<h2>Secure Airgapping</h2>
<p>This topic deserves an in-depth guide, which I will begin working on and will link to it as soon as I complete it. For now, I hope the following gives a high level overview of what I use: <strong>an ultra-paranoid, pain-in-the-ass, peace-of-mind setup</strong> for key storage <em>and</em> transaction signing</p>
<p>Note: Physical access to the machine is kept under strictly authorized access only. If done correctly, the only way to compromise this setup's security is through unauthorized physical access. Any such access will therefore be considered catastrophic, so keep the machine hidden and secure!</p>
<hr />
<h4>The Setup</h4>
<p>Step 1: Acquire an old/used laptop and REMOVE the wifi card. This will require unscrewing the back cover and performing a little surgery, but this way there can be no question about wireless attacks.</p>
<p>Step 2: Download the latest Ubuntu Server LTS and flash it onto a USB stick. I also recommend downloading and re-flashing the BIOS for the machine. This is to rid the machine of any (potential) rootkit/BIOS level malicious software. Be careful with this step; doing it improperly can brick the computer.</p>
<p>Note: ALWAYS verify your downloads through PGP and/or SHA checksums.</p>
<p>Step 3: During Ubuntu installation, choose the minimal installation and select full disk encryption. When selecting the password, I recommend a salted <a href="https://resources.yubico.com/53ZDUYE6/as/9hccqgx9bwwqq96mhkk8jb4h/Static_Password_Function.pdf" rel="nofollow noreferrer">static yubikey OTP</a>. You can then use the same salt as the sudo password for the OS.</p>
<p>Step 4: Establish a one-time network connection using an ethernet/USB port to download all necessary software. This will be the one and only time the machine will be exposed to the internet, prior to any key generation.</p>
<p>Step 5: Download all necessary software: ubuntu updates, <code>git</code>, <code>cardano-cli</code>, <code>cardano-wallet</code> (optional, but recommended if you want to generate mnemonic-style keys). <a href="https://github.com/fukuchi/libqrencode" rel="nofollow noreferrer"><code>qrencode</code></a> is also highly recommended. If building from source, you'll also need all prerequisite software like <code>git</code> and such. Depending on the machine's specs you may want to install pre-compiled cardano binaries instead of building from source.</p>
<p>Step 6: Terminate the network connection and (for peace of mind) disable all networking interfaces in the OS and/or BIOS. Never connect to any network again.</p>
<hr />
<h4>Inputs and Outputs</h4>
<p>You are now ready to generate keys with cardano-cli. Once this is done, there are two options for inputting transaction bodies for signing:</p>
<ol>
<li>Use a hardware encrypted USB that has write-protection feature. I recommend the <a href="https://apricorn.com/aegis-secure-key-3nx" rel="nofollow noreferrer">Apricorn Aegis NX</a>. Draft transactions on a hot machine, transfer to the Aegis, turn on write protection, and plug into the airgapped machine. This way, even if a malicious payload finds its way into the airgapped machine, there would be no way to exfiltrate the data.</li>
<li>Manually enter the cborHex of the transaction body into the airgapped machine. Use a JSON template so all you have to do is manually type the cborHex. This is the biggest pain of the setup (if you choose to do this), but it makes the system truly airgapped.</li>
</ol>
<p>For outputting signed transaction bodies, use qrencode to generate qr images in the command line, and use a phone camera to extract the image contents. If the signed tx body is too large to fit into a single qr image, use the <code>split</code> command to break up the file into multiple smaller files and QR each file sequentially.</p>
<p>Note: ALWAYS backup any keys generated on another secure USB drive and/or a paper wallet.</p>
<hr />
<p>I will expand on this guide on github and will link to it as soon as I feel it is ready. Hope this helps for now!</p>

CC BY-SA 4.0
2021-12-12T15:45:40.343Z
2021-12-12T15:45:40.343Z
zhekson
<p>The way that I choose is to use a live USB with <a href="https://tails.boum.org/" rel="nofollow noreferrer">Tails OS</a> and a persistent encrypted storage.
Once Tails OS is installed, you can decide to boot it without network connection or as they call it &quot;Offline mode&quot;. Tails also supports OpenPGP, so if you want to be extra secure and encrypt your keys/recovery phrases with a YubiKey or something similar you can do it.</p>
<p>The only hardware that you need are 2 USBs with at least 8GB, one for main usage and one for backups.</p>
<p>If you need help on setting up this solution just let me know, I am here to help.</p>
<p>Edit:
If anyone is interested, I've created a guide on setting up this solution, you can find it <a href="https://github.com/Techs2Help/TailsOS_cold_storage" rel="nofollow noreferrer">here</a>.
If you have any improvements just let me know, I will be happy to make it better over time :-)</p>

CC BY-SA 4.0
2021-09-06T19:10:50.960Z
That sounds like a very interesting solution! on the backup, you just store your key files, right? or do you also install tails there?
Robin
CC BY-SA 4.0
2021-09-07T08:00:25.067Z
I wouldn't store my backups for private key/recovery phrases files in an unencrypted usb, so I have 2 solution for this, one to install Tails also on the secondary usb, the other one is to use an encrypted usb like [this one](https://datalocker.com/products/encrypted-usb-flash-drives/k350/). There are many of this usbs arround, but with the second solution costs go up. There is a really good [video](https://www.youtube.com/watch?v=fqrAzBAi64c) made by Charles Hoskinson where he explains how to store your private key/recovery phrases. I took inspiration from there.
Nic_T2H
CC BY-SA 4.0
2021-09-01T17:12:44.560Z
2022-10-12T14:04:40.847Z
2022-10-12T14:04:40.847Z
Nic_T2H
<p>What setup are you using for your air gap machine? Did you buy specific hardware, or some old pc laying around? If reusing some of your old hardware did you wipe it before using it again?</p>
<p>Im looking for a cheap solution. I also read that it is possible to use a hardware wallet to create your cold keys. Any experiences with this? And how would you technically do this?</p>

CC BY-SA 4.0
2021-08-31T17:34:18.623Z
I use a Chromebook with Arch for storing all kind of sensitive data, cheap and powerful enough to do the work gracefully
Aron Neewart
<stake-pool>
Best setup of your air-gapped offline machine (cold environment)?
# Best setup of your air-gapped offline machine (cold environment)?

