Specifications

Bitcoin Witness independently checks the work the other layers produce (seeds, addresses, extended public keys, multisig setups, backup formats, descriptors, signatures, etc.) and turns those checks into secret-free documents your heirs, cosigners, counterparties and auditors can use. It can sign transactions offline too, but it is a verifier first. See who it’s for.

What it is not: not a daily-driver spending wallet · not a multisig coordinator · not networked · not a custody service · not tamper-evident hardware (it runs on a general-purpose Raspberry Pi, its defenses are the air gap, encryption, and a pinned, verified supply chain).

Code: no compiled binaries or firmware are produced by the project itself. The whole trust-relevant codebase is a number of Bash and Python scripts. Bundled third-party tools (Electrum, Sparrow, KeePassXC, Ian Coleman's BIP39 tool) are open source and independently verified during installation (which itself is a script, not a binary).

Every fund-spending signature comes from Electrum or Sparrow, both mature, widely-audited signers. Bitcoin Witness ships no production Schnorr signer, and its own ECDSA is used only where a signature can never authorise a spend.

Bitcoin Witness's own BIP340 / RFC6979 code is used in exactly two places, neither of which can ever authorise a spend: message sign and verify (BIP322 / BIP137, whose signatures spend an impossible outpoint or sign the "Bitcoin Signed Message" magic, so they can never move coins), and the independent nonce audit on every signature it produces. The signing itself is delegated to the trusted third-party signer. Our math checks that signer's output, it does not replace it.

Dark Skippy (disclosed August 2024, darkskippy.com) is a real attack where a malicious signer hides fragments of your seed inside its signatures and leaks the whole thing across a couple of transactions.

Each signature produced on the station is checked against an independently recomputed deterministic nonce. A mismatch blocks export. The defense works because a second device redoes a deterministic signer's arithmetic on every signature. For ECDSA the recomputation follows RFC 6979 and is grind-aware, replaying the low-R grind. For Taproot it follows BIP 340 with a deterministic aux_rand = 0. We have searched for another consumer signer that performs this recomputation and would welcome a counterexample. A confirmed leak is quarantined: the signature file is renamed, refused for export, and never broadcast. Nothing is deleted. Implemented in sign-psbt.sh + psbt_handler.py.

The scope is important: a nonce can only be recomputed by the party that generated it. A signature that arrives already made (from a hardware wallet, from a cosigner) is only checked against the key it claims to come from. Dark Skippy is an attack on the device that signs. We defend the signing that happens on our device. We do not audit a nonce we did not generate.

The free xpubverify.py tool is published separately under the MIT license. Clone it, read the source (pure Python stdlib, one sitting) and run the test suite, which prints its own totals. No dependencies, no network.