frost, which is probably the most, you know, the most useful one out there

in in car there is, other Frost implementations out there. But in terms of, the usability of it and its, application to Bitcoin, I think I think if developers did want to have a play around, I think they would find it very useful.

You can also just directly use the FrostNap libraries also. So we everything we build is open source, and the libraries are not, like, full of application concerns or anything. Right now, I'm trying to build Frost snap over Nosta, actually.

And so I'm making it I'm making the libraries more flexible, and it's really not yeah. It's it's fully that we don't we make some decisions that over and above, like, what a normal crypto library low low level crypto library would do. But I think they're all very sensible decisions. It's like, you know, there's a coordinator

and what what are the roles and how are the nonces stored on the coordinator. We just make those kinds of decisions and how how do you how do you model the data about, you know, the coordinator and the devices.

So that's you can use FrostNap core. It's not really released though, so we're we're changing that without releases. But at some point, I think it probably will be. Like, yeah, you can you can get you can tell Claude to go look at look at FrostNap core and go build, a command line Frost thing, and it'll one shot it pretty well, actually.

Yeah. That's good to know. That's good to know. I'll definitely have to dig in myself. I wanna take us back to the user experience. So Nick, you walked us through the the setup process where, you know, you data change the devices, you get your wallet generated, and then you can install those geographically.

I presume, quick answer, that that one time where you connect all the devices in the data chain is probably the only time that you ever need to do that as part of the the wallet life cycle. Is that fair to say?

Yes. That's true. At at the moment, that is correct. There may be certain future features, which, you know, you may need to do that if it's, like, many rounds of communications between devices.

Yes. At the moment, it's just Kagen where you bring them together. Nice. Okay. So as part of the onboarding as well, the user will be prompted to write down 25 seed words per device. Is that correct? Why the 25?

Yeah. Another good question. That Frost so Frost has these, shares of a key, and there's a little bit more data, that we would like to back up than a traditional, seed phrase. So the some of the things Lloyd has spent a lot of time working on this. So some of the the features, for example, are, there's a few checksums,

and one of them is to check that a group of shares say you've got two backups and you don't know whether they're compatible or not. If you if you load those two shares into, two devices, the Frosnap app will actually be able to tell you that those shares are either compatible or incompatible.

And we would not be able to do that if we didn't add a little bit more data, to the backup format.

So, yeah, there's there's a few extra, things we check. And, I think there's one there's one thing, Lloyd, that we check, the the public key one. I don't if you wanna talk to that one briefly. That's an interesting one that, like, no multisigs check at the moment. It's a little bit technical and, a far out attack, but

it's interesting. Sure. I that yeah. Okay. So it's 25 words. The it's it's basically, like, a 24 word, you know, but with one extra word because we weren't comfortable. We wanted some extra checksum data in there, but it's the same amount of data is this 24 word seed phrase include in codes.

I mean, I suppose the first interesting question is why isn't it couldn't it be 12, which is the question that everyone would ask. Right? And it's just because we need to store more data. We need to store a full secret key.

So when you have a 12 words seed phrase, you don't store a full secret key in that thing, but you do hash it to extract secret keys from it. And so a secret key is 32 bytes, which is vaguely 24 words, and so we have 24 words as well for to encode that secret key, which is your Shamir secret share, your frost share of the overall key.

And then we have an extra word for more more checksum data. So we have we have, like, we can we can catch, you know, entering wrong seed words, you know, better than a than a normal no one twenty twenty four word seed phrase. And we do have this extra byte of data, which what Nick was mentioning

is to catch this kind of attack, which is a very obscure attack, but, you know, it's good to protect against it. I suppose it's a little bit in the weeds, but imagine yourself and you are recovering a multisig, and you put your your shares together and you you put them on each device,

and then you try to make a you you have a malicious laptop, and your laptop is actually attacking you during this process. And you load the descriptor onto each device, which is what you're meant to do in order to verify addresses.

And then each descriptor actually, the laptop attacks you by putting the valid key for each device in the descriptor, but it changes the descriptor each time somehow. Like, you're plugging it in, and you're loading the descriptor and you don't you've technically, you're meant to manually check the descriptor is the same

on each device. Right? So you meant to go through each device and check that they'd have the same addresses, basically.

You you have that's a manual check that maybe you don't do. And then maybe you try to get an address, and actually that address, yeah, it has one on one of the devices. You check it on one of the devices, but you don't check it on all the devices.

You check it on one only, and that address has the key of that wallet in it, but the other two keys are owned by the malicious laptop. And so you just lost whatever money you transferred to that setup.