(Asked by: username_0 on 2021-08-31)

What setup are you using for your air gap machine? Did you buy specific hardware, or some old pc laying around? If reusing some of your old hardware did you wipe it before using it again?

Im looking for a cheap solution. I also read that it is possible to use a hardware wallet to create your cold keys. Any experiences with this? And how would you technically do this?

**Tags:** stake-pool
> **Comments:**
> **username_1**: I use a Chromebook with Arch for storing all kind of sensitive data, cheap and powerful enough to do the work gracefully  

---

## 2 answers

### Answer by username_3 on 2021-09-01. Score: 4

The way that I choose is to use a live USB with [Tails OS](https://tails.boum.org/) and a persistent encrypted storage.
Once Tails OS is installed, you can decide to boot it without network connection or as they call it "Offline mode". Tails also supports OpenPGP, so if you want to be extra secure and encrypt your keys/recovery phrases with a YubiKey or something similar you can do it.

The only hardware that you need are 2 USBs with at least 8GB, one for main usage and one for backups.

If you need help on setting up this solution just let me know, I am here to help.

Edit:
If anyone is interested, I've created a guide on setting up this solution, you can find it [here](https://github.com/Techs2Help/TailsOS_cold_storage).
If you have any improvements just let me know, I will be happy to make it better over time :-)

> **Comments:**
> **username_0**: That sounds like a very interesting solution! on the backup, you just store your key files, right? or do you also install tails there?  
> **username_3**: I wouldn't store my backups for private key/recovery phrases files in an unencrypted usb, so I have 2 solution for this, one to install Tails also on the secondary usb, the other one is to use an encrypted usb like [this one](https://datalocker.com/products/encrypted-usb-flash-drives/k350/). There are many of this usbs arround, but with the second solution costs go up. There is a really good [video](https://www.youtube.com/watch?v=fqrAzBAi64c) made by Charles Hoskinson where he explains how to store your private key/recovery phrases. I took inspiration from there.  

---

### Answer by username_2 on 2021-12-12. Score: 0

## Secure Airgapping

This topic deserves an in-depth guide, which I will begin working on and will link to it as soon as I complete it. For now, I hope the following gives a high level overview of what I use: **an ultra-paranoid, pain-in-the-ass, peace-of-mind setup** for key storage *and* transaction signing

Note: Physical access to the machine is kept under strictly authorized access only. If done correctly, the only way to compromise this setup's security is through unauthorized physical access. Any such access will therefore be considered catastrophic, so keep the machine hidden and secure!

---

#### The Setup

Step 1: Acquire an old/used laptop and REMOVE the wifi card. This will require unscrewing the back cover and performing a little surgery, but this way there can be no question about wireless attacks.

Step 2: Download the latest Ubuntu Server LTS and flash it onto a USB stick. I also recommend downloading and re-flashing the BIOS for the machine. This is to rid the machine of any (potential) rootkit/BIOS level malicious software. Be careful with this step; doing it improperly can brick the computer.

Note: ALWAYS verify your downloads through PGP and/or SHA checksums.

Step 3: During Ubuntu installation, choose the minimal installation and select full disk encryption. When selecting the password, I recommend a salted [static yubikey OTP](https://resources.yubico.com/53ZDUYE6/as/9hccqgx9bwwqq96mhkk8jb4h/Static_Password_Function.pdf). You can then use the same salt as the sudo password for the OS.

Step 4: Establish a one-time network connection using an ethernet/USB port to download all necessary software. This will be the one and only time the machine will be exposed to the internet, prior to any key generation.

Step 5: Download all necessary software: ubuntu updates, `git`, `cardano-cli`, `cardano-wallet` (optional, but recommended if you want to generate mnemonic-style keys). [`qrencode`](https://github.com/fukuchi/libqrencode) is also highly recommended. If building from source, you'll also need all prerequisite software like `git` and such. Depending on the machine's specs you may want to install pre-compiled cardano binaries instead of building from source.

Step 6: Terminate the network connection and (for peace of mind) disable all networking interfaces in the OS and/or BIOS. Never connect to any network again.

---

#### Inputs and Outputs

You are now ready to generate keys with cardano-cli. Once this is done, there are two options for inputting transaction bodies for signing:

1. Use a hardware encrypted USB that has write-protection feature. I recommend the [Apricorn Aegis NX](https://apricorn.com/aegis-secure-key-3nx). Draft transactions on a hot machine, transfer to the Aegis, turn on write protection, and plug into the airgapped machine. This way, even if a malicious payload finds its way into the airgapped machine, there would be no way to exfiltrate the data.
2. Manually enter the cborHex of the transaction body into the airgapped machine. Use a JSON template so all you have to do is manually type the cborHex. This is the biggest pain of the setup (if you choose to do this), but it makes the system truly airgapped.

For outputting signed transaction bodies, use qrencode to generate qr images in the command line, and use a phone camera to extract the image contents. If the signed tx body is too large to fit into a single qr image, use the `split` command to break up the file into multiple smaller files and QR each file sequentially.

Note: ALWAYS backup any keys generated on another secure USB drive and/or a paper wallet.

---

I will expand on this guide on github and will link to it as soon as I feel it is ready. Hope this helps for now!


---

