如何在Ledger Nano S中创建钱包？

Question

如何在Ledger Nano S中创建钱包？

- 4
- 445 2019-03-18
此问题的上下文在此处共享.

我想使用我的Ledger Nano S创建一个钱包(我的意思是tz1地址).我在网上找到的所有内容都是如何使用软件(例如Galleon Wallet)或网络创建一个钱包.应用程序(例如Tezbox).但是,据我了解,基于硬件的钱包的全部要点是密钥已创建并保留在硬件中.通过软件创建的密钥可以被软件拦截或存储(更加险恶),甚至可以发送给第三方.

现在,当我初始化账本时,我确实创建了密钥(设置PIN,然后设置24字安全性).因此,原则上,关键在于硬件.但是,没有什么可以保证我不能通过创建钱包并将其链接到分类帐的软件看到密钥.

那么,如何使用Ledger硬件安全地创建钱包?也许使用CLI tezos-client? (但后者意味着我需要运行一个节点?).

更新:

如上所述,几周前,我用24个恢复字和密码以及所有这些内容设置了我的分类帐.我的印象是我需要创建一个tz1地址,Blindripper的回答表明,该地址要求运行一个节点.我没有这样做,也没有做其他任何事情.但是,几天前,我刚刚将分类帐连接到Galleon Wallet(该软件中包含该选项),并且分类帐和软件中出现了tz1地址(公共密钥).配置分类帐时是否创建了这样的地址?我的账本合法.从制造商那里购买.因此,它不太可能已经带有地址.

Context of this question here.

I want to create a wallet (by which I mean a tz1 address) using my Ledger Nano S. All I find online is how to create a wallet using software (e.g. Galleon Wallet) or web application (e.g. Tezbox). However, as I understand it, the whole point of a hardware-based wallet is that the keys are created and stay in the hardware. A key created via software can be intercepted or (more sinister) stored by the software or even sent to a third party.

Now, when I initialised my Ledger, I did create the key (setting a PIN and then the 24-words security). So, in principle, the key is in the hardware. However, nothing assures me the key is not being seen by the software by which the wallet is created and linked to the Ledger.

So, how can I create a wallet securely using the Ledger hardware? Perhaps using the CLI tezos-client? (but the latter means I need to run a node?).

UPDATE:

As said above, I set up my ledger a few weeks ago, with the 24 recovery words and pin and all that. I had the impression I needed to create a tz1 address, which the answer by Blindripper suggested required running a node. I did not do that, and did not do anything else. Yet, a few days ago, I just connected my ledger to Galleon Wallet (with the option included in that software), and a tz1 address (public key) appeared in the ledger and the software. Was perhaps such address created when configuring the ledger? My ledger is legit. Bought it from the manufacturer. So it's unlikely it already came with an address.

ledger wallets

- 除非您公开您的种子词,否则应用程序无法提取和滥用存储在硬件钱包设备中的密钥.
  
  There is no way for apps to extract and misuse your key that is stored within the hardware wallet device unless you expose your seed words.
  - 0
  - 2019-03-19
  - Stephen Andrews
- @StephenAndrews谢谢.您怎么确切知道是这种情况?例如,如果Ledger Live具有sudo访问权限怎么办?
  
  @StephenAndrews Thanks. How exactly do you know this is the case? For instance, what if Ledger Live has sudo access?
  - 0
  - 2019-03-19
  - luchonacho
- 它使用硬件安全模块-这是一个单独的芯片,不允许提取您的私钥.HSM是众所周知的,并且在世界范围内用于许多安全应用程序.
  
  It uses a Hardware Security Module - this is a separate chip that does not allow to extraction of your private key. HSM are well known and used around the world for many secure applications.
  - 1
  - 2019-03-19
  - Stephen Andrews
- @StephenAndrews我明白了.听起来更像是答案,而不是评论.钙你要加吗?这似乎也与其他答案背道而驰.
  
  @StephenAndrews I see. That sound more like an answer than a comment. Ca you add it please? It also seems to go against the other answer.
  - 0
  - 2019-03-20
  - luchonacho
- 您不清楚要问什么."创建钱包"到底是什么意思?当然,您必须将_some_软件连接到Ledger,因为它并未预装可在Tezos派生路径上生成密钥的应用程序.
  
