Foundation Passport Core (Batch 2): In-depth exploration of interesting architecture

Foundation Devices has carved out a clear niche in the Bitcoin security market by producing hardware wallets designed to empower users with true control, guarantee Bitcoin ownership, and fully protect privacy. The company's core mission is to create beautiful, open-source hardware for Bitcoin, which is a seamless improvement and evolution from the first generation.

The Passport Core (Batch 2) is designed with an air-gapped security system that allows transaction data to be transferred only via QR codes or MicroSD cards, eliminating the main risks associated with USB or wireless connections that could be hacked. The security architecture includes a Microchip ATECC608A Secure Element for protecting private keys and a True Random Number Generator (TRNG) that uses an open-source Avalanche noise source to generate more unique random words.

What truly sets Foundation apart is that both its hardware schematics and firmware are completely open-source under copyleft licenses (CERN-OHL-S and GPLv3). This allows external experts to fully review and audit the devices, and also enables reproducible builds, meaning the software can be verified as coming from a legitimate source. Additionally, Foundation enhances supply chain confidence by assembling devices exclusively in the USA. Combined with features designed to improve user experience, such as a high-resolution color IPS screen and an integrated camera for scanning QR codes, the Passport Core offers convenience without compromising security.

The pricing of the Passport Core at $199, which is higher than competitors like the Coldcard MK4 ($168), is a clear strategic decision. Foundation does not compete on price, but on quality, design, and the exclusive use of American-made components.

The target audience for the Passport Core are serious Bitcoin investors, large investors with technological understanding, financial institutions, and those who prioritize ultimate security. It connects to mobile phones via an air-gapped wallet. The price is not suitable for beginners, and it only supports Bitcoin, not other coins.

The integration of advanced architectural security with modern usability standards, despite a higher price than competitors and support only for Bitcoin, makes the Passport Core (Batch 2) a worthwhile investment for those who prioritize ultimate security and want true self-custody of their Bitcoin.

Foundation Devices operates on the fundamental belief that "security through openness" is the only long-term strategy Foundation Devices believes will truly protect hardware wallets that empower users.

Foundation chooses not to design closed, proprietary architectures that hide potential design flaws. These ideas are translated into concrete technical specifications. Foundation publicly releases all circuit schematics, design files, and firmware under open-source copyleft licenses, including CERN-OHL-S and GPLv3. This transparency allows experts and the broader community to openly examine both hardware and software for vulnerabilities, bugs, and hidden backdoors. Foundation discloses all components, from hardware design to bootloader code, which is crucial for systems requiring high security.

Furthermore, the commitment to assembling hardware wallets exclusively in the United States is a direct measure to mitigate risks associated with untrustworthy overseas manufacturing and potential supply chain interference, which is a major concern for advanced technical users. This stringent control over the manufacturing process provides additional assurance that the hardware users receive precisely meets the disclosed design specifications, without any hidden unwanted components or potentially harmful modifications.

Foundation adopted a "Digital Deco" design concept because they found the common hardware wallet designs on the market to be too simple and boring. By combining elegant elements with premium shapes, using high-quality plastic and copper-plated zinc alloy, the Core (Batch 2) model has also been slimmed down by approximately 20% compared to the Founder's Edition, making it more portable and easier to handle.

A significant user experience improvement is the high-resolution color IPS display, bonded to ultra-hard, scratch-resistant glass. This display is not just aesthetically pleasing but also a functional security upgrade, as it can show brighter and clearer QR codes, which is crucial for air-gapped transmission of complex transaction data.

The user interface has been completely redesigned to leverage this display, resulting in a look unlike typical hardware wallets. At first glance, it resembles a mobile phone used by grandmothers, leading to playful teasing from my admin who called it a "grandma phone" model. It features an easy-to-use left-to-right navigation, similar to old Nokia phones (T9), making PIN entry very simple.

Regarding the battery, Foundation addressed user concerns by switching from AAA batteries to a standard, user-replaceable Nokia BL-5C lithium-ion battery (the same one used in Nokia phones). This change provides better battery life, accurate battery level display, and frees users from relying on proprietary parts from Foundation, truly reinforcing the principle of independence. Charging uses a special USB-C port designed only for power delivery, without data pins, ensuring the air-gap status is maintained regardless of whether it's connected to a wall outlet or a computer.

The security of the Passport Core is fundamentally based on complete air-gapped isolation from the internet. This design dictates that the device has no physical connection to any internet-connected computer or network whatsoever. The existing USB-C port is designed solely for power delivery, with data transfer pins physically removed. This internet disconnection ensures that even if the device is plugged into a compromised computer, data theft or malicious firmware injection via the USB port is structurally impossible, reducing the attack surface.

Data communication relies solely on asynchronous and offline methods, primarily QR Codes and MicroSD Card. For QR Codes, the integrated Omnivision Cameracube camera allows the device to quickly scan unsigned PSBTs sent from companion wallet software like Envoy or Blue Wallet. After signing the transaction internally, the Passport displays the signed transaction data as a series of continuously changing QR codes, which the mobile software then scans back. This method is convenient yet maintains security.

