1. Conventions
1.1 Requirement words
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 (RFC 2119, RFC 8174) when, and only when, they appear in all capitals, as shown here.
1.2 Terms
| Term | Meaning in this document |
|---|---|
| Signer | The device, and the software on it, that holds a seed and produces signatures. |
| Coordinator | Software on a networked machine that builds transactions and collects signatures. Untrusted by this profile. |
| Review | Everything the signer displays about one transaction before it can sign it. |
| Owned | Re-derived by the signer from its own seed, or from a multisig descriptor the user registered on the signer. Nothing a PSBT asserts makes an input or output owned. |
| Blocking condition | A finding that disables signing until the user gives an explicit, single-use override. |
| Manifest | A text file listing the SHA-256 of every file in the signer's declared source roots. |
| Manifest root | SHA-256 of the manifest file's bytes. |
| Tier | One of the provisioning levels in section 4.3. A lower tier is never described in a higher tier's language. |
1.3 Requirement identifiers and check lines
Identifiers take the form SP-<AREA>-<n>. Areas: ENT entropy, REV review,
SIG signing, ATT attestation, HW hardware, TX transport, DEP
dependencies. Review requirements numbered below 20 say what is shown, and
those from 20 say when signing is disabled; the gap leaves room for additions
without renumbering.
Each requirement ends with a Check line naming one of:
- a vector file under
spec/vectors/signer-profile/ - an existing nullroute invariant id and its test, where nullroute already checks it
- a manual procedure, stated in full
- UNTESTABLE, with the reason
Each section ends with a table stating whether nullroute's current build meets each requirement. "Met" means an invariant with a bound test exists in this repository. It does not mean the requirement has been observed on hardware.
Rendered from spec/signer-profile.md, the same bytes that ship with the code. SHA-256 4138440d8a2b925d07a9b6d1d96d4189a74c399b5fc717ae27a79d65c0065817