It's a it's quite an obscure situation, a little attack, but I just having it there was a bit annoying. So we have a little bit of extra checksum in there to sort of make it so this kind of thing cannot happen. So a malicious app cannot tell you you have a different descriptor.

Like, your key share is actually part of a different wallet than it actually was. It has a high probability of catching catching some kind of attack like that. So that's we just we have extra word because we care is basically the is the base of the summary.

Nicely summarized. Yeah. Okay. Cool. So walking a bit further down the the user journey, they've got the setup. They're using the wallet. They're all very happy. They've got their 25 words per device.

What happens if they lose a device? Walk us through that that process. Obviously, they could, I guess, buy a new device from you guys and then reconstitute with the the 25 words from the the lost device. That's the obvious one.

Yeah. But the I I presume there is an alternative where if they didn't wanna do that for for the obvious reason, but those 25 words may or may not have been compromised. Like, what what does that process look like?

Yeah. So there is a more exciting future that we want to get to, and we haven't built this feature yet. But with Frost, there's the ability to repair or recover key shares. And not only repair or recover them, but, rotate shares as well. So if you've lost one device, you could actually, in the future, use

your your other two devices to restore that third share, which you could put on a a new device without having that seed word backup. So without the seed, you lose the device and its backup. You could actually use the other two devices to completely restore that that third device.

And yet not only that, you could also rotate the shares of the two devices you still have and make those those keys incompatible, with the one that may have been compromised. So so if if an attacker manages to steal one of your devices,

you can rotate your other two devices and and essentially render the attacker's key, completely useless even if they were to gain access to to one more of your devices. But we haven't built it yet. It's definitely definitely,

on our wish list and and priorities for this year. It'd be a super exciting one. Just just magical, really. Yeah. And am I correct in saying that if the user was to do that, then no funds would have to move on chain whatsoever?

Yes. That is correct. Amazing stuff. Yeah. Okay. That's really cool. So you can rotate things differently than you would with a normal multisick rather than having to start from scratch. Yeah. Exactly. And that and that's super useful if you've got, you know, invoices

or or payments that or addresses that, you know, you've shared out there to people and, you know, you're expecting payments to be keep on coming in. If you've got to change your, if you've gotta make a whole new multisig because one of your keys got compromised or or someone left your organization and you wanna rotate the keys

and you have to make a whole new wallet, that's a massive, you know, pain in the ass really to to have to go and send new addresses out to everyone. Yeah. Definitely. Jumping back here a little bit, but it's just nagging in my mind.

Where Seth was asking before about, you know, multi vendor, multi sig, and the fact that it's sort of like you've got your app and then you've got your devices. Is there room, is there scope for future developments where somebody could use alternative hardware alongside yours? I know you've got the male and the female, but for example,

if you had four devices that were the frost snap ones, and then you have, like, a passport that went into the end of that or something like that. Or you have, like, one device that was a joining device that had a two male part or something like that. Could could you could you do that? Or is it not possible because

it's just built in a different way? I'm a non techie guy. So Yeah. Yeah. No. Definitely definitely possible. I think we're I'm gonna I'm gonna say no. I'm gonna say we're we're never gonna have our devices. Fuck your devices.

We're

gonna but there is a way there is a way in. Right? So the what I'm working on now is how to do remote signing and remote key generation. So you don't have to bring all these device together. You're gonna have different people in different locations, you know, have devices

or even not have a device possibly. Right? They just have a phone. Right? Mhmm. And they can join a Frost key generation together over the Internet. Right now, I'm using Nosta to, like as a relay for the messages.

So you have, like, an encrypted channel with all your other people on Nostro or something like that, and you you generate a key. And that's where I think other devices could come in to the mix. Right? Because then once you once you're at arm's length, then there's no there's no electronics

to sort out over USB Yeah. That's right. USB stuff. And so I think I think that in the future, probably, a lot of Frost FrostNav will be used that way frequently, I think. It's only really the personal setup where you're just doing a full personal thing and several devices. If you're doing anything inside a organization or

even, you know, a large family, you know, you could you could go with go with remote devices and each person brings their own device and maybe even doesn't have a particular hardware wall but just has a phone or something.

Okay. Yeah. That makes sense. Yeah. Because as I'm listening through, I'm I'm kind of like every every change here compared to a multisig, like a traditional multisig sounds

better to me. And then that's the one thing where I'm like, okay. It's just putting trust in. You sound like very nice guys. I'm sure you're you're not malicious, but, you know, it's just that always that concern of, like, okay. Am I putting all my trust?

Saying that, you know, you're doing that if you're just using single sig and you're not using a pass phrase on top or, you know, there's there's other trade offs that are made. But, yeah, that makes sense.