The MicroSD Card, an industrial-grade MicroSD Card included with the device, serves as a secure data transfer channel for large and complex data, such as Multisig settings, firmware updates, and encrypted seed backups.

This "SneakerNet" approach allows even complex PSBT workflows to be managed securely offline. The combination of these two methods strikes a good balance between daily convenience and the ability to handle complex tasks, all while maintaining complete internet disconnection, which is central to the highest level of security.

The core functions of the Passport Core are managed by a high-speed STM processor, a 32-bit Arm® Cortex®-M7 core that can operate at up to 480 MHz. This processor features advanced capabilities such as a Floating Point Unit (FPU), Digital Signal Processing (DSP) instructions, and a Memory Protection Unit (MPU), creating a robust and secure operating environment for the firmware.

Crucially, this device employs a hybrid security architecture, incorporating a Microchip ATECC608A Secure Element (SE). This specialized chip acts as a physical security device that significantly enhances protection against physical attacks. Additionally, the Secure Element is responsible for several critical security functions, such as:

First, seed protection: The Secure Element stores the seed data, which is an element for generating the Master Private Key. This makes it difficult for anyone attempting to attack and extract data from the Secure Element; basic tools cannot be used to breach the system.

Second, PIN locking: The Secure Element enforces a device lockout after 21 incorrect PIN attempts, effectively preventing brute-force attacks.

And finally, supply chain verification: Every Passport device has a unique secret key locked in the SE, used for a challenge-response verification with Foundation's servers during initial setup. If the SE is compromised or swapped during shipping, the device will fail this check and alert the user to the risk of a supply chain attack.

Along with encrypted bootloader written in C and using Secure Element for power-on and firmware verification before the system starts.

The quality of a cryptographic seed is paramount in a security system, requiring high-quality, unpredictable entropy sources. The Passport Core addresses this requirement with a multi-source randomness generation strategy. The seed generation process (supporting both 24-word and 12-word seeds) utilizes three independent true random number sources: the CPU's built-in Random Number Generator (RNG), the Secure Element's True Random Number Generator (TRNG), and an open-source Avalanche noise entropy source.

The inclusion of the Avalanche noise source is a significant feature. This component is a dedicated open-source hardware module that relies on physical noise generated by reverse-biased avalanche diodes. This random signal is amplified, digitized, and mixed with other randomness sources. Foundation's design and public disclosure of its own physics-based, verifiable TRNG directly addresses concerns about the trustworthiness of RNGs embedded in microcontrollers that rely on other manufacturers.

This decision shifts trust from closed-source silicon manufacturers to a transparent and verifiable circuit design, assuring users that generated seeds are truly random from diverse and auditable sources, in line with Foundation's philosophy of "security through openness."

For securing Bitcoin, which holds digital gold value, the origin of the device is as crucial as its design. Foundation mitigates the risk of potential attacks during transit from the factory to the user, known as supply chain interdiction, through a verification system utilizing a Secure Element. Each device is equipped with a secret key in its Secure Element at the factory. Upon initial setup, the device performs a challenge-response verification with Foundation's servers using this key. If the device or secure element is tampered with en route, the verification will alert the user, preventing them from using the compromised device.

Foundation submits its hardware and software for independent expert review, having commissioned Keylabs to conduct a security audit of Passport Core in 2021. While the audit details require consultation of the PDF document, this review demonstrates an intention to proactively address all potential vulnerabilities and also encourages community involvement.

Foundation has a system to prevent users from downgrading firmware, ensuring that users are not vulnerable to flaws in older firmware versions. While some may dislike this forced approach, Foundation prioritizes maximum security. After the device is updated, it uses a C-language bootloader with forced rollback for firmware verification and updates.

Foundation Passport Core is suitable for those who require a high level of security due to its completely air-gapped design. It connects only via air-gapped (barcode) and SD card. The open-source hardware and firmware design, along with reproducible build techniques for the software, ensures that the software's security level can be verified, preventing code injection during transit. Furthermore, the management of device components includes a process to verify authenticity, with a secret code embedded in the device to prevent alteration of components used in assembling the hardware wallet.

Personally, I believe there are some areas where it lags behind competitors, such as having only one Secure Element, which cannot provide secondary protection if the primary one has a vulnerability. This is compared to the Coldcard Mk4 (not including Coldcard Q and Trezor Safe 7, which are top-tier models from Coldcard and Trezor). The Secure Elements are also undisclosed due to non-disclosure agreements, with only Trezor Safe 7 currently featuring an open-source Secure Element. Overall, it's a very worthwhile piece of hardware. The metal body is incredibly robust—you could probably throw it at someone's head and break it. The battery is stable, unlike the Coldcard Mk4, which had issues with unstable power causing device failure (Coldcard Q switched to AAA batteries instead of the Mk4's battery). However, it can't compare to the Trezor Safe 7's battery life, which is very long and supports wireless charging, in exchange for the ability to replace the battery yourself. If you're someone who only wants to store Bitcoin, this is an interesting option.