Ledger Hardware Wallet Documentation Monero Previous page: Ledger Hardware Wallet Index page: Documentation Next page: Monero Trezor Hardware Wallet

Introduction

Trezor is a hardware cryptocurrency wallet created by SatoshiLabs. Its firmware and PCB design are open source. Its client software source code is source-available, but under a restrictive license.

Trezor Safe 3 and Safe 5 incorporate a secure element known as OPTIGA Trust M (V3) ^[1]; although its documentation is source-available, its internal state remains proprietary.

Trezor 7 employs a dual‑secure‑element architecture: one element is the Optiga Trust M, while the other is the TROPIC01, an auditable secure element with open source circuit design and firmware. According to Trezor, each secure element contributes a portion of the secret, and together they form the final key used for seed decryption ^[2].

Installation

Platform specific.

Kicksecure: No special notice.
Kicksecure for Qubes: In the kicksecure-18 Template.

sudo adduser user plugdev

^[3]

Install package(s) trezor python3-hid following these instructions:

Platform specific notice.

Kicksecure: No special notice.
Kicksecure-Qubes: In Template.

Update the package lists and upgrade the system.

sudo apt update && sudo apt full-upgrade

Install the trezor python3-hid package(s).

Using apt command line --no-install-recommends option is in most cases optional.

sudo apt install --no-install-recommends trezor python3-hid

Platform specific notice.

Kicksecure: No special notice.
Kicksecure-Qubes: Shut down Template and restart App Qubes based on it as per Qubes Template Modification.

Done.

The procedure of installing package(s) trezor python3-hid is complete.

Signing Key Download

Platform specific.

Kicksecure: No special notice.
Kicksecure for Qubes: In the kicksecure App Qube.

Digital signatures are a tool enhancing download security. They are commonly used across the internet and nothing special to worry about.
Optional, not required: Digital signatures are optional and not mandatory for using Kicksecure, but an extra security measure for advanced users. If you've never used them before, it might be overwhelming to look into them at this stage. Just ignore them for now.
Learn more: Curious? If you are interested in becoming more familiar with advanced computer security concepts, you can learn more about digital signatures here: Verifying Software Signatures

Securely download the signing key.

scurl-download https://trezor.io/security/satoshilabs-2021-signing-key.asc

Display the key's fingerprint.

gpg --keyid-format long --import --import-options show-only --with-fingerprint satoshilabs-2021-signing-key.asc

Verify the fingerprint. It should show.

Note: Key fingerprints provided on the Kicksecure website are for convenience only. The Kicksecure project does not have the authorization or the resources to function as a certificate authority, and therefore cannot verify the identity or authenticity of key fingerprints. The ultimate responsibility for verifying the authenticity of the key fingerprint and correctness of the verification instructions rests with the user.

Key fingerprint = EB48 3B26 B078 A4AA 1B6F 425E E21B 6950 A2EC B65C

The most important check is confirming the key fingerprint exactly matches the output above. ^[4]

Warning:

Do not continue if the fingerprint does not match! This risks using infected or erroneous files! The whole point of verification is to confirm file integrity.

Add the signing key.

gpg --import satoshilabs-2021-signing-key.asc

Download

Platform specific.

Kicksecure: No special notice.
Kicksecure for Qubes: In the kicksecure App Qube.

Check the latest version number and read the release notes on the Trezor Suite website.

Download the Trezor Suite AppImage.

scurl-download https://suite.trezor.io/web/static/desktop/Trezor-Suite-21.10.2-linux-x86_64.AppImage

Download the OpenPGP signature.

scurl-download https://suite.trezor.io/web/static/desktop/Trezor-Suite-21.10.2-linux-x86_64.AppImage.asc

Digital Software Signature Verification

Platform specific.

Kicksecure: No special notice.
Kicksecure for Qubes: In the kicksecure App Qube.

Verify the OpenPGP signature.

gpg --verify Trezor-Suite-21.10.2-linux-x86_64.AppImage.asc

If the file is verified successfully, the output will include Good signature, which is the most important thing to check.

gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.

This message does not alter the validity of the signature related to the downloaded key. Rather, this warning refers to the level of trust placed in the Kicksecure signing key and the web of trust. To remove this warning, the Kicksecure signing key must be personally signed with your own key.

Make Executable

Platform specific.

Kicksecure: No special notice.
Kicksecure for Qubes: In the kicksecure App Qube.

Make the file Trezor-Suite-21.10.2-linux-x86_64.AppImage executable.

chmod +x Trezor-Suite-21.10.2-linux-x86_64.AppImage

Usage

Platform specific.

