This topic deserves an in-depth guide, which I will begin working on and will link to it as soon as I complete it. For now, I hope the following gives a high level overview of what I use: an ultra-paranoid, pain-in-the-ass, peace-of-mind setup for key storage and transaction signing
Note: Physical access to the machine is kept under strictly authorized access only. If done correctly, the only way to compromise this setup's security is through unauthorized physical access. Any such access will therefore be considered catastrophic, so keep the machine hidden and secure!
Step 1: Acquire an old/used laptop and REMOVE the wifi card. This will require unscrewing the back cover and performing a little surgery, but this way there can be no question about wireless attacks.
Step 2: Download the latest Ubuntu Server LTS and flash it onto a USB stick. I also recommend downloading and re-flashing the BIOS for the machine. This is to rid the machine of any (potential) rootkit/BIOS level malicious software. Be careful with this step; doing it improperly can brick the computer.
Note: ALWAYS verify your downloads through PGP and/or SHA checksums.
Step 3: During Ubuntu installation, choose the minimal installation and select full disk encryption. When selecting the password, I recommend a salted static yubikey OTP. You can then use the same salt as the sudo password for the OS.
Step 4: Establish a one-time network connection using an ethernet/USB port to download all necessary software. This will be the one and only time the machine will be exposed to the internet, prior to any key generation.
Step 5: Download all necessary software: ubuntu updates,
cardano-wallet (optional, but recommended if you want to generate mnemonic-style keys).
qrencode is also highly recommended. If building from source, you'll also need all prerequisite software like
git and such. Depending on the machine's specs you may want to install pre-compiled cardano binaries instead of building from source.
Step 6: Terminate the network connection and (for peace of mind) disable all networking interfaces in the OS and/or BIOS. Never connect to any network again.
Inputs and Outputs
You are now ready to generate keys with cardano-cli. Once this is done, there are two options for inputting transaction bodies for signing:
- Use a hardware encrypted USB that has write-protection feature. I recommend the Apricorn Aegis NX. Draft transactions on a hot machine, transfer to the Aegis, turn on write protection, and plug into the airgapped machine. This way, even if a malicious payload finds its way into the airgapped machine, there would be no way to exfiltrate the data.
- Manually enter the cborHex of the transaction body into the airgapped machine. Use a JSON template so all you have to do is manually type the cborHex. This is the biggest pain of the setup (if you choose to do this), but it makes the system truly airgapped.
For outputting signed transaction bodies, use qrencode to generate qr images in the command line, and use a phone camera to extract the image contents. If the signed tx body is too large to fit into a single qr image, use the
split command to break up the file into multiple smaller files and QR each file sequentially.
Note: ALWAYS backup any keys generated on another secure USB drive and/or a paper wallet.
I will expand on this guide on github and will link to it as soon as I feel it is ready. Hope this helps for now!