Home

Awesome

Warning: Seedkeeper-Tool has been deprecated as of November 2024. You should use the new Satochip-Utils application instead to easily manage and use your Satochip, Seedkeeper and Satodime cards.

Seedkeeper-Tool

Windows & Linux application for the Seedkeeper secure vault: store your most precious secrets, including seeds, masterseed and others inside a secure chip, protected by a PIN code.

Customize and buy your own Seedkeeper here!

Introduction

Traditionally, cryptocurrency users have used a simple pen and paper to keep a backup copy of their hardware wallet seed. While this simple method works relatively well, it has also signifiant drawbacks:

A slightly more sophisticated way of securing your seed backup has been developed in the form of metal plates that are fire and water-proof. But the user is still left with the difficulty of protecting the seed from malicious unwanted eyes. And the challenge is only getting worse if you want to make multiple backups...

With a SeedKeeper, Seeds are stored in the smartcard secure memory and can only be accessed by their legitimate owner using a short, easy-to-remember, secret PIN code. SeedKeeper is easy to use yet powerful; it is robust yet affordable; and last but not least, it is completely open-source. SeedKeeper can be conveniently used in combination with a Satochip hardware wallet to serve as a secure backup. And you can use multiple SeedKeeper backups without compromising security!

A few definitions

In order to clarify concepts, here are a few terms that will be use throughout this manual:

SeedKeeper overview

The main purpose of a SeedKeeper is to securely store and backup seeds. On a basic level, here are the main actions you can perform on a seed:

A SeedKeeper can store several seeds in its secure memory (the exact number depends on their size, but it can exceed several dozen). A label can be attached to each seed stored in secure memory. This can be used e.g. to provide a short description in less than 128 characters.

A seed can be exported in two ways, as defined during seed creation:

The export in encrypted export is obviously more secure and it also allows end-to-end seed encryption, where the seed is generated on-card in a SeedKeeper then exported encrypted to any number of backup device and finally to a Satochip hardware wallet. Note however that encrypted export only works with compatible devices ( SeedKeeper and Satochip currently). Note also that if a seed is marked as 'Encrypted export only', it cannot be exported in plaintext for security!

For backup purpose, it is possible to export all the secrets stored in a SeedKeeper to another SeedKeeper. The procedure is similar to a seed export, except that all the secrets are exported in an encrypted form. An arbitrary number of backup can be performed that way.

SeedKeeper secure pairing

The secure pairing allows 2 devices (SeedKeeper, Satochip or any compatible device in the future) to authenticate each other and generate a shared secret key to communicate securely. This will allow them to exchange seeds and other data. To achieve this, the two devices needs to exchange their authentikey and store the other device's authentikey in their secure memory. To simplify this process, each time a card is inserted, its authentikey is requested by the SeedKeeper-Tool and stored in a temporary array called the Truststore. When a user wants to export a seed from a device A to another device B, he selects B's authentikey in the 'Export a Secret' menu option. After export, the encrypted data is available in JSON format

How to use your SeedKeeper?

To use your SeedKeeper, simply connect a card reader and insert the SeedKeeper in it, then run the SeedKeeper-Tool on your computer. If you are on Linux, you may need to install the smartcard driver if the card is not detected (for example on Ubuntu: "sudo apt install pcscd"). On the first usage, you will need to initialize the card by defining a PIN code and optionnaly a label to identify the card. On the subsequent use, you will have to enter your PIN code in order to use your SeedKeeper, so be sure to memorize this PIN correctly!

The SeedKeeper-Tool provides the following menu:

How to use SeedKeeper with your Satochip?

You can import a BIP39 mnemonic, an Electrum mnemonic or the raw Masterseed into a Satochip hardware wallet. Note that it is not recommended to import an Electrum mnemonic into a hardware wallet (even though it is possible) as it is not standard and can create compatibility issues. A Mnemonic can be imported in plaintext only, using any application supporting Satochip for the import (e.g. SeedKeeper-Tool, Electrum-Satochip, Electron Cash, Satochip-Bridge...). A Masterseed can be imported encrypted using the SeedKeeper-Tool ('Import a Secret' > 'Secure import from json'). In this case, the encrypted Masterseed can be obtained from the export menu after pairing the SeedKeeper with the Satochip.

You can import a seed into a Satochip either in plaintext or encrypted. Simply insert the Satochip and use the same menu option as for seed import to a SeedKeeper (you will see that only the menu options available for a Satochip will be enabled). If the seed is in plaintext, you can use any application supporting Satochip for the import (e.g. Electrum-Satochip, Electron Cash, Satochip-Bridge...).

Note that encrypted seed import is only supported by Satochip v0.12 (and higher).

Buidl

Requirements

Python dependencies can be installed with:

$ python3 -m pip install -r ./contrib/requirements/requirements.txt

Run from sources

$ python3 seedkeeper/seedkeeper.py

Use -v flag for detailed logs in console.

Build Linux AppImage

Build docker image:

$ sudo docker build -t seedkeeper-appimage-builder-img contrib/build-linux/appimage

Build AppImage:

$ sudo docker run -it \
    --name seedkeeper-appimage-builder-cont \
    -v $PWD:/opt/electrum \
    --rm \
    --workdir /opt/electrum/contrib/build-linux/appimage \
    seedkeeper-appimage-builder-img \
    ./build.sh

Build Windows .exe

Build Windows binaries from Linux & Docker.

Export some variables:

export GIT_REPO=(provide project folder path)
export GIT_BRANCH=master

Build docker image:

sudo docker build -t seedkeeper-wine-builder-img contrib/build-wine

Clone project:

FRESH_CLONE=contrib/build-wine/fresh_clone && \
    sudo -E rm -rf $FRESH_CLONE && \
    mkdir -p $FRESH_CLONE && \
    cd $FRESH_CLONE  && \
    git clone $GIT_REPO seedkeeper && \
    cd seedkeeper && \
    git checkout $GIT_BRANCH

Generate binaries:

sudo docker run -it \
    --name seedkeeper-wine-builder-cont \
    -v $PWD:/opt/wine64/drive_c/electrum \
    --rm \
    --workdir /opt/wine64/drive_c/electrum/contrib/build-wine \
    seedkeeper-wine-builder-img \
    ./build.sh

License

This application is distributed under the GNU Lesser General Public License version 3.