  It's not clear what you're asking. What exactly do you mean by "create a wallet"? You certainly must connect _some_ software to the Ledger, because it does not come preinstalled with an app which will generate keys at the Tezos derivation path.
  - 0
  - 2019-04-08
  - Tom
- 作为参考,您可以检查https://gist.github.com/dakk/bdf6efe42ae920acc660b20080a506dd和https://github.com/obsidiansystems/ledger-app-tezos
  
  For reference you can check https://gist.github.com/dakk/bdf6efe42ae920acc660b20080a506dd and https://github.com/obsidiansystems/ledger-app-tezos
  - 0
  - 2019-04-09
  - Ezy
- @luchonacho:我现在已经解决了这个问题,因为它已经被适当地涵盖了.另外,请避免在原始问题的答案中的评论内提出多个后续问题.这不是良好的SE惯例.如果您有后续问题,请一次提出一个新问题并在那里提问.否则,很难跟踪您的困难,也很难为社区其他成员正确地组织知识.
  
  @luchonacho : i have now closed this question as it has been appropriately covered now. In addition please refrain from asking multiple follow-up question within comments in the answer to your original question. It is not good SE practice. If you have follow-up questions please create new questions and ask them there, one at a time. Otherwise it is difficult to keep track of your difficulties and also organize properly the knowledge for the rest of the community.
  - 0
  - 2019-04-14
  - Ezy

2 个回答

投票数

adrian · Answer 1 · 2019-04-10

4

2019-04-10

此过程有多个步骤,我认为您已经完成了所有步骤,但我将逐步介绍这些步骤,以突出其中的某些工作原理.

分类帐设置

要使用分类帐,您必须使用之前的旧种子短语对其进行初始化,或者为您生成一个新的短语.您应始终确保直接从Ledger网站上购买了正版账本.

初始化账本时,它使用种子的随机性,并为其支持的所有加密密钥生成不同的私钥.它将那些私钥存储在分类帐的安全元素内.即使您具有物理或数字访问权限,从安全元素中提取私钥实际上几乎是不可能的.获得相同私钥的唯一方法是使用相同的种子短语.

Tezos Wallet Ledger应用程序

分类帐本身对TZ1,ETH或BTC地址一无所知.为了获得您的TZ1地址,您需要从Ledger Live安装" Tezos Wallet"应用程序.该应用程序可以向Ledger固件询问ed25519曲线的私钥的公钥.这是从您的种子短语确定生成的私钥之一. Tezos Wallet应用程序还可以在"分类帐"屏幕上显示派生的TZ1地址.

TezBox或其他客户端

为了与Tezos Wallet应用程序进行交互,您需要一个软件客户端,例如TezBox. TezBox永远无法访问分类帐上的私钥.它知道如何向账本上的Tezos Wallet应用程序索要与上述某些私钥相对应的公钥.然后,TezBox使用该公钥并输出相应的TZ1地址.您应该确认TezBox和Ledger屏幕显示相同的TZ1地址,以确保没有人拦截您的连接.

当您使用TezBox和Ledger发送交易时,TezBox准备交易,然后将其发送到Tezos Wallet应用程序,该程序对交易进行解码并在屏幕上显示所有详细信息.签署前,请务必先进行验证.单击签名后,Tezos Wallet应用程序会要求Ledger固件使用存储在安全元素中的私钥之一对交易进行签名.私钥永远不会离开安全元件,并且签名会在该芯片上进行.然后将签名返回给Tezos Wallet应用程序,该应用程序又将其返回给TezBox,然后将其提交到全节点.

我希望可以澄清一下Ledger的工作原理:-)我很乐意回答有关此问题的更多问题.阿波写了一个真正的关于如何将Ledger与TezBox结合使用的好指南.

There are multiple steps to this process, all of which I think you have already done, but I'll walk through them just to highlight how some of it works.

Ledger Setup

In order to use the Ledger you have to initialise it with either an old seed phrase from before or it generates a new one for you. You should always ensure that you bought a genuine ledger directly from the Ledger website.

When you initialise your Ledger it uses the randomness from your seed and generates different private keys for all the cryptographic keys that it supports. It stores those private keys inside of the secure element of the Ledger. It is virtually impossible to extract the private keys from the secure element, even if you have physical or digital access to it. The only way to get the same private keys is to use the same seed phrase.

