Demo video (6 min): https://odysee.com/@ndssigner:9/demo-dtmf-signer:c
Two weeks ago I posted the threat model of NDS-Signer here, SeedSigner on a Nintendo DSi, and your reviews made it better. Someone in that thread also asked where to buy a DSi. Fair question, they're getting old. So here's the other answer: a signer you build yourself, from parts you can buy anywhere.
DTMF-Signer is a Raspberry Pi Pico, a small screen and five buttons on a breadboard, about $13 in parts if you buy multipacks. It hears PSBTs as telephone tones (that's ur-tones), and the reference build answers with QR codes that Sparrow reads. No camera, no USB data, no secure element, no storage. Unplug it and the seed is gone.
The part I care about most is that the seed is never shown. It arrives as tones from an offline computer (or a WAV kept on an MP3 player), encrypted with a long PIN you type on the signer, and the screen only ever shows its fingerprint. After the Ledger implant that read recovery phrases off the screen, I wanted a device with nothing on the screen worth stealing. It also never generates seeds and signs with deterministic nonces, so there's no RNG in it to get wrong.
What works today, on a breadboard: loading a seed by tones with its PIN, the fingerprints, exporting the xpub, and signing PSBTs that go back as QR. The screen shows the keys and parts as they arrive, so you can tell it's hearing you. What doesn't yet: tones through the air with a mic and a speaker, a PCB, an inactivity timeout, and any independent review. So please don't put funds on it.
These are the firmware's own screens, drawn by its code on a computer with test data, from main (a bit newer than the alpha). All of them are here: https://github.com/ndssigner/dtmf-signer/blob/main/docs/screens.md
The repo has the spec, the breadboard layout with a printable 1:1 template, a .diy file for DIYLC, and a catalog of cheaper or stranger builds, down to an 8-bit micro and a DTMF decoder chip out of an old phone.
- Code, spec and layout: https://github.com/ndssigner/dtmf-signer
- Where to start reading the code: https://github.com/ndssigner/dtmf-signer/blob/main/AUDIT.md
- First alpha, build it from source: https://github.com/ndssigner/dtmf-signer/releases/tag/v0.1.0-alpha
Two asks. If you have a Pico and an afternoon, build one and tell me where the instructions failed you. And if you read C, tear the signing path apart.