What setup are you using for your air gap machine? Did you buy specific hardware, or some old pc laying around? If reusing some of your old hardware did you wipe it before using it again?
Im looking for a cheap solution. I also read that it is possible to use a hardware wallet to create your cold keys. Any experiences with this? And how would you technically do this?
The way that I choose is to use a live USB with Tails OS and a persistent encrypted storage. Once Tails OS is installed, you can decide to boot it without network connection or as they call it "Offline mode". Tails also supports OpenPGP, so if you want to be extra secure and encrypt your keys/recovery phrases with a YubiKey or something similar you can do it.
The only hardware that you need are 2 USBs with at least 8GB, one for main usage and one for backups.
If you need help on setting up this solution just let me know, I am here to help.
Edit: If anyone is interested, I've created a guide on setting up this solution, you can find it here. If you have any improvements just let me know, I will be happy to make it better over time :-)
This topic deserves an in-depth guide, which I will begin working on and will link to it as soon as I complete it. For now, I hope the following gives a high level overview of what I use: an ultra-paranoid, pain-in-the-ass, peace-of-mind setup for key storage and transaction signing
Note: Physical access to the machine is kept under strictly authorized access only. If done correctly, the only way to compromise this setup's security is through unauthorized physical access. Any such access will therefore be considered catastrophic, so keep the machine hidden and secure!
Step 1: Acquire an old/used laptop and REMOVE the wifi card. This will require unscrewing the back cover and performing a little surgery, but this way there can be no question about wireless attacks.
Step 2: Download the latest Ubuntu Server LTS and flash it onto a USB stick. I also recommend downloading and re-flashing the BIOS for the machine. This is to rid the machine of any (potential) rootkit/BIOS level malicious software. Be careful with this step; doing it improperly can brick the computer.
Note: ALWAYS verify your downloads through PGP and/or SHA checksums.
Step 3: During Ubuntu installation, choose the minimal installation and select full disk encryption. When selecting the password, I recommend a salted static yubikey OTP. You can then use the same salt as the sudo password for the OS.
Step 4: Establish a one-time network connection using an ethernet/USB port to download all necessary software. This will be the one and only time the machine will be exposed to the internet, prior to any key generation.
Step 5: Download all necessary software: ubuntu updates, git, cardano-cli, cardano-wallet (optional, but recommended if you want to generate mnemonic-style keys). qrencode is also highly recommended. If building from source, you'll also need all prerequisite software like git and such. Depending on the machine's specs you may want to install pre-compiled cardano binaries instead of building from source.
Step 6: Terminate the network connection and (for peace of mind) disable all networking interfaces in the OS and/or BIOS. Never connect to any network again.
You are now ready to generate keys with cardano-cli. Once this is done, there are two options for inputting transaction bodies for signing:
For outputting signed transaction bodies, use qrencode to generate qr images in the command line, and use a phone camera to extract the image contents. If the signed tx body is too large to fit into a single qr image, use the split command to break up the file into multiple smaller files and QR each file sequentially.
Note: ALWAYS backup any keys generated on another secure USB drive and/or a paper wallet.
I will expand on this guide on github and will link to it as soon as I feel it is ready. Hope this helps for now!
