Objectives
- Create a seedkey for a bitcoin wallet in a safe environment without any internet connection or storage device.
- The seedkey will be only stored in a paper.
- The seedkey also has passphrase that works as a extra word. That it will be stored in a different paper from the seedkey.
- Both the seedkey and the passphrase will have extra backups. This means, that they will be written in more than one paper.
- The papers with the seedkey and the papers with the passphrase will be stored in different locations, protected from fire and water.
- From this wallet it will be created an watch only wallet, removing all the private keys.
- The watch only wallet it will be online and can receive funds. But can't send any, since doesn't contains private keys to sign any transactions.
Booting Tails
You can use Tails to create a bitcoin seed in cold storage.
This seed will be created in a machine with no connection to the internet.
In this guide I use a virtual machine, but you can use a real machine running Tails in a DVD.
Before booting Tails do the following:
- Disconnect every device connected to your computer, leaving only the mouse. (e.g: printer, external hard drive, usb sticks and etc...).
- Remove the battery if the computes has one.
- Disconnect the computer (without battery in case there is one) and wait 15 minutes.
Now put the DVD with tails and power up the machine and boot from tails.
This is the process you will do every time you use Tails to create a bitcoin seed in cold storage.
Getting Tails
To get Tails you got to the website https://tails.boum.org/index.en.html at https://tails.boum.org/install/index.en.html
Download a DVD ISO and verify the PGP signature.
You have a guide that helps you to verify the PGP signature https://tails.boum.org/install/dvd-download/index.en.html#install-inc-steps-download.inline.basic-openpgp
And this is a very important step. You need to know that your Tails software isn't compromised.
The guide covers the PGP signature verification in Windows, Linux and MacOS.
Bellow is the verification under Linux using the terminal.
You can see that there is a warning!
That happens because I didn't sign the PGP key with my own PGP key.
But still it 's possible the see that the PGP fingerprint "05469FB85EAD6589B43D41D3D21DAD38AF281C0B" in the website:
gpg: Signature made 2020-06-29T15:13:11 UTC
gpg: using RSA key 05469FB85EAD6589B43D41D3D21DAD38AF281C0B
gpg: Good signature from "Tails developers (offline long-term identity key) <[email protected]>" [full]
gpg: aka "Tails developers <[email protected]>" [full]Matches the one in my terminal!
Like a I said I will use a virtual machine instead a real machine.
I will create one with VirtualBox https://www.virtualbox.org/
I choose type Linux and as version Other Linux (64-bit).
I choose any hard drive size, since later I did remove it.
This is my virtual machine settings.
!!Warning!!
Make sure that you disabled Shared Clipboard.
!!Notice!!
The network adapter is disabled.
No hard disk on this machine, only the DVD in IDE Primary Master drive.
In a real machine do the procedure that I mentioned in beginning of this article!
In the virtual machine just start it.
Tails already has Electrum wallet.
No data will be recorded.
First lets create a 12 word seedkey with passphrase.
This is your seedkey.
!!Warning!!
No data will be stored on this setup.
So you need to write the seedkey on more than one paper and store them in different locations.
This will allow the use the passphrase. That in fact is like a 13 word of the seedkey.
Click Next after ticking the box for extending the seed.
Choose at least a 32 chars or even more than one word with high entropy.
!!Warning!!
Once again, no data it will be stored.
Write that passphrase in more than one paper.
Don't use the same paper that you wrote the seedkey.
And don't store the paper with the seedkey and the one with passphrase in the same location.
Confirm the seed.
Confirm the passphrase.
Now choose the password for the wallet.
Notice that in fact this it won't do nothing, since you aren't recording any data.
And this is Electrum wallet.
Now to send funds to the addresses controlled by the private keys, you need to access the public keys that will allow to create addresses.
This string is your master public key.
And this is its QR Code.
Take a picture of it with your phone and store the picture.
Scan the QR code with QR code scanner and store the string in a txt file on it.
To explain what you just did I will use the following diagrams.
You created a seedkey. This seedkey generates a set of private keys that can sign transactions and send your funds.
This seedkey also generates the public keys and the addresses of your wallet.
A master public key is a wallet without private keys.
So you only can generate addresses and transactions from those addresses.
But since you don't have any private key, you can sign any transactions.
And this is called a watch only wallet.
No I will use Electrum wallet to create a 24 word seed with passphrase.
This requires the use of the terminal.
Use
$ electrum make_seed --nbits=256 --segwit
for a segwit wallet
This is your seedkey.
!!Warning!!!
No data will be stored on this setup.
So you need to write the seedkey on more than one paper and store them in different locations.
Tails has a text editor.
Copy the seed to it!
No lets launch Electrum wallet again.
Lets create a new wallet.
With a name that matches our purposes.
We already have a seed.
So just paste it.
We also want add a passphrase. This will work as a 25 word of the seedkey.
Once again use at last 32 chars with high entropy. You can use more than one word, also.
Choose a password! Once again no data will be stored in this setup.
And now you just do what you did in the 12 word example to access the master pub key.
Receive funds
To receive funds we create a watch only wallet.
This watch only wallet is the master pub key.
You toke a picture of the QR code of it and store the text string in your phone.
As watch only wallet you can use different type of softwares like
Sentinel https://samouraiwallet.com/download/sentinel
Electrum https://electrum.org/#home
You just need to put the master pub key in this software.
I will show it is done on Electrum.
Launch Electrum and choose a name for this watch only wallet.
I will use a master public key.
This master public keys is censored since all the others private keys in this guide don't hold any funds.
But this one, belong to a private key that hodls funds.
Summary
Using Tails on DVD with no data storage or internet connection, we created a seedkey with a passphrase.
The seedkey was written in a paper. And the passphrase was also written in another paper.
Both papers were stored in different locations.
In this way no one can move your funds without having the seedkey and the passphrase.
Removing all the private keys from the wallet it is possible to create a watch only wallet.
This wallet it will be online and can receive funds but can't sign any transactions, since this wallet don't have any private keys on it.
Donations
Bitcoin base layer:
Bitcoin lightning network:
