Objectives
- What we have done so far?
- A bit more about seedkeys and passphrases.
- What is a signer?
- Create a transaction.
- Sign a transaction.
- Broadcast the transaction.
What we have done so far?
In the guide Creating a bitcoin cold storage wallet just using Tails on a CD Rom it was a created a setup to generate seedkeys with passphrases.
This setup can run in a real machine or in a virtual machine using Tails OS.
Using Tails you always have to read the security considerations.
In the case of virtual machines,
https://tails.boum.org/doc/advanced_topics/virtualization/index.en.html#index1h1
- Running Tails inside a virtual machine has various security implications. Depending on the host operating system and your security needs, running Tails in a virtual machine might be dangerous.
- Only run Tails in a virtual machine if both the host operating system and the virtualization software are trustworthy.
- Only run Tails in a virtual machine if leaving traces on the hard disk is not a concern for you.
More:
https://tails.boum.org/doc/index.en.html
https://tails.boum.org/doc/advanced_topics/index.en.html
Personally I only use virtual machines for testing purposes, small amounts or any emergency that a I need a seedkey real fast.
For other stuff I use a real machine.
A bit more about seedkeys and passphrases.
In the previous article we created a seedkey and add to it an extra word that is a passphrase. In the 12 words the passphrase is the 13rd word. And in 24 words the passphrase is the 25nd word.
But there is a lot more about this. To see some features let's use https://iancoleman.io/bip39/ just for testing purposes.
In there generate this BIP 39 seedkey with 12 words
immense volcano curious grace twenty frame scrap rapid cannon extend maze goat
That has the following BIP 32 root key
xprv9s21ZrQH143K4U1atV7GoU5saqW2z1vC9Fhop6BQiGnSveo6QSUmabLMTeESoy6xMs1YxhnCYKfcSYmzWNghKhqknz65biWVdJT9QUY7bEw
Now lets add the following passphrase
Pirouettedsen8Te0n5cing4E9XPlicAtio1nsInstIt8uteDef8lEc4tiO3n1s554
We can see that the BIP32 root key changed
xprv9s21ZrQH143K4SGG44mwGXMc8SHNCQXFraUnX2ArFr9KnYUiSz4okBpFQyTuSJQkytwzbdQpboGxpSWGt2a4xdaTyYj3EdXMqzobqfFqh54
This means that this a total different wallet with a different BIP32 root key or master private key.
And using different passphrases we can create hidden wallets that can help your OPSEC.
Lets see an example:
Seedkey Wallet 1: love slab media orange panda flash month cluster afford indoor hungry basket
Passphrase Wallet 1: ACt9ual9lyExplA3inAb5leaDducin5gen5cl4osUr0esGiDdieR622
BIP 32 root key Wallet 1: xprv9s21ZrQH143K3qRE1rAG2wKuuHnsRk1YZAs635XyM144UyARVSdPtLZUBTfdCkAWP6oShn3vacYV4RLez2JZxKYfVLsFUgbeQfCpLo7DK7y
Seedkey Wallet 2: love slab media orange panda flash month cluster afford indoor hungry basket
Passphrase Wallet 2: W7e0sternshudsOns1perso3nif8I9Edp6ArACh0u0tesbUg0s1122
BIP 32 root key Wallet 2: xprv9s21ZrQH143K3Zr3j7ihMncpuRMCenKZcbDMmypTuSHGafjxTZDfJtZCG43cVFpCFjYaxe7zZj8P8iMjHzk8tLXrhrtHuAwaNg6WpEfp9nA
Seedkey Wallet 3: love slab media orange panda flash month cluster afford indoor hungry basket
Passphrase Wallet 3: desiR1abLePrenatAll7yIMpriNT6e8rsTATtL5esNoNsUSta3i2n3i9nG8352
BIP 32 root key Wallet 3: xprv9s21ZrQH143K49zPqX4Uv5L7SHe9HiX1adhfbTme3Yko9mxcDNpK2iQ8BBRQjGbTzkZzd8jDZCPySPfcY3GzKhFPMsaNADW2rbeuG7c7reC
In this way we created 3 different wallets from the original 12 words of the seedkey.
This can be used as defense from a physical attack! Even you get caught and forced to give your seedkey you can have same funds hidden just using different passphrases.
Read more about this in TREZOR wallet guide:
https://wiki.trezor.io/Passphrase
https://wiki.trezor.io/User_manual:Security_best_practices#Using_passphrase
https://blog.trezor.io/passphrase-the-ultimate-protection-for-your-accounts-3a311990925b
You have always to prevent online attacks and physical attacks.
And the best protection from physical attacks is first avoid that someone could get your seedkeys. And second even if they got them, make it hard to steel everything.
But always try to do the first one. Don't get anyone get them. If you are own bank you have to secure your own bank too.
What is a signer?
In the article Creating a bitcoin cold storage wallet just using Tails on a CD Rom the seedkey was created but not stored.
And to sign transactions you need to have the private keys (generated by the seedkey).
We can use that setup to sign transactions but isn't easy.
Since the seedkey is not stored, we have to import it to Electrum typing it every time we want to sign a transaction.
