S ShieldSigner / build & use0.0.2-dev

TASK 06

Use smartcards

Choose storage or on-card signing, then verify the reader and card applet.

You need
  • Contact-capable card
  • UR2 reader configured
  • Working device; spare/test card
You’ll have

Card detection, applet identity and a verified store/load or public-export test.

Choose what the card should do

  • SeedKeeper stores secrets; loading one puts it in the Luckfox’s memory for host signing.
  • Satochip derives/signs on the card; the host still reviews the transaction and requests a signature.
  • This PCB has a contact socket and no NFC reader. Buy a contact-capable retail card, or a supported blank JavaCard for deliberate DIY provisioning.
SeedKeeper: storage →PIN-protected seeds/passphrases.Satochip: signing →On-card derivation and signatures.Blank JavaCard →Install an applet first.

Verify the reader before changing the card

  • Insert a spare card and inspect Tools → Smartcard Tools. Card presence/ATR only prove transport, not the right applet.
  • J601 is the Amphenol 7312P0225A13LF contact socket. Only SEC1210 SC1 is wired; UR2 may enumerate another empty slot.
  • If no card is detected, check seating and the UR2/UART configuration before installing applets or guessing PINs.
Python / PCSCApplet commands
SEC1210 UR2Card electrical interface
J601 + cardContact socket
Socket contacts & Linux stack ↗Reader bring-up ↗

Follow the workflow for your card

  • Select a card type below. Use disposable test secrets; the checklist is not a verification of the card or prototype.

DIY JavaCard · install an applet

A blank card is not yet a SeedKeeper or Satochip. Use a supported contact JavaCard with known management keys.

  1. Verify reader transport with a known-good card first. Use a separate blank/test card for provisioning; the custom carrier has not passed bench tests yet.
  2. Open Tools → Smartcard Tools → DIY Tools → Install Applet. For storage choose SeedKeeper-0.2-official.cap; the usual initial storage choice is 8 KB. For signing choose the pinned SatoChip-0.12-official.cap.
  3. After installation inspect Card Info for the expected applet/protocol version. Set the applet PIN when its first operation prompts you.
  4. Continue with the SeedKeeper or Satochip workflow. GlobalPlatform management keys, applet PIN and wallet keys are different credentials.
Upstream walkthrough with screenshots ↗

Check the result and keep a recovery copy

  • After loading a SeedKeeper secret, compare its fingerprint. For Satochip, compare the card’s master fingerprint/public export with the intended seed.
  • A wrong fingerprint is a reason to stop and check setup, not to overwrite the card.
  • Keep PINs, management keys and wallet backups offline. Do not reset a card containing a seed as a transport diagnostic.
Compatibility and applet versions ↗
Sources & deeper reference

Checked 12 October 2026. Menu names can vary with firmware.

SeedKeeper instructions ↗Satochip instructions ↗Edit this workflow on GitHub ↗