Encrypt PIN with MicroSD card
Encrypting your PIN with a microSD card
Encrypting your PIN using a microSD card provides extra protection against physical attacks on the Trezor Model T and Trezor Safe 5. When enabled, a randomly generated secret is stored on the microSD card.
When checking your PIN or using your PIN to unlock your Trezor, this secret is combined with the PIN to decrypt data stored on the device. Simply put, the device gets bound to the microSD card and cannot be unlocked without it until you intentionally disable the feature or factory reset your device.
If you need to perform a factory reset, please consult the relevant guide:
If you are concerned about physical attacks, you can remove the SD card whenever the device is not in use and keep the two in separate locations. One without the other is worthless to an attacker because the SD card secret is an entirely random value that carries no information about the seed or passphrase.
Activating and using SD protection
To enable this feature, you will need:
- trezorctl version 0.11.6 or later
- A FAT32-formatted microSD card
If the card is not properly formatted, Trezor will offer to erase and format the card for you.
There are three commands related to SD protection:
trezorctl device sd-protect on
trezorctl device sd-protect off
trezorctl device sd-protect refresh
The refresh command replaces the current SD card secret with a new one. This is useful if you inserted the SD card into a malware-infected computer and are worried that the secret stored on the card may have been compromised.
Connect your device and insert the MicroSD card into the card slot
The MicroSD card should be inserted with pins facing you on the left-hand side.
Using the command line to enable the SD protection
Use the command:
trezorctl device sd-protect on
Follow the on-screen instructions:
Congratulations! Your device is now bound to the secret on the microSD card. You will need insert the card into the device to use your PIN.
The SD card is required to enable the feature, and then every time you wish to unlock the device.