S ShieldSigner / build & use0.0.2-dev

TASK 06

Use smartcards

Choose storage or on-card signing, then verify the reader and card applet.

You need
  • Contact-capable card
  • UR2 reader configured
  • Working device; spare/test card
You’ll have

Card detection, applet identity and a verified store/load or public-export test.

Choose what the card should do

  • SeedKeeper stores secrets; loading one puts it in the Luckfox’s memory for host signing.
  • Satochip derives/signs on the card; the host still reviews the transaction and requests a signature.
  • This PCB has a contact socket and no NFC reader. Buy a contact-capable retail card, or a supported blank JavaCard for deliberate DIY provisioning.
SeedKeeper: storage →PIN-protected seeds/passphrases.Satochip: signing →On-card derivation and signatures.Blank JavaCard →Install an applet first.

Verify the reader before changing the card

  • Insert a spare card and inspect Tools → Smartcard Tools. Card presence/ATR only prove transport, not the right applet.
  • J601 is the Amphenol 7312P0225A13LF contact socket. Only SEC1210 SC1 is wired; UR2 may enumerate another empty slot.
  • If no card is detected, check seating and the UR2/UART configuration before installing applets or guessing PINs.
Python / PCSCApplet commands
SEC1210 UR2Card electrical interface
J601 + cardContact socket
Socket contacts & Linux stack ↗Reader bring-up ↗

Follow the workflow for your card

  • Select a card type below. Use disposable test secrets; the checklist is not a verification of the card or prototype.

SeedKeeper · store and load

Use a contact card with SeedKeeper already installed. Host signing happens after the secret is loaded.

  1. Enable smartcard support under Settings → Advanced and inspect Card Info in Tools → Smartcard Tools → SeedKeeper Functions → Card Settings.
  2. Create/load a disposable seed. In Seed Options select Backup seed → To SeedKeeper; enter or set the card PIN and choose a label.
  3. Wait for Secret Saved. Return to Seeds → Load a seed → From SeedKeeper and select that secret.
  4. Compare the loaded fingerprint with the original. Keep an independent verified backup; a PIN cannot restore a lost card.
Upstream walkthrough with screenshots ↗

Check the result and keep a recovery copy

  • After loading a SeedKeeper secret, compare its fingerprint. For Satochip, compare the card’s master fingerprint/public export with the intended seed.
  • A wrong fingerprint is a reason to stop and check setup, not to overwrite the card.
  • Keep PINs, management keys and wallet backups offline. Do not reset a card containing a seed as a transport diagnostic.
Compatibility and applet versions ↗
Sources & deeper reference

Checked 12 October 2026. Menu names can vary with firmware.

SeedKeeper instructions ↗Satochip instructions ↗Edit this workflow on GitHub ↗