Tezos Wallet Ledger Application

The Ledger itself doesn't know anything about what TZ1, ETH or BTC addresses are. In order to obtain your TZ1 address you need to install the "Tezos Wallet" application from Ledger Live. The application has the ability to ask the Ledger firmware for the public key of the private key for the ed25519 curve. This is one of the private keys that was deterministically generated from your seed phrase. The Tezos Wallet application can also display the derived TZ1 address on the Ledger screen.

TezBox or other clients

In order to interact with the Tezos Wallet application you need a software client, such as TezBox. TezBox never has access to the private key on the Ledger. It knows how to ask the Tezos Wallet application on the Ledger for the public key that corresponds to some private key as described above. TezBox then takes that public key and outputs the corresponding TZ1 address. You should confirm that TezBox and the Ledger screen show you the same TZ1 address in order to ensure that no one is intercepting your connection.

When you send a transaction using TezBox and the Ledger, TezBox prepares the transaction, then sends it to the Tezos Wallet application, which decodes the transaction and displays all the details on the screen. You should always verify those before you sign it. Once you click sign, the Tezos Wallet application asks the Ledger firmware to sign the transaction using one of the private key that is stored in the secure element. The private key never leaves the secure element and the signing happens on that chip. It then returns the signature to the Tezos Wallet application which in turn returns it to TezBox which then submits it to a fullnode.

I hope that clarifies a little bit how the Ledger works :-) I'd be happy to answer more questions around this. Awa wrote a really good guide on how to use the Ledger in combination with TezBox.

高超！谢谢！尚无法投票,因为使用了我的每日限额:/,但明天会这样做.一些后续问题.1)究竟何时创建"tz1"地址?通过Ledger Live安装Tezos Wallet时是吗?2)由于分类帐只有一组私钥,这是否意味着我创建的任何其他地址/钱包都相同?ETH还是BTC?3)在某个时候,我必须告诉区块链有一个新的`tz1`帐户.这就是所谓的"公开"地址吗?4)硬件(以及任何软件创造的钱包)如何确保不会创建两个相同的`tz1'?

Superb! Thanks! Can't upvote yet because used my daily limit :/ but will do so tomorrow. Some follow-up questions. 1) when exactly is the `tz1` address created then? Is it when installing the Tezos Wallet through Ledger Live? 2) Since the ledger has only one set of private keys, does it mean it is the same for any other address/wallet I create, e.g. ETH or BTC? 3) At some point I have to tell the blockchain there is a new `tz1` account. Is this what is mentioned as "reveal" the address? 4) How does the hardware (and any software-creation wallet) ensures not two identical `tz1` are created?
- 0
- 2019-04-10
- luchonacho
1.在安装Tezos Wallet应用程序时,将创建TZ1地址.它获取存储在安全元素上的私钥及其公钥,并显示从公钥派生的TZ1地址. 2.分类帐使用分层确定性密钥派生,这使您可以从同一私有密钥派生许多不同的公共密钥.因此,您只需要存储一个私钥即可使用无限数量的公钥.

1. The TZ1 address is created when you install the Tezos Wallet application. It takes the private key that is stored on the secure element and its public key and displays the TZ1 address derived from the public key. 2. The ledger uses hierarchical deterministic key derivation, which allows you to derive many different public keys from the same private key. Due to that you only have to store a single private key for an unlimited amount of public keys.
- 1
- 2019-04-10
- adrian
3.是的,这在很大程度上是正确的.在您可以从新的TZ1帐户发送第一笔交易之前,必须显示其公钥.但是,即使将XTZ显示出来,也始终可以将其发送到TZ1. 4.这归结为使用HD路径,并且种子短语后面的熵是唯一的(即,在两个人使用相同的种子短语之前,宇宙很可能发生内爆).

3. Yes that is largely correct. Before you can send the first transaction from your new TZ1 account you have to reveal its public key. However you can always send XTZ to your TZ1 even before you reveal it. 4. This comes down to using HD path and that the entropy behind a seed phrase is unique (ie it's more likely that the universe implodes before two people use the same seed phrase).
- 1
- 2019-04-10
- adrian
建议删除与Tezos无关的分类帐详细信息.如果没有,则应对其进行纠正...这些应用程序正在安全元素内运行,并且能够使用私钥.