Kicksecure: No special notice.
Kicksecure for Qubes: In the kicksecure App Qube.

Run the following command to start Trezor Suite.

./Trezor-Suite-21.10.2-linux-x86_64.AppImage

Qubes Issues

Symptom:

kernel: vhci_hcd: vhci_device speed not set
kernel: usb usb1-port1: Cannot enable. Maybe the USB cable is bad

The official instructions by Trezor for Qubes OS reduce security because they require running third party software inside the USBVM.

Ideas:

A) Create another sys-usb with a USB controller exclusively attached to that App Qube. An HVM App Qube with PCI passthrough. And/or
B) Switch off sys-usb altogether, for example if the system has only one USB controller, and switch between using USBVM and not using USBVM. -> security issue https://github.com/QubesOS/qubes-issues/issues/6368

Use trezor in qubes VM without usb access

Neither the Trezor Suite nor Trezor Web Connect connect directly to the Trezor device. Instead, a helper called Trezor Bridge handles the usb connection, then opens an access service at 127.0.0.1:21325. Both Suite and Web Connect will access that service for USB communication. Using qvm‑connect‑tcp we can forward that port, letting the Trezor software—or any in‑browser wallet such as MetaMask—run inside a Qubes VM without needing direct USB access.

Since the Trezor Bridge service is just a webpage, we can run any number of wallets at the same time on one or multiple VMs.

Setting up Trezor Bridge service in sys-usb

At present, the Trezor Suite bundles the Trezor Bridge, allowing us to launch the bridge service via the Trezor Suite AppImage directly.

Copy Trezor Suite Appimage you just downloaded to sys-usb qube. qvm-copy Trezor*

Move Trezor Suite Appimage from QubesIncoming directory to home directory. In this scenario, it’s being sent from a VM named browser

mv /home/user/QubesIncoming/Trezor* ~

Make sure it is executable

chmod +x ~/Trezor*

Set up the systemd service

mkdir -p ~/.config/systemd/user touch ~/.config/systemd/user/trezor-bridge.service

Open the trezor-bridge.service systemd config file and paste

[Unit] Description=Trezor Suite Bridge daemon mode [Service] Type=simple WorkingDirectory=%h ExecStart=/home/user/Trezor-Suite.AppImage --bridge-daemon --disable-gpu Restart=on-failure RestartSec=3 [Install] WantedBy=default.target

Enable auto start.

systemctl --user enable --now trezor-bridge.service

Check the service

ss -tuple

If you see a program listening on port 21325, the Trezor Bridge service is running.

Footnotes

↑ Secure Elements in Trezor Safe devices
↑ https://trezor.io/guides/trezor-devices/trezor-safe-7/dual-secure-elements-in-trezor-safe-7
↑ Required, otherwise Trezor Suite will show the error "Trezor Bridge is not running". python3-hid may be superfluous in some use cases. The package trezor Recommends: it.
↑ Minor changes in the output such as new uids (email addresses) or newer expiration dates are inconsequential.

Ledger Hardware Wallet Documentation Monero Previous page: Ledger Hardware Wallet Index page: Documentation Next page: Monero

Kicksecure

A secure by default operating system with the latest security research in place.

Dark mode

Supported by Power Up Privacy

Kicksecure is proudly supported until 2026 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Kicksecure we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint

2012- 2026 ENCRYPTED SUPPORT LLC

Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 14 year success story and maybe DONATE!

[1] Secure Elements in Trezor Safe devices

[2] ttps://trezor.io/guides/trezor-devices/trezor-safe-7/dual-secure-elements-in-trezor-safe-7

[3] Required, otherwise Trezor Suite will show the error "Trezor Bridge is not running". python3-hid may be superfluous in some use cases. The package trezor Recommends: it.

[4] Minor changes in the output such as new uids (email addresses) or newer expiration dates are inconsequential.

[1]

[2]

[3]

[4]

Trezor Hardware Wallet

Contents

Introduction

Installation

Signing Key Download

Download

Digital Software Signature Verification

Make Executable

Usage

Qubes Issues

Use trezor in qubes VM without usb access

Setting up Trezor Bridge service in sys-usb

Footnotes

Navigation menu

Trezor Hardware Wallet

Introduction

Installation

Signing Key Download

Download

Digital Software Signature Verification

Make Executable

Usage

Qubes Issues

Use trezor in qubes VM without usb access

Setting up Trezor Bridge service in sys-usb

Footnotes

Navigation menu

Search