I wanna leave enough time for the raft of listener questions. But before we do, just this is my one from me personally. The frost of protocol, is that anything to do with you guys or just a very unfortunate similar naming structure?

So I when we were working this when we first started working this Frost implementation, I made a, like, a proof of concept to show that it could sign Nosta messages, and I called that Frosta.

Okay. Which is, yeah, using Frost to have a, you know, multi sig for Nosta. But since then, some other guys in Austin have made a a whole dedicated their time to actually making this project real, making multi for. They've also taken up the name.

I see. Okay. Thank you for for clearing that up. Alright. I'm gonna I'm gonna go a little bit more quick right now through listener questions. I think you've kind of already alluded to this one, Lloyd, but this one comes from Kiwi Huddl. It said when remote signing. Sounds like that's already underway.

I don't know whether you're able to share any any timelines around when you think that might be ready for some public testing. Yeah. I don't I don't know when it will be ready. Maybe we'll have it as like a develop we have a developer mode thing in the app, and so maybe under developer mode relatively

in in the next few months, it might be there. No no promises, but it's it's looking good. It is interesting. I mean, I can share some share some thoughts about it. So that that what so the that challenge I mentioned, you have to choose the signers

before you start signing. Right? You have to know who's gonna be signing. It's kind of becomes interesting to hide that complication for the user because you kinda have to in this group multisig,

right, you have to say, like, who is gonna be signing? Either you have to choose them or you have to let the people in the in the chat room, let's say,

say, I'm gonna be the one to sign and then sign it. With a two out of three or two out of anything, it's it's fine. It's very straightforward. But if you have, like, larger thresholds, you have to kind of have everyone say

put their hand up to be the ones one of the ones signing and then actually have do the signing round where they each person who put their hand up goes and gets their device. It's got a cover that's where I'm currently at with that. It's looking good though. We're definitely gonna be using it in in FrostNap internally imminently.

Awesome. Glad to hear it. Next one comes from Bitcoin. Brad and says, oh, snap. Do you need to be physically together to use the tech? I think the short answer is yes. You do at the moment, but, obviously, refer to your previous answer. I don't know if there's anything else to add to that one.

Yeah. The the one thing to answer is there's a sort of a misconception we often run into, which is that you need to bring your devices together to sign, but that's not the case. So when you're signing, you can just visit one device, plug it in, sign on that device, and leave it, you know, in its secret hidden location,

and then travel to your next device and sign on that device. So once you've made the wallet, you never actually have to bring the keys back together. Good call out. Yeah. We just had one pop up on Twitter from Rips that says, is is this a Taproot only thing? So can you only generate Taproot wallets with with FrostNap?

Yes. So Frost the the s in Frost stands for Schnorr, and we got, we got Schnorr signatures with the Taproot upgrade. So, yes, we we only use Taproot. Quick tangential question to that. This just popped in my head. Is the defrost protocol compatible with stuff like mini script as well?

Yeah. Totally. You can you can use a mini script, but not on FrostNaps yet. We're sort of waiting for someone to have really want this and, like, you know, want to cheerlead it. Internally,

we haven't had much of a need for that yet. But, yeah, absolutely. You can you can do you can make a mini any key in your mini script can be a frost key and it'll just works in a straightforward way.

Okay. But then you then you may have to have a descriptive backup, of course, depending on what the new discord is. Yes. Yeah. Very good call out. Next one comes from Gwidian, and they said, are the signers gonna be compatible with Sparrow or any other software while independent from this project?

Well, I guess that's kind of up to everybody else. It's not you guys, I guess. But, any thoughts on that one? Yeah. So that we would love to get there. It's probably a little while off. One thing we would probably try and do in the in the meantime is getting some wider adoption for our backup format,

so that if if, you know, if if FrostNap has somehow disappeared off the face of the earth, you've got, many avenues to take your FrostSnap backups and load them into another wallet and and get access to your funds.

So we do have some tools that do that already, but it'd be nice to get those tools into into something like Sparrow. But with the way AI is going, you could in in a few months, you probably one shot it into So I'm just gonna vibe it. Yeah. Yeah. It's gonna happen for sure. For sure. But if

someone else doesn't do it, I'll do it eventually. Yeah. But you won't get a nice funny shiny looking UI, but you'll get a nice a nice functional Sparrow UI that puts all puts it all together.

Sweet. Another one from Gwydian said, is Frost multisig also available for phones to be the signers? And would I be able to replace a Frost signer with a phone signer in case the FrostSnap device is broken and the company does not ship the product anymore? That's a good question.

