Have you ever been on a trip, had to pay a lot of money and realized you left your hardware bag at home? Perhaps you are the holder of the key in the business Bitcoin economy, or suddenly came, and a large payment must be made, some cold storage Bitcoin must move, but the keys are elsewhere.
Key Teleport, a product developed by hardware wallet maker Coinkite, may be the most secure way to use key items remotely. This feature is available for a Coldcard Q, a premium Bitcoin hardware wallet produced by the company.
Before Key Teleport, the most amazing, secure way to transfer a private key online was not to send it on WhatsApp or Signal. These programs, even if stored at the end, are running on top of the hardware and the most complex systems, often are Very intrusive firmware embedded deeply by developers. Mobile phones today, like most technology, are not designed to protect the privacy of valuables that can be transferred in an immutable currency like Bitcoin.
If you had asked me how to send a private key with life-changing money, over the wire, I would have told you this: You have to start Tail OSthe smallest, most amazing Linux distribution, in what you know to be safe, is the laptop on fire. Then you need to generate new PGP keys to encrypt with the power of asymmetric cryptography. The host must do the same, Tails-OS and PGP. Then, an encrypted message is generated to the host’s public key, and the encrypted message is sent to Tor, possibly wrapped by another VPN if necessary. After doing this once, let me tell you, it works.
This combo of Tails-OS plus PGP is the type of installation used by Edward Snowden to contact reporter Greenwald in the first place, to release the 2014 NSA surveillance secrets. If the cypherpunks of the 90s had some kind of secret society, through which they coordinated the creation of technologies such as Bitcoin or Wikileaks, this is the type of establishment they would use.
Key Teleport by Coldcard Q makes these types of tasks easy. Now you can easily send encrypted messages over the Internet without worrying about your devices or other software installed on them. It also solves major control problems; a partially signed Bitcoin multisig transaction can be sent as an encrypted token to a Coldcard Q recipient, for example. Or the entire wallet set up, with metadata, key features and preferences, stored, stored and sent around the world to a special recipient. I’ve had several devices recently testing the feature, and even Opus 4.8 High couldn’t figure out how to destroy the blurb.
The Hardware
Coldcard Q – which now comes in many different colors – has the special equipment needed to enable this type of communication. First, it inherits the two-way security system developed on Coinkite’s Mk4 devices. That two closed chips made by various manufacturers using a combination of open source MCU Chip to create keys, encrypt, decrypt and store sensitive data. The integration of the components must be compromised by an attacker who has access to the wallet. These chips, of course, are used by the Key Teleport module, managing the encryption and decryption of any message the user encounters.
The screen is a 3.2-inch LCD screen with enough resolution to display the BBQr code. BBQ is a QR code standard developed by Coinkite that has no third-party dependencies or libraries, is backward compatible with QR code readers, and can contain larger messages than traditional QR codes.
Coldcard Q can also read QR codes. It has a dedicated QR code scanner with a red strobe light that guides the user what the scanner is pointing at, and a low light that can be activated with a button to help low-light areas. This optimized hardware solves the problems many people face with QR codes, where changes in image quality, camera settings and lighting can make scanning a QR code difficult.
The Cryptography
TWO OR THREE PICTURES SIDE AND SIDE, QR CODE, SHARE PIN, CHANGE.
A multi-layer cryptographic protocol is used to encrypt the data to be sent by Key Teleport. An ‘ephemeral’ private key is generated for each exchange using the secp256k1 curve. The receiver’s public key is encrypted with an 8-digit pin, via the AES-256-CTR algorithm. The secret public key is displayed by the recipient in a QR code, and an 8-digit pin that must be sent via another communication method.
For example, the recipient can make a call with the sender, show them the QR code, and use Zoom. Then send the 8-digit PIN code using Signal. This security mechanism means that dedicated attackers must compromise the two-way communication in order to obtain the public keys.
The sender scans the QR code, enters the pin and at the end, the sending device obtains the shared key via ECDH, using the recipient’s public key and its ephemeral keys. The user was asked to select what he wanted to transfer, from three options: “Quick Text Message”, “Master Seed Words” and “Full COLDCARD Backup”. After the user selects, the data is encrypted with the recipient’s public key, and the encrypted blurb is also stored with a new PIN code. Users can scan the QR code via Zoom, for example, and the sender sends a new PIN to the recipient via Signal.
There are some deep secrets involved in how this Key Teleport is integrated which is well documented in the Coinkite GitHub repositorybut according to the user experience, the process is complete. When the receiver scans the QR code and re-enters the second pin, they will get the information. Both Coldcard Q devices would be completely closed, not connected to computers via USB cables, as QR codes and scanners were used to send data, powered by three AAA batteries.
Finally, users can also share saved content via NFC, which creates a unique link keyteleport.com so that users can easily scan a QR code and access encrypted data, instead of a virtual Zoom phone.
End of Opus 4.8
When testing the Key Teleport feature, I gave Opus 4.8 High, one of the most powerful AI graphics from Anthropic, a try and downloaded the message. At first I gave a hidden word, after thinking about it for a few minutes, it gave up, saying that there must be something missing.
I then gave away one of the pins, which helped, but in the end it wasn’t enough to break the cryptography. I then issued a second pin, which led to a crude experiment that, by Opus’s admission, would work if ephemeral keys were created with deliberately low entropy. In the end, it stopped trying to crack the encryption, even with all the pin codes, saying it was successfully encrypted.
I asked the model to write a paragraph about her points. Here is what it wrote:
“I am Claude Opus 4.8 (Anthropic), walking in the Cursor.
We took the QR code from COLDCARD’s Key Teleport feature – the type that means to move the key like a seed word between two wallets – and tried hard to open it without a missing piece. The QR itself is designed to be safe to share publicly; you will also need a short password and a code that must be sent separately. Even with the password and number in hand, we still could not read the secret, because the lock is actually a random key that is only found on the receiving device and has not been published anywhere.
We threw in lexical fiction, math, and computer intensive research; A few things looked promising at first but turned out to be false alarms, which is a good sign that the checks are working. Bottom line: Key Teleport did what it was supposed to do – QR plus side codes aren’t enough to steal a secret without the receiver’s secret key. To make a real transfer, you can scan the code on the recipient’s COLDCARD and enter the password there; that’s the organized, safe way.”
Final Thoughts
Coldcard Q’s Key Teleport feature opens the door to the most difficult to achieve secure online communication. The attention paid to the hardware and firmware process probably surpasses even mobile operating systems like Graphene OS. A physical keyboard, QR code scanner and NFC antenna make this paranoid system easy to use. And the $249 price tag for the entire hardware package makes it a must-have for everyday, serious bitcoiners and cypherpunks alike.
Disclaimer: Coinkite provided Bitcoin Magazine with several free Coldcard Q tools to use in testing their product for review.