This is not practical! And also brings security problems, since we want to create our seed and passphrase and wrote them in different papers and store them very safe. Don't make sense to always move them around to sign transactions.
So to create a signer using Tails we need a storage device.
The storage device must be removable, like a USB thumb drive. And it must be encrypted.
And we will create this storage device using the Tails CD Rom from the previews guide.
Again I will show this in a virtual machine! And I will clone the machine.
But in a real machine this will be the same cd rom you used before booted in the same way before:
- Disconnect every device connected to your computer, leaving only the mouse. (e.g: printer, external hard drive, usb sticks and etc...).
- Remove the battery if the computes has one.
- Disconnect the computer (without battery in case there is one) and wait 15 minutes.
In the virtual machine I changed the shared clipboard to birectional.
This is less safe that using real machines. Because those machines will not share clipboard.
The machine will always be offline!
I will create a storage device to store my wallet.
In a real machine you will use a USB thumb drive.
And now we have the almost same setup from the previous guide, besides the shared clipboard and a storage device.
Booting Tails we have to select our keybard and time format.
But also click in the + button
And set a admin password.
Now we are ready to go!
Since we have a new storage device, we have to prepare it.
First we will format it with ext4 filesystem and encrypt it with LUKS.
Please don't forget the password you use to encrypt your storage device.
And use a strong password.
All data in the storage device will be lost after formating it.
To this operations you need administration access.
After formated and encrypted the storage device should be unlocked.
But after that, every time you boot tails and want to use the storage device you need to unlock it.
If the storage device is locked, on the right side it will show a locked lock. And you click the button with unlock symbol.
After unlocking the storage device, on the right side it will show an unlocked lock.
No close all the windows.
Open the file explorer.
And choose "Other Locations". Then you will see your encrypted storage device.
On the first time it should be empty.
Create a folder called Electrum, where you will store your Electrum wallets.
Now you create a wallet like we did the previous guide.
And after creating the wallet go to $HOME/.electrum folder. That is a hidden folder (starts with a dot).
You should find the wallet you just created.
Copy it to your encrypted storage device.
And this is it!
Now you have your seedkey with the passphrase that generates the private keys. This is your wallet and it is encrypted with the wallet password.
This wallet is stored in an encrypted device that also has another password.
Alternatives to shared clipboard, to real machines.
On real machines you can't share clipboards.
But you can use another USB thumb drive formatted with vfat filesystem to store the text files from the transactions between the online machine (generator/broadcaster) and the offline machine ( signer).
Never forget to use only vfat filesystem. Since on vfat fileysytem linux can't run executable files.
So any storage device that connect both the offline and online machine must be formatted in vfat filesystem.
You can also implement a system with 2 webcams, one in each machine. And in this way you can use QR codes instead of text files.
Create a transaction.
In the previous guide we created a watch only wallet in electrum.
And I said that this wallet could create transactions. But couldn't sign it since the watch only wallet has no private keys.
But since you now have the private keys stored in a encrypted device you can use the them to sign it on the offline machine running Tails.
Let's send a small amount of bitcoin to another wallet we have to test this setup.
Now we need to copy the transaction data to the clipboard using "Copy" or to a text file using "Export".
This last option should be used in real machines. The exported file it will be a text file that it will be saved in the vfat USB thumb drive.
After having the transaction data, we need to sign.
Let's go to our offline machine, where we have the private keys.
Sign a transaction.
On the machine offline running Tails with encrypted USB thumb drive we can sign the transaction.
In a virtual machine we send the transaction data to the clipboard and in the real machine we have it on the vfat USB thumb drive.
Lets load the transaction to the Electrum wallet.
In the virtual machine choose "Text" since the data is in the clipboard. In the real machine choose "File" since the data is in a text file.
After pasting it form the clipboard choose "Load transaction"
And there it is, the transaction data generated in the online machine. That we couldn't sign because we hadn't the private keys in there.
Choose "Sign"
Enter the password.
Now the transaction is signed!
And we need to go to the online machine a broadcast it. Only in this way the bitcoin nodes that our Electrum wallet is connected will receive the transaction and validate it.
In the virtual machine with shared clipboard choose "Copy". In a real machine choose "Export" and save the signed transaction as a text file.
Lets go to the online machine.
Broadcast the transaction.
On the online machine load the transaction from clipboard or from the text file in case you are in real machine.
And this case I am using virtual machines.
Confirm if everything is ok once more and broadcast it.
Now just wait to the transaction be mined it a block and the confirmations of it afterwords.
Remember that onchain transactions will be always slow!
Summary
In this article we saw how seedkeys with passphrases can be used to hide wallets.
We also used the previous guide to create an encrypted storage device that it will be connected to our Tails OS running in the a offline machine, to sign transactions. Creating in this way a signer, a offline machine that signs transactions keeping the private keys away from the internet (offline).
And finally we tested this setup.
Using cold storage in this way is much harder and slower than an hardware wallet. Where you sign and broadcast transactions just pressing buttons.
But it is a nice way to learn how cold storage works.
And also a alternative if you can't buy an hardware wallet.
It also can be used in case of a emergency, like if your hardware wallet is damaged, lost or stolen. Knowing how to deal with situations should be in your OPSEC.
