Add Ledger support

The Ledger companion wallet for Komodo suffers from the lack of an important Komodo-specific feature that allows KMD holders to claim interest. It does not seem like Ledger will be implementing anything soon. Ledger CTO recently stated on their slack channel regarding a question about this issue: "we don't have the dev bandwidth to do that in the near future". They also don't want to work on it because "the Chrome apps are going to be deprecated".

Fortunately there might be an easy solution to the problem for KMD holders that want store their KMD in a Ledger-based account. Ledger provide a NodeJs API for communicating with the device app. The api works both over u2f (in-browser) and node-hid (native bindings). Since Iguana seems to be a NodeJS application it should be easy to add Ledger support to Iguana and Agama using this API.

[pbca26]

@lenondupe Thanks for suggestion. I'm aware of it.
I haven't played with Ledger before. How does it send transactions? Do they have an interface for that? Where do those transactions go? I assume to Ledger specific end points/servers?

So the Ledger does not send the transaction, that's the responsibility of the companion wallet application. The Ledger device is purely for signing your transaction, because it alone knows the secret key. The idea is that the wallet (iguana/agama) prepares the transaction and just hands it off to the device to be signed. Once the user approves the transaction by pressing the buttons on the device, it sends the signature back. Then you just set the signature on the transaction and post it to your own network. Super easy!

[pbca26]

Are you saying it's possible to send/receive data between js app and ledger firmware?

Exactly. The NodeJS API I linked is a communication library for the device app.

So the application flow would be something like this:

1. You have a separate button on the sign in page that let's you use the Ledger device. Something like 'Sign in with Ledger'. You can check the device connection with the NodeJS API. You can have a callback or something that gets called once the API detects the device is connected and the Komodo app openened. The callback enables the button in the UI and the user is able to click it.
2. Once the user clicks the sign in button you make another call to the device asking it for the public keys. You get back the public keys and query the network for account information, etc.
3. When there is something to sign you prepare the transaction and send it to the device. You wait for it to return the signature and sign your transaction.

I developed the Ledger integration for Stellar. You can see my NodeJS API for that app here: https://github.com/lenondupe/stellar-ledger-api/

[pbca26]

https://github.com/lenondupe/stellar-ledger-api/blob/master/src/stellar-ledger-api.js

[pbca26]

could you explain where do i get all those hex values? Is it described somewhere in docs or reference materials?

So in your case you would need this one because it is for the blue-app-btc which supports Komodo: https://github.com/LedgerHQ/ledger-node-js-api/blob/master/src/ledger-btc.js

It's not necessary to dive in deep and understand the device communication logic exactly although if you need it I can give you some hints. You should just be able to use the above library as a black box.

[pbca26]

Thanks a lot. I will definitely look into that.

[CHMEX]

Thank you both! It would be a very nice solution.
Michael

[Zeehenk]

Would be great of this could be solved!

[pbca26]

@lenondupe i have a question about creating and signing a tx. createPaymentTransactionNew_async doesn't have any output values in args list, only output script. How can I specify output amount? I assume I need to write something similar to yours signTx_async ?

@pbca26 TBH I have no idea, sorry. I'm not familiar with Bitcoin transactions. The code looks a lot more complicated than what I had to do. Best way to get help on that is ask on their slack channel: https://ledger-dev.slack.com/ They are usually quite responsive.

[pbca26]

@lenondupe thanks will try to get an invite there.
Another question how do I run the code in browser mode? Compile through browserify?

@pbca26 Yes, there is something about that in the README, but it's not complete.
Couple of things: 1) you need to serve the page over https 2) you need a u2f supporting browser (Chrome or Opera) 3) you need to enable browser support on the Ledger app itself by going to Settings > Browser support.

I found this: https://gist.github.com/dergachev/7028596 to be very helpful. For instance run that in the node-js-api project directory and open https://localhost:4443/test/index.html

@pbca26 Also if you fail to get an invite let me know. I'll ask them to add your email.