Passport was off for a while, battery was dead.
Recharged it today and it says to ensure your security the master key has been erased. It asks me to provide master key.
is this normal behavior?
Hey @Panicseller sorry to hear that.
First of all, know that only the encryption key was lost, as long as you have access to your keycards you can just tap provide master key, you should be able to tap them and recover prime in the state that you had it before.
Passport prime automatically shuts down when it sees less than 5% of battery in KeyOS 1.2.1, but in order to address if this normal behavior I’d need more info - how long has it been stored without turning on? what charge percentage was it stored with?
Moreso, did you have to charge it for it to turn on? or did it turn on but with that screen and some battery left? Trying to get all the pieces of the puzzle before assessing - thanks!
Again, apologies for the incovenience
It was off for a month or so, there was still a decent amount of charge when last used, so it seems to drain battery even when off. Had to charge for it to turn on.
I didn’t even really think about the battery part much, just wanted to check if it’s normal if it’s turned off for prolonged period that it erases the master key?
would be problematic, that means the keycards or seed have to stay close by all the time
Hey @Panicseller - just to confirm, what version KeyOS are you on? Battery shouldn’t be draining that fast, we’ll look into it. You don’t happen to remember what battery percentage it had when you stored it by any chance, did you?
Version 1.2.1
Unfortunately I do not remember, I had not used it for a while
Ok thank you, we’ll look into it - thank you for the report! Keep an eye on battery legvels and if it happens again do not hesitate to report back
This sounds extremely concerning. There should be no battery condition that causes the master key to erase. If this is correct, this needs to be the top bug to fix!
Hey @Mason.99999 thanks for chiming in. The seed erase on battery depletion is there by design:
Attackers often do things like remove a chip from the circuit board and mount it on a new board, which would cause it to lose power. So since the master key is split between the SECURAM, which is battery backed in the CPU, and the Secure Element (where the secret survives power loss), if the attacker removes the BGA-based CPU, it will lose power and thus the master key will become unrecoverable. It would be pretty challenging to find a way to remove the BGA-based CPU without it losing power, and that is assuming you also simultaneously found a way to avoid the active tamper.
So this essentially makes Passport Prime a bunker for your seeds, making lab based attacks very challenging (the tamper check also checks for drastic temperature variations btw, so heating up the thing too much to desolder stuff would also trigger it).
Passport Prime automatically shuts down when it has 5% battery of left, which in 1.2.0 and 1.2.1 is displayed at 5%, but in 1.3.0 and on we will display as 0%. So essentially before 1.3.0 you will see the battery go down to 5% then shut down, in 1.3.0 we made it so that visually it goes down to 0% before it shuts down, even if it really still has that 5% reserve intact.
Passport should really last a very long time on that 5% when completely shut down, like almost nothing drains battery in that state. What we need to find out is why your device was sucking power while shut down, which we are actively investigating.
So again, apologies for the inconvenience, but I hope this message helps clarify why this is a sought after feature and not a bug.
Thanks for the explanation! That makes sense. Have you done any bench mark testing of how long it should last after 5% shutdown or set a target life? Personally, I’d rather it shutdown at 10% or even 20% and ensure it doesn’t lose the keys for at least a year. I don’t want to have to worry if I go on a trip and leave it at home that when I come back the seeds are gone.
Make it a configurable at that point - so users can adjust it. Niche feature but I could see a purpose, for instance, if you leave it in a safety deposit box or something.
Agreed if this was an option given to the user somehow would be nice to turn this on and off when desired because I often leave my hw devices in private spaces for long periods of times
This is in fact feasible and has been discussed internally, we will look into adding it to KeyOS 1.4.0 - thank you for the feedback! In the meantime, just charge it before putting it in a drawer. Also, know that passport automatically shuts down if locked for X amount of time (where X is twice the time you defined as default lock time), so leaving it locked is ok too