KEYCARD STATUS CODE
KEYCARD STATUS SERIES

Users can unlock the Status app with the Keycard.

The transaction is signed with the key and sent back to the Status app to further forward it to the Ethereum network for confirming the transaction on the blockchain. Note that the wallet's private key never leaves the Keycard. If the passcode is correct, the Keycard signs the transaction sent to it by the Status app. The user now has to enter the passcode to authorize this transaction. This signing phrase is generated randomly for every app installation and first shown to the user during setup. It shows the secret three-word signing phrase (not to be confused with the three-word chat name) which informs the user that this transaction signature request is indeed coming from the Status app and not someone else spoofing it. When ‘ Sign with Keycard’ is tapped, the app communicates with the Keycard over NFC and starts authorizing this transaction. This transaction has to be signed with the wallet's private key which is now stored only within the Keycard. ETH, the amount of token and the network fee. The information entered by the user on the Status app is used to create a transaction specifying the from and to addresses, the crypto token e.g. Once the Keycard account is set up, wallet transactions can be signed using it.

The app then randomly asks for two of those words to check if the user has indeed written it down correctly. And like always, the user has to safely backup the 12-word seed phrase which is required to recover keys if necessary. As explained in the previous article, these security measures raise the bar significantly for an attacker.

KEYCARD STATUS CODE

The next two steps are for the user to safely write down the Personal-Unlocking-Key (PUK) code and pairing-code.

This passcode will be asked each time a wallet transaction has to be executed. It should not be something easy to guess like all zeros, 123456 or the user's date-of-birth. So a random 6-digit number that can be remembered has to be picked. For this, Keycard is brought next to the phone to perform three simple but important steps to set it up. Keycard is then chosen as the storage location and has to be paired with the phone. The user has to pick one of the suggested random but readable three-word chat names which is generated from the chat public key. The account setup flow with Keycard is as follows: keys are generated on the Status app. So, even if the phone or Keycard gets compromised, keys are safe. Keycard enhances security by storing keys within its hardware wallet and using the phone to interact with it. These keys are today stored within the Status app on the mobile phone. Status app uses cryptographic keys to keep wallet transactions and chat messages secure and private. This section describes security aspects of the various flows while using Keycard with the Status app, specifically the setting up of an account, executing a wallet transaction, logging into the app and exchanging messages. This article dives into the different Keycard security flows and scenarios. It described the current implementation, possible exploit scenarios and corresponding mitigations.

KEYCARD STATUS SERIES

The previous article in this series gave an overview of Keycard’s security features related to cryptography, access control, smart card security, communication security, applet security and transparency. It takes the form-factor of a credit-card and uses NFC technology for a contactless experience with the Status mobile app. Keycard is an open-source hardware wallet for managing private keys and signing transactions.

Keycard status