Anti-exfil protocol can't be verified on multiple hardware wallets
Regarding the nonce side channel attacks detailed in posts like this one by Blockstream. Which references this mailing list by Pieter Wuille. The idea is to add another layer of protection against a malicious hardware wallet by requiring it to prove that it incorporates some randomness provided by the software wallet that is used to broadcast the signed transaction. Comparing the anti-exfil protocol to deterministic nonce, Pieter says: In case HW uses a deterministic algorithm, it is possible to protect against the MHW case by spot checking HW's behavior, by using an externally known secret/seed. However, we'd like to have better than just spot checking security, and for protection against side-channel attacks we may want something that keeps working even when randomness is used by HW. But this is precisely what I like about the deterministic nonce. I can buy as many hardware wallets as I want to verify that they all produce the same signature. And even test it against s...