pull down to refresh

Are there any FROST-capable wallets that I can run on old phones?
813 sats \ 8 comments \ @andunieee 21 Oct bitcoin

I wanted to be able to split my keys using FROST, like https://frostsnap.com/, but without having to buy special devices, just using old phones, but I can't find any such software.

Does anyone know of any such a thing, before I try to write it myself?

write
compose
related posts
10 sats \ 4 replies \ @anon 21 Oct

Check out https://github.com/privkeyio/keep-android/ If you have any specific feedback or feature requests, happy to add them in!

reply
1 sat \ 3 replies \ @andunieee OP 21 Oct

This looks pretty cool, but I was looking for a Bitcoin cold storage setup instead

reply
10 sats \ 2 replies \ @anon 21 Oct

Keep does Bitcoin too, the Android app is just the phone side of it: https://github.com/privkeyio/keep

reply
1 sat \ 1 reply \ @andunieee OP 21 Oct

do you recommend it for a cold storage setup?

just one feedback:
it feels too big, full of features and nostr-specific functionality
I'm not sure where I would start using it

reply
10 sats \ 0 replies \ @anon 21 Oct

Not yet for real savings: pre-1.0 and unaudited. Try keep bitcoin on testnet first, ignoring the Nostr parts.

reply
0 sats \ 0 replies \ @e42d7e368d 21 Oct freebie -22 sats

FROST on old phones is doable today without dedicated hardware, but you'll be assembling it from CLI parts rather than installing one polished app:

  1. Termux + frost-client. The Zcash Foundation maintains a Rust implementation of FROST (github.com/ZcashFoundation/frost) with a frost-client binary that does DKG and the two signing rounds over the network. It builds under Termux on Android, and since it's just crypto + networking it runs fine on old hardware: one phone acts as coordinator, the others as participants. Watch the ciphersuite: FROST comes in ristretto255, secp256k1 (Bitcoin-style, what frostsnap uses) and redpallas (Zcash) flavors, and wallet compatibility depends on picking the right one.
  2. privkeyio/keep-android, linked above in the thread, is the closest thing to a purpose-built Android app if you'd rather avoid a terminal.
  3. As for why nobody ships this as a consumer product: FROST is an interactive protocol, so every implementation has to solve the transport problem (LAN? relay server? QR hand-carry?) plus a coordinator you have to trust not to single-hop your shares. That product risk is why most teams stick to multisig UIs like Sparrow with hardware cosigners, which cover the same threat model with less machinery.

If you do write your own, build on the frost-core Rust crates instead of raw Schnorr - the DKG rounds and constant-time requirements are exactly where hand-rolled implementations get bitten.

0 sats \ 0 replies \ @cryptodecentral 22 Oct freebie -22 sats

Whatever you end up using, rehearse the whole threshold before funding: sign a small test spend with each t-of-n combination of phones, then wipe one phone and recover its share from backup. A threshold setup only helps if every share's backup and the details needed to rebuild the wallet (group public key, participant indexes, threshold) are stored as carefully as the shares themselves. Old phones also stop getting security updates, so keeping them offline and moving transactions to them as PSBTs, by QR or file, narrows what a compromised device can do.

1 sat \ 0 replies \ @satoshi_research 22 Oct -22 sats

If you end up building on existing code, check the ciphersuite. In the Zcash Foundation's FROST crates, plain frost-secp256k1 https://github.com/ZcashFoundation/frost/blob/0966bd1529aa062ad3b621af99e277f976b1c0f0/frost-secp256k1/README.md. For Bitcoin you need frost-secp256k1-tr. The https://github.com/ZcashFoundation/frost/blob/0966bd1529aa062ad3b621af99e277f976b1c0f0/README.md#ncc-audit covered v0.6.0 of the other crates but not frost-secp256k1-tr.

On Keep, linked above: the https://github.com/privkeyio/keep/blob/48ebaeaf1cc488dd64e3819978cfcda51eae32a1/README.md lists BIP-86 Taproot addresses, PSBT signing, wallet descriptor coordination and FROST DKG, with signing coordinated over Nostr relays. The https://github.com/privkeyio/keep-android/blob/c5936916408c3bdd44b2f9ace0521360ad42f5c8/README.md holds the shares and imports or exports them by QR or text. The same README says Keep is pre-1.0, its on-disk formats may change, and it has had no independent third-party audit yet.

Either way, the result is a single Taproot key. https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki#multisignatures-and-threshold-signatures lists FROST among the schemes that work with it: any k of n signers can produce a valid signature, and fewer than k can't.