All articles

Encrypt PIN with MicroSD card

SD protection provides extra protection against physical attacks on the Trezor Model T. When it is enabled, a randomly generated secret is stored on the microSD card that you can insert into your Trezor Model T.

During every PIN checking and unlocking operation this secret is combined with the entered PIN value to decrypt data stored on the device. Simply put, the device gets bound to the SD card and cannot be unlocked without it until you intentionally disable the feature or factory-reset your device.

If you are concerned about physical attacks, you can remove the SD card whenever the device is not in use and keep the two in separate locations. One without the other is worthless to an attacker, because the SD card secret is an entirely random value which carries no information about the seed or passphrase.
 

Activating and using the SD protection

To enable this feature you will need trezorctl version 0.11.6 or later and a FAT32 formatted microSD card. 

 

If the card is not properly formatted, then Trezor will offer to erase and format the card for you.

 

There are three commands related to SD protection:

 

trezorctl device sd-protect on

 

trezorctl device sd-protect off

 

trezorctl device sd-protect refresh 

 

The refresh command replaces the current SD card secret with a new one. This is useful if you inserted the SD card into a malware-infected computer and are worried that the secret stored on the card may have been compromised.


 

Connect your device and insert the MicroSD card into the card slot

 

 

The MicroSD card should be inserted with pins facing you on the left side.


 

Use the Trezor command-line interface to enable the SD protection

 

  • Use the command:

 

trezorctl device sd-protect on

 

  • Follow the on-screen instructions:

 

 

Congratulations! Your device is now bound to the secret on the microSD card. You will need insert the card into the device to use your PIN. 

 


 

The SD card is required to enable the feature, and then every time you wish to unlock the device.