How NGRAVE Ensures Security Against Dark Skippy Attacks

Understanding the Dark Skippy Attack

Dark Skippy is a refinement of a known vulnerability in digital signature algorithms called a "chosen nonce" attack. To understand Dark Skippy, let's first break down the basics of a chosen nonce attack.

When signing a transaction on a blockchain, a private key generates a digital signature. For each transaction, a unique value called a "nonce" should be used. The nonce is crucial because if it's predictable or reused across multiple transactions, it becomes possible for an attacker to derive the private key by analyzing the signatures. The traditional "chosen nonce" attack exploits this vulnerability when multiple transactions are signed with the same private key and a non-unique nonce.

Dark Skippy takes this a step further. This advanced attack occurs via malicious firmware and requires even fewer inputs to extract the private key from improperly signed transactions. It represents the most efficient algorithm currently known to exploit this vulnerability, significantly reducing the effort needed to breach a system that does not handle nonce generation securely.

How NGRAVE Mitigates the Dark Skippy Threat

NGRAVE always prioritized robust security measures, and the nonce generation process is no exception. Here is how we ensure that the Dark Skippy attack is not a threat to our users:

Secure Nonce Generation 

We ensure that every transaction signed with your NGRAVE ZERO hardware wallet uses a safe, unpredictable nonce. Depending on the blockchain and compatibility requirements, we employ one of two strategies:

• Random Nonce Generation: For maximum security, we generate a fully random nonce for each transaction. This randomness ensures that no two transactions will ever use the same nonce, nullifying the Dark Skippy threat.
• Deterministic Nonce Generation According to RFC 6979: In some cases, we use deterministic nonce generation for compatibility with other wallets as per the RFC 6979 standard. This method allows for secure nonce generation even in environments where true randomness is challenging to achieve. It’s a method recommended even by the Dark Skippy website as a reliable mitigation strategy.

Built-In Security from Day One

These safeguards were not a reactive measure to the emergence of Dark Skippy. Instead, they have been integral to NGRAVE ZERO’s system architecture from the very beginning. We did not have to perform any additional mitigation work after Dark Skippy was identified because our system was already designed to withstand such threats.

Why You Can Trust NGRAVE’s Security Design

NGRAVE designed its products to be inherently secure. Our focus is to ensure you can trust the security of your wallet without needing to dive into the complexities of verifying the underlying code. Here is how:

• Control Over Communication: NGRAVE created its ZERO hardware wallet so nothing malicious can enter the device. To receive new firmware, the ZERO boots in a separate, empty partition, specifically to receive the update, which is cryptographically signed by NGRAVE’s secret keys. Then, the Secure Firmware Update relies on cryptography to decrypt, authenticate, and check the integrity of the newly received firmware, making sure it has no alien tasks such as Dark Skippy running. Plus, as ZERO uses transparent QR codes to communicate with online devices, you can verify all the transferred information to ensure all is correct.
• Control Over Seed Phrase Generation: NGRAVE ZERO gives you full control over the generation of your seed phrase. You can also use your fingerprint for entropy and shuffle parts of it, ensuring that the generation of your private key is entirely within your control.
• Control Over Supply Chain: When you set up your ZERO, you can verify the authenticity of the device by scanning a QR code on our website. The verification will only be successful if NGRAVE has manufactured the ZERO and it was not tampered with on its way to you.

Looking Ahead

Security is a journey, not a destination. While we are confident in the robustness of our current security measures, we are always looking ahead, exploring new technologies and methodologies further to enhance the safety of our users’ assets. If hardware wallet security is something that interests you, or if you have any other suggestions, we would love to hear from you.

At NGRAVE, your security is our priority, and we are committed to maintaining the highest standards to protect your digital assets. Stay safe; Stay Cold.