808bits

808bits HSM

An HSM that reads the transaction before it signs

Open source. Built for Bitcoin keys. It signs what your policy allows and nothing else.

Hello. I am your HSM. Please insert bytes.

What C_Sign sees
CKM_ECDSA
9f2c41d07be3a815c6e0f4b2d917a35e
0c88f1e6a4b07d23e5918c4fa62b7e01

signed

32 bytes. Your cold wallet or someone else's, the module can't tell.

What this one sees
to      bc1q...7xk2  2.0000 BTC
        not on allowlist
change               1.7999 BTC
fee                  0.0001 BTC
today   1.5 of 2 BTC used
        over daily limit

refused

The same request, read before signing.

C_Sign, the music video.

PKCS#11 is from 1995, and its signing call takes a digest. For Bitcoin that means the module receives the 32-byte hash of a transaction and never the transaction itself. It cannot tell a payment to your cold wallet from a payment of everything to someone else, so it signs both.

The rules about who may be paid and how much therefore live on the server in front of the HSM, which is the machine an attacker reaches first. A limit that a compromised host enforces is a limit a compromised host can skip.

What it checks

The 808bits HSM takes the unsigned transaction, parses it, and computes the hash it signs from what it parsed. Before it signs, every output is checked against a policy stored on the device:

  • the destination is on the allowlist, or it is change back to your own keys
  • the amount is under the per-transaction limit
  • the total for the day stays under the daily limit

If any check fails, it says which one and signs nothing. The host can still send it anything it likes. It just cannot get a signature for it.

[policy.btc]
allow         = ["bc1q...cold1", "bc1q...exchange"]
max_per_tx    = "0.5 BTC"
max_per_day   = "2 BTC"

Not FIPS validated

It has no FIPS 140-3 certificate. The curve is not the obstacle any more: SP 800-186 has allowed secp256k1 for blockchain applications since February 2023. Whether a validated module includes it in its approved mode is a question for that module’s certificate, and the FIPS tracker has those.

Open source

The firmware, the policy parser and the host tools are open source.

An HSM that signs anything is an expensive place to keep a key.