Suggest deleting the Ledger details which are not about Tezos. If not, should correct them... The apps are running inside the secure element and are able to get their hands on private keys.
- 0
- 2019-04-11
- Tom

Blindripper · Answer 2 · 2019-03-18

0

2019-03-18

首先:是的,您需要运行一个节点来完成此操作.

此处是一个教程,介绍如何使用CLI进行操作.

如果您使用 LedgerLive (安装了Tezos Wallet(和烘焙)应用程序.

那么,使用第三方软件为Ledger创建钱包并不安全吗?

So, using a third-party software to create a wallet for Ledger is not secure then?
- 0
- 2019-03-18
- luchonacho
似乎是一个超强的结论.基本上,仅通过节点创建钱包是100％安全的.这绝对不是人们的印象.

Seems to be a super strong conclusion. Basically, only creating a wallet via the node is 100% secure. This is definitely not the impression people get.
- 0
- 2019-03-18
- luchonacho
什么是100％安全?:-)

What is 100% secure? :-)
- 1
- 2019-03-19
- Blindripper
在这种情况下,在创建钱包之前和之后,密钥均应与外界隔离.谁知道.由于Ledger的固件不是开源的,因此它们本身可能是直接的(恶意)或间接的(错误)风险源.

In this case, that the keys are shielded from external parties before and after creating a wallet. And who knows. Since the firmware of Ledger is not open source, they themselves might be, either directly (malintention) or indirectly (bugs) be a source of risk.
- 0
- 2019-03-19
- luchonacho
私钥在创建钱包的过程中也受到保护,因为它们在任何情况下都不会离开设备.离开设备的只是公钥.

The private keys are also protected "during" wallet creation, as they never leave the device, under no circumstances whatsoever. What is the leaving the device are only the public keys.
- 0
- 2019-03-20
- cryptodad
嗨,您好.这可能是另一个问题,但是...几周前,我用24个恢复字和大头针等等设置了我的分类帐.从您的问题中可以看到,然后我想使用硬件创建一个钱包,您建议使用CLI来完成.我没有这样做,也没有做其他任何事情,但是后来我刚刚将分类帐连接到Galleon Wallet,在那里出现了tz1地址.初始化钱包时是否创建了一个钱包?我的账本合法.从制造商那里购买.

Hi there. This might be another question, but... I set up my ledger a few weeks ago, with the 24 recovery words and pin and all that. As you can see from my question, I then wanted to create a wallet using the hardware, which you suggested needed to be done with CLI. I did not do that, and did not do anything else, but then I just now connected my ledger to Galleon Wallet, and, a tz1 address appeared there. Was perhaps a wallet created when initialising the wallet? My ledger is legit. Bought it from the manufacturer.
- 0
- 2019-04-08
- luchonacho
我不知道问题的含义,但是似乎可以确定您不需要运行节点.

I don't know what the question means, but it seems certain that you do not need to run a node.
- 0
- 2019-04-08
- Tom
@luchonacho您的评论在这里暗示您感到困惑.参见例如[此文档](https://ledger.readthedocs.io/en/latest/background/hd_keys.html).无需"使用硬件创建钱包"；选择24个字后,设备上的所有tz *地址都将确定.海事组织这是有关账本的有趣问题所必需的知识.

@luchonacho your comment here suggests you are confused. See e.g. [this doc](https://ledger.readthedocs.io/en/latest/background/hd_keys.html). There is no need to "create a wallet using the hardware"; all the tz* addresses on the device were determined as soon as you chose the 24 words. IMO this is required knowledge for interesting questions about the Ledger.
- 0
- 2019-04-08
- Tom
@Tom我的意思是创建一个新的`tz1`地址.您可以使用无法永远不能确保将密钥发送给第三方的软件来实现此目的,也可以使用"硬件"(例如Ledger)来实现,而不能在任何人的干预下创建密钥.确保将键保留在设备内部.很抱歉,我的知识不足以使您对这个问题感兴趣.

@Tom I mean, to create a new `tz1` address. You can do that with a software, where you can't never be sure the keys are not sent to a third party, or with a "hardware" (e.g. Ledger), where they are supposedly created without the intermediation of anyone, and the keys for sure stay inside the device. I'm sorry my knowledge is not good enough for this question to be interesting to you.
- 0
- 2019-04-08
- luchonacho
对不起,没有冒犯.

Sorry, no offense.
- 0
- 2019-04-08
- Tom