Yeah. We would love to get there. So that's also one of our to dos is just having it so that you can download the FrostSnap app on, say, you know, a mo a few mobile phones or a laptop, a mobile phone, and a desktop.

And once we've got remote signing, make a, Frost wallet, using those devices. So, yeah, not yet, but but to do, We'd love to love it to have you use the wallet just your phone to make a frost wallet.

Wouldn't look quite so good with the data chain and then if you, like, had USB between iPhones and stuff, I guess. No. They you would definitely be doing the remote signing thing over the Internet then.

That's a good point. Yeah. Yeah. Another one from Gwydian. He's getting his money's worth here. Do you guys plan on having any official trusted resellers that might be more private to order from depending on the region? Oh, good question.

That's another good question. We don't have any yet. We're still sort of thinking about this. The current plan for if if you want to be, you know, very private in your purchase, the the two options really are user's pseudonym and a PO box.

So every country except for The US, we will ship to PO boxes. And if you're not comfortable with that, you can come and meet us at a conference. So maybe send us a message and see if we're we're heading to a conference your way.

And I think we can come to the Sydney Bitcoin Hub. Yeah. Come to the Sydney Bitcoin Hub. That that also works. Yep. I think that's good practice for any person who's thinking about buying any device from any manufacturer really is just get yourself to a meetup or get yourself somewhere in person.

It's it's something I I wouldn't want even with PO boxes and stuff like that. Personally, like, if you if you really care about this stuff and, like, with what's been going on recently with all these attacks and everything, just giving any data unnecessarily is I don't know. It's it's not for me.

Yeah. Yeah. It is a big risk. Next one we've got from g h n on Noster. They said, do you have any plans to add coin control and UTXO label into the coordinator app?

And number two is, is Frost compatible with bit three sixty? Off the top of my head, I have no idea what bit three sixty is. So hopefully, you guys do, and you can give us a quick TLDR. So I'll answer the first one.

Coin control and UTXO labeling, these would be nice to have, but they're also sort of no. It's not something that we really want to have. It's sort of an unfortunate side effect of Bitcoin's lack of privacy is that we feel the need to, you know, have have labels on coins and really have to have to track this, I mean, micromanage UTXOs.

If you want to do that today with FrostNap, you can use it alongside an existing software wallet like Sparrow. So you can actually load your descriptor into Sparrow and build PSBTs, you know, do your coin selection in Sparrow, and then export that PSBT and load it up in the Frosnap app where you will sign it and broadcast it.

So at the moment, we don't have any plans to do it in the in the near future, but those those tools are available for you to use in conjunction with FrostSnap.

Yeah. That's a that's a good that's a good point. And then we it also, like, yeah. People often will ask this anyway, so I might as well answer it, you know, the air gap in question. Basically, do you use FrostNap air gap? You take a phone and you took it put it on airplane mode or you do something more severe to it

to stop it from communicating to the outside world and you use Sparrow to just scan PSPTs in and, you know, scan sign with the FrostNap app with the devices. So the FrostNap app still interacts with the devices, but it air gaps to the to the laptop or whatever you're running Sparrow on or whatever other PSPT wallet.

Then the second question, is Frost compatible with BIP three sixty? That's that's Hunter Beast's Quantum new new not quite it's meant to be addressing quantum, but doesn't really address quantum. It's more like setting the stage for quantum protection in Bitcoin.

I'm me, personally, I'm not a fan of the direction of BIP three sixty, and we and it's definitely not compatible. K? So BIP three sixty does not have Schnoor signatures, and like Nick mentioned, that s means Schnoor.

So what BIP three sixty is saying, everyone has to get off Schnoor signatures right away. Okay. Or at least the Taproot version of them where they have the public key exposed in the address.

Right? So BIP three sixty is saying that, you know, we really shouldn't be exposing public keys in the address because of quantum computers because anyone can see the public key on the chain and then perhaps attack it with a quantum computer.

I think this risk is not as severe and is not severe, actually, in the next in the next few years. So it's it's an interesting problem for us and everyone in the Bitcoin community because we are apparently meant to make a judgment on the existence of these futuristic computers.

But, yeah, me personally, I don't think they're gonna be coming anytime soon. I think that's the that's the opinion of most people in the space. But if we do activate BIP three sixty, you will not be able to use CrossNap.

You will you you could use it in the in the trees. So you could use it in the you could still you probably you could still use it with BIP three sixty actually off the top I mean, act that's a actually, now that I think about it, you can. So you could use Frosnap with BIP three sixty.

