This is a guide for creating highly secure keys to use for cold storage, or more specifically in my case, to assign as the recovery authorities to Verus IDs. The goal is to generate a bulk batch of keys that have never been in a system that’s been online and come away with a copy of those keys and addresses on a pair of thumb drives (for redundancy) and the addresses (without keys) on another drive for monitoring and for reference to use those secure keys (to send to or for Verus ID authority assignments).
You will need: 4 USB drives, a computer running Linux (doable without, but that’s what these instructions are for), and optionally another computer. If you don’t have a Linux system handy but want to follow these directions, you can start by creating the boot media for the Linux live distribution, then booting into that environment, connecting to the internet, and following all of the instructions – just make sure to shut down and perform a cold boot to get back into the fresh environment (without internet) when it’s time for the secure system.
While I’ve tried to be as comprehensive as possible in my directions, it is assumed that you are somewhat familiar with the Linux command line.
Step 1: Selecting Media
Use only the best storage media. It doesn’t make sense to cheap-out to save a few bucks and risk your data. Cheap USB drives can be unreliable, and sadly you probably won’t discover the problem until you already need your backup.
The Samsung BAR Plus is the best drive I’ve encountered for any purpose. They have no moving housing parts to break, they are made of aluminum which not only makes them sturdy but also helps dissipate heat. They’re also incredibly fast, inexpensive, and very well (and thoroughly) reviewed.
For a redundant backup grab two of these or some other drive you trust for each key or set of keys you want to back up. We’ll call these USB drives 1 and 2.
You’ll also need to have two more drives handy. The first is for getting your key generation software onto the secure system you’ll be using and for storing the list of addresses you generate and getting them back to the computer you’re going to use to send funds from. The second is for creating the boot media for a secure, air-gapped system. We’ll call these USB drives 3 and 4, respectively.
Step 2: Preparing Media
For the sake of the integrity of the data we want to make sure the drives are good. No matter how good a particular model of drive is there can be duds. To be extra paranoid we also want to make sure there’s nothing unexpected (and malicious) on the drive when we take it to the air-gapped system for the real backup. We can do both of these at once using the badblocks command (Linux only, so far as I’m aware).
badblocks will write a series of patterns across the whole drive, then read it back and check to make sure there aren’t any bad blocks. In doing so it will also destroy any and all data on the drive (including the partition table, filesystems, and anything else). It’s possible you’d get a scrub more thorough and robust against recovery using another tool, but this will certainly make sure there’s nothing readable of substance left on the drive.
I recommend doing this on all three drives you’ll be using (drives 1, 2, and 3) – the two secure drives for the private keys, along with the drive for storing your addresses and getting your key generation software onto the secure computer.
Plug the drive in. If it auto-mounted unmount it. Make sure you know which drive it is – your file manager might tell you, or you can find out using the mount command before you unmount it, or run dmesg immediately after inserting it and look at the last bits of output about the insertion of the drive to find where it’s located. For the sake of these instructions we’ll assume it’s located at /dev/sde – but you MUST replace this with the actual path on your system if it differs.
The command you’ll run is:
sudo badblocks -w -s -o badblocks.log /dev/sdeThis will perform a destructive (-w for write) test, show progress as it goes (-s for show), and output (-o) a logfile called badblocks.log, acting on /dev/sde.
In my case, with two 32GB drives testing at once the test took about 2 hours.
When this is done there should be nothing meaningful on the drive. Do not partition or format drives 1 or 2 yet, wait until you’re on a more secure computer.
Step 3: Secure System
Now that you’ve got quality media tested and wiped clean you need a secure, air-gapped system on which you’ll finish preparing your media and generate your keys. My recommendation is TAILS, but you could use any live distribution so long as it doesn’t automatically mount the drives present in your computer (or so long as you’re using it on a computer with no drives connected).
Download whichever distro you’re going to use, make sure to verify its hash or signature, and follow the distro’s instructions for installing it on a USB drive to put it on USB drive 4.
Step 4: Prepare Tools
Download or prepare whatever tool you’re going to use to generate your keys. I’m creating keys for Verus, and I’ll be using the Verus vanity generator for simplicity and speed. Specifically, I wanted to generate CSV files of a large number of keys, which the vanity generator supports natively. Other options include the paper wallet generator (easy to use, though not well suited to generating large numbers of keys), the official Verus CLI wallet (a great option, and can create a straightforward export of keys, but requires getting the large set of Zcash key proving data onto the airgapped system to run, and requires at least one dependency to be installed on most systems), and I’m sure others – each come with their own requirements or limitations for this setup. Make sure to check signatures or hashes on anything you download.
To prepare the vanity generator, clone the repository to another system (such as the one you prepared your drives on) and build according to its instructions. You’ll need to have build tools installed, and any necessary libraries. In my case, on an older Ubuntu system that meant installing libcurl4-openssl-dev and libpcre3-dev on top of the other tools or dependencies I already had installed.
Once you’ve built the vanity generator (or prepared whatever option you’re going to use) you’ll partition and format USB drive 3 and copy your tools onto it. You’ll later use this drive to transport/store the list of addresses you’ll generate, so format with whatever filesystem you’d like to use when accessing that file.
Step 5: Boot Secure, Air-Gapped System
Gracefully unmount and remove USB drive 3 that contains your tools and disconnect your Ethernet connection if present (or move to another computer that is without a connection). Boot your secure system (TAILS in my case) from the USB drive. We want to generate the keys and addresses on a clean system that has never been online so when your system reboots don’t connect it to your WiFi or wired network.
