Standards
Signer profile
A draft standard for what any air-gapped signer must show and refuse, written to be met by more than one device.
Draft specification, version 0.1, 24 September 2026. Not adopted by anyone, including by the project that wrote it. It is a proposal for review.
This document says what a device that holds Bitcoin keys offline has to do so that a user can check, rather than trust, four things: where the seed came from, what a signature will authorise, which software is asking for the passphrase, and what hardware the rest of the argument assumes. It names no board, panel or vendor in a requirement. Where it describes nullroute, it does so in a conformance column, as one implementation of the profile, and marks the places nullroute does not meet it.
Every requirement has an identifier and a line saying how it is checked. A
requirement that cannot be checked by a test says so. The vector files named
here are in spec/vectors/signer-profile/, pinned by SHA256SUMS in that
directory, and conformance/README.md says how to run them against any signer.
No expected value in them was produced by nullroute.
In this chapter
- 011. ConventionsThe key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be...
- 022. EntropyThe rule is the one nullroute publishes. Quoted from docs/ENTROPY.md, section "The canonical encoding" (lines 91-96).
- 033. Pre-signing reviewA PSBT is chosen by whoever built it. BIP-174 makes display optional ("The Signer can additionally compute the addresses and values being sent, and the transaction fee, optionally...
- 044. Attestation: the software identity shown before secretsBefore the user enters a passphrase, PIN or mnemonic, the signer shows a value that identifies the software it runs, in a form the user can recompute from source with tools that...
- 055. Hardware requirementsNo requirement here names a board, SoC or panel. Where nullroute's current profile is described, it is the Raspberry Pi 4 (4GB) with the official 7 inch DSI touchscreen at...
- 066. TransportSP-TX-1. A payload that fits in one QR frame SHOULD be sent bare, without a multi-frame header, so a generic scanner reads it. Check: nullroute INV-UI-22.
- 077. Normative dependenciesFetched from github.com/bitcoin/bips at commit 7c7cb232 on 24 September 2026. Status and version are copied from each file's header. "Draft" and "Complete" are the BIP process's...
- 088. Out of scopeThis profile does not defend against the following, and a signer that conforms to it does not either. Most of the list is docs/THREAT-MODEL.md, "Out of scope", restated without...
- 099. Change log
Rendered from spec/signer-profile.md, the same bytes that ship with the code. SHA-256 4138440d8a2b925d07a9b6d1d96d4189a74c399b5fc717ae27a79d65c0065817