But the idea of bit three sixty is that quantum is extremely close. And as soon as we have to stop using elliptic curve cryptography, frost snap will not not be the protocol frost will not work at that point. Right? So frost is for using elliptic curve cryptography.

And so if we disable that in Bitcoin or it it becomes broken, then, you know, we'll have to do something else with frost snap. I I I presume we'll still have a product that will still maintain, you know, your keys in different locations

and, you know, make sure that your money is not stored in your house. That will still be a thing, but we will not be able to use Frost. And we'll probably have to rebrand at that point severely.

Okay. Good answer. Nice easy one for you. I think we kind of touched on this earlier, but a question from Ape says, can you change keys in a Frost multisig without moving funds? Yes. I asked that question before. You can.

And is the number of signers or threshold visible from your on chain transactions? I'm gonna say no. But, Nick, anything else to add to that one? You know, that's that's spot on. So, yeah, you can looking at a transaction on chain, you cannot tell how many signers,

what the threshold was, or or what the the total number of parties were in that multisig. She's really nice for security. So you're not revealing your, you know, your security setup every time you you spend Bitcoin.

Mhmm. Yeah. Definitely. Yeah. Just nerd sniping the question. Frost and Moose, they got two different things, but sort of related. Good call out. I completely missed that one. But Yeah. It's a that's a good catch.

Quick one from Cruz on Nosda. Is it possible to use a standard bit 39 word list for unilateral exit? I think we've covered that. No. Absolutely not. But, guys, I don't know whether you got anything else to kind of spell out on that one as to why that is the case.

Yeah. Well sorry. Go ahead, Nick. Go ahead. I was just gonna say that the one thing I would point out is that you can take, two so you got a two out of three. You can take two out of your two out of your three backups, and you can use these tools that we're trying to get out there, to recombine those backups into a single,

xPRIV that you could load into Sparrow, as a sort of emergency escape hatch that, you know, I can say that's your your natural exit.

That's interesting. Okay. But, presumably, that will be a standalone app or something that you just download and and be able to throw the information into. Probably. Yep. Yeah. Command line tool or something. Yeah. I Nick Nick knows, like, to talk about this, but we actually designed the format so that you could vibe code

the thing that combines it very easily. So you can give it, like, a few sentences. I won't say them here, but or maybe I should for the sake of, you know, posterity. Get you the the you just tell the the the agent that it is these are Shimmya's secret shares on sec p 256K1.

The first 32 bytes is a Shimiya's secret share on sec P256K1. And the number in front of the backup, because our backup have a little number in front of each one, is the share index. And like that, you can just interpolate to recreate the master secret key.

And that that that's enough to give it to actually give you the master secret key, and then you just need to know the derivation path, which is just like four or five zeros, and then you'll have the money.

Okay. Cool. Well, guys, we're we're almost at time. This has been very insightful. I've learned a lot myself. Before we we sign off, where can people go and learn more? Where can they follow you? Where signpost them to the website?

And can they see you at any conferences and maybe even buy any device off you this year? Just give us an information download before we head off. Yep. Yeah. Sure. So frostnap.com is the website where you can check out everything about Frostnap, Frostnap Tech on Twitter, and we are o x, and we are also on Nostar.

For conferences this year, we'll be at all the Australian, Bitcoin bushbashes. We'll probably be in a bunch, throughout Asia, throughout the year, and, European and United States conferences and and elsewhere in the world to be confirmed at this point in time.

Perfect. Well, hopefully, I'll bump into you at one of those later this year, guys. Very excited to to see what you guys continue to build. Hats off to what you've already achieved. And, yeah, thank you for stopping by. This has been a great one.

Thanks very much for having us. It's been a pleasure. Yeah. Thanks for inviting us on the show. It was great. Thank you for tripping on.

Thank you for listening to Freedom Tech Friday. To everyone who boosted, asked questions, and participated in the show, we appreciate you all. Make sure to join us next week on Friday at 9AM EST and 2PM London.

Thanks to Seth, Max, and q for keeping it ungovernable. And thank you to Cake Wallet Foundation and my Nim Box for keeping the Ungovernable Misfits going. Make sure to check out ungovernablemisfits.com to see mister Crown's incredible skills and artwork.

Listen to the other shows in the feed to hear Kareem's world class editing skills. Thanks to expatriotic for keeping us to date with Boost's XMR chats and sending in topics. John, great name and great guy, never change and never stop keeping us up to date with mining news

or continuing to grow the Mestadel. Finally, a big thanks to the unsung hero, our Canadian overlord Jordan, for trying to keep the ungovernable in check and for the endless work he puts in behind the scenes.

We love you all. Stay ungovernable.