In order to format thumb drives as I did in the next section you’ll need to make sure you have administrative/root access. To get this on TAILS you’ll have to set this up before logging in. When the system has finished starting up there’s a window to adjust settings before logging in. At the bottom under “Additional Settings” is a button with a plus sign. Click that. In the Additional Settings window select “Administrative Password”, and in the window that brings up set and confirm a password of your choice to use as the root password for this session.
Step 6: Prepare Drives
You should now have a clean, secure, air-gapped system that’s never been online.
Now that we’re here we need to prepare the drives you’ll be using to store your secure keys, USB drives 1 and 2. You’ll need to partition and format the drives. TAILS offers GUI application for doing this, but I used the command line. To use the GUI go to Applications -> Utilities -> Disks. Whether using the GUI or the command line always make sure you’re positive which drives are which or you might have a very bad day.
To partition on the command line I used the following:
sudo fdisk /dev/sdfWhere /dev/sdf is the path to the drive (see above in section 2 for determining the path to your drive after inserting it). Then option “o” to create a new empty DOS partition table, then option “n” to create a new partition and following all the defaults for size, start position, etc., to use the whole drive. “w” to write changes to disk to finish partitioning. Then:
sudo mkfs.ext4 /dev/sdf1This will create an ext4 filesystem for use on Linux systems. If you prefer you can run mkfs.vfat instead to create a FAT filesystem that will work on other non-Linux systems.
Perform those steps for both USB drives 1 and 2.
Step 7: Generating Your Keys and Addresses
This step is specific to generating keys for Verus using the Vanity Generator. If you’re making keys for something else your process will be different.
Now that you’re in the clean system and have your storage media prepped, it’s time to generate the keys. Insert USB drive 3 to get access to your key generation tool(s).
For the easiest time locating things (and to make sure these directions are robust against different configurations, you’ll do best to work in your home directory and use a file browser to copy files around as needed. Copy vanitygen from your USB drive into your home directory.
Open a terminal (Applications -> System Tools -> Terminal) and use these commands to generate your keys and addresses, replacing N with the number of key/address pairs you’d like to create. There’s no harm in creating a bunch of keys in case you need/want to use them in the future. I created 5000.
./verusvanitygen -z -t 3 -a N -F compressed R | cut -d, -f3,4 > rec.csv
cut -d, -f1 rec.csv > rec_addresses.csvThis will create a csv file with addresses and keys (in columns 1 and 2, respectively) in rec.csv, and a list of just the addresses in rec_addresses.csv.
Definitely check both files out in a text editor or in OpenOffice Calc to make sure the results are what you expect and that you do indeed have addresses and keys there. If you followed these directions these files should be in your home directory and you can likely just double click on them to open them as spreadsheets (don’t save any changes you might accidentally make).
Now it’s time to copy these files onto your secure USB drives. You’ll need at least rec.csv, but may as well grab rec_addresses.csv to put on drives 1 and 2. Then just put rec_addresses.csv on drive 3. Use a copy operation for all of your work, then you have the option to use shred to securely delete and wipe the files. Once you’re sure you’ve copied the files and safely unmounted the drives you can shut this system down (hard power down recommended rather than a restart) and you should be done.
Validation
It’s always a good idea to test your work. You have several options here.
At minimum you should test this process by going through all the steps to generate keys, then actually using them with a small amount of money, or assigning a dummy Verus ID to them. Then import the keys to a live wallet and make sure you can spend from the address, or that you can revoke/recover your IDs, or whatever the case may be depending on how you used them. Then, when ready to use them for real, use another set of keys you’ve generated that haven’t been used.
Another option is to get Verus running on a computer and get it fully synced up, then disconnect the computer from the network and internet (including WiFi) and try importing and using your keys. Make sure you have a backup of that wallet before doing this or you’re going to have a hard time separating your secure keys out. You should be able to create transactions, create the transaction to revoke and ID (you won’t be able to recover because you won’t have a confirmation on the revocation to allow the recovery to take place), and otherwise use your keys however you will use them in practice. When you’re done make sure you shut down Verus and shred the wallet file to remove any trace of your keys, then restore your wallet backup.
The End Result
In the end you should have:
- Two thumb drives (1 and 2) each containing a list of address/key pairs in rec.csv and a list of just the addresses in rec_addresses.csv.
- Another thumb drive (3) with your key generation tool and a list of the addresses generated (without private keys) to use when creating or updating Verus IDs with these addresses, or to send funds to.
- The TAILS or other live system USB drive which you can now format and repurpose if you like.
It’s also worth noting that none of the addresses you generated won’t appear on the blockchain until you use them, so they’re completely private, anonymous, and invisible until you send funds to them or assign a Verus ID to them.
Lastly – as above, test your results. Make sure it works as expected for you, and make sure you understand how to make use of the keys in the way you intend. These instructions are to give you the tools to get the job done, but you are responsible for making sure you’re operating safely – I am not responsible if you lose funds, access to IDs, or anything else – do your due diligence.
If you see any conceptual security problems, mistakes, or other room for improvement in the process described in this writeup please reach out, I’ve intended it to be fairly accessible and to utilize the best possible security practices to reduce the potential theoretical vectors for compromise.
One thought on “Seriously Paranoid Cryptocurrency Key Generation”