BitKey is a swiss army knife of handy Bitcoin tools built on top of Debian, which we created to scratch our own itch.

Community Branch

As most would be aware, BitKey is a side project of @turnkeylinux. Other than the initial development and a few updates here and there over the years, we've done a really poor job of maintaining it! :'(

However, the BitKey community was lucky enough that @estevaocm has come along and given the project some love! Seeing as we're doing such a poor job and he's doing such a great one, we've asked him to take over as community leader and maintain this community branch of the offical BitKey repo.

The master branch remains the "offical" BitKey release branch, but for the foreseeable future, the "community" branch will be the one you'll most likely want to use! Community ISOs (built and published by @estevaocm) should be avaialble from the releases area of this repo.

Backstory

We're avid Bitcoin fans but after going to our first local Bitcoin meetup we discovered the elephant in the room was that there was no easy way to perform cold storage Bitcoin transactions where the wallet lives on an air-gapped system physically disconnected from the Internet.

We used the TurnKey GNU/Linux build system to create a self-contained read-only CD/USB stick to satisfy all our Bitcoin needs. Yours too we hope, and if not we're open to suggestions for improvement.

In December 2017, the project was forked to update all software and include webcam support for QR code scanning and additional altcoin wallets.

In March 2018, @estevaocm has graciously agreed to lead maintence of this communtiy branch. His work to date has been merged from his fork, back into this branch.

Apps: batteries included!

Apps that are allowed network access in online mode:

• Electrum with wrapper that stores wallet on a USB in a LUKS encrypted loopback filesystem. During creation, displays passphrase strength estimates such as entropy and crack time.

• Electrum-LTC for Litecoin (with wrapper)

• Electron-Cash for Bitcoin Cash (with wrapper)

• Electrum-DASH for DASH (with wrapper)

• Armory Wallet (with wrapper)

• QtQR: allows QR code scanning from webcam

• zbar-tools: alternative for QtQR

• Exodus: multi-coin wallet, including ShapeShift exchanging (NOT OPEN SOURCE)

• CryptoSeed: encryption for paper wallets

• KeePassXC: password manager

• Online Web apps:

  • MyEtherWallet
  • Ripple Wallet
  • Minimalistic Ripple Wallet
  • Coinb.in: swiss army knife of bitcoin tools

Offline Web apps (not allowed network access even in online mode):

• Base43 decoder: decodes the strings from Electrum QR codes
• BIP39 Mnemonic Code Converter: paper wallet seeds for 30+ cryptocurrencies (BIP39, BIP32, BIP44, BIP49, BIP84, BIP141)
• bitaddress: paper wallet generator
• bitcoinpaperwallet: paper wallet generator
• IOTA paper wallet
• IOTA seed generator
• Monero paper wallet
• qrcode generator: encodes anything as a qrcode
• warpwallet: brainwallet with strong KDF (scrypt+pbkdf2) and salt
• zxcvbn: realistic password strength estimator

Advanced tools for Bitcoin ninjas:

• bx: the Bitcoin command line tool (AKA libbitcoin-explorer)

Other:

• Chromium web browser: runs in incognito mode by default (only visible in online mode), updated beyond default Debian Jessie

• Network manager

• Printer manager

• File manager

• Text editor

Installing BitKey on a USB stick or CDROM

BitKey on CDROM: use your favorite program to burn the ISO to CDROM. Nothing special. CDROMs are naturally read-only and tamper resistant.

BitKey on USB: If you don't burn BitKey to a CDROM, writing BitKey to a USB stick with a hardware read-write toggle (e.g., Kanguru FlashBlu) is the next best thing. Also loads the system much faster.

On USB sticks without write protection, you can remove BitKey USB after booting as an additional security measure. BitKey loads into RAM so after booting you no longer need the USB.

1. Insert USB stick and detect the device path::

   $ dmesg|grep Attached | tail --lines=1 [583494.891574] sd 19:0:0:0: [sdf] Attached SCSI removable disk

2. Write ISO to USB::

   $ sudo dd if=path/to/bitkey.iso of=/dev/sdf $ lsblk | grep sdf sdf 8:80 1 7.4G 1 disk
   └─sdf1 8:81 1 444M 1 part

Formatting your data storage flash drive

By default, BitKey stores your wallet encrypted on a USB flash drive AKA USB stick.

It expects your flash drive to be vfat formatted. This is the standard format for store bought drives. If this isn't the case, BitKey may have trouble detecting your drive. In that case you can reformat the drive from Windows, or on Linux / BitKey using the following steps:

1. Insert data storage flash drive and detect the device path::

   $ dmesg|grep Attached | tail --lines=1 [583494.891574] sd 19:0:0:0: [sda] Attached SCSI removable disk

2. Reformat the drive::

   $ sudo mkfs.vfat /dev/sda1 mkfs.fat 3.0.27 (2014-11-12)

Usage modes

See https://bitkey.io for a detailed introduction and usage guide.

BitKey Live CD/USB supports three modes of operation selected from a boot time menu.

High security - Cold storage boot modes

Two cold storage modes:

1. cold-offline: create wallet, sign transactions

   In this mode, the desktop background is green (mnemonic for cool and safe)

2. cold-online: watch wallet, prepare transactions

   In this mode, the desktop background is blue (mnemonic for cool and informative)

If the instructions are carefully followed, cold storage modes creates an airgap which ensures that your wallet's private keys are never loaded into RAM on a computer connected to the Internet.

Attention: cold-online mode has been disabled due to no longer being supported by Electrum 3. So your wallet's master public key must be manually exported to a cold-online wallet. It may be most convenient to generate the QR code for the master public key, then scan it from the Electrum app for Android to create a watch-only wallet. The watch-only wallet allows you to check your balance and history, prepare and broadcast transactions, but not sign transactions. If you only ever sign your transactions in cold-offline mode and never otherwise compromise your secret master private key, your funds cannot be stolen by a network attack. Since this version of Bitkey includes webcam support, you may use the cam to scan the QR code of the prepared transaction for signing, thus never exposing Bitkey or your wallet to harmful files. For more information, refer to http://docs.electrum.org/en/latest/coldstorage.html

Medium security - Hot-online boot mode (red background)

In this mode the desktop background is red (mnemonic for hot and dangerous)

Allows you to create & watch wallet, prepare & sign transactions.

In hot online mode, the private keys are known to a computer connected to the Internet. This is the most convenient mode because you only need one computer. After booting BitKey resides in RAM and saves nothing to your hard drive.

The flip side is smaller security margins:

1. You need to trust that your copy of BitKey hasn't been tampered with and that the original signed BitKey image hasn't been compromised.

2. If you use a network enabled app (e.g., Chromium) and an attacker exploits a zero-day vulnerability to gain access to your online system, say goodbye to those Bitcoins!

Low security - Hot storage on your PC/phone

In this mode you don't use BitKey or any hardware wallet type device. Your wallet's private keys are stored on your phone or PC and known to an Internet enabled device that is vulnerable (or will be sometime in the future) to the efforts of thieves who would like nothing more than to steal your Bitcoin.

You rely on the magical power of wishful thinking. You're not important enough to get hacked and any opportunistic malware infection you do get is not going to include any Bitcoin stealing functionailty. Right? Right! Good luck!

Paranoid brainwallet support - Jason Bourne mode

Hardest to use but leaves no trace of wallet keys in any storage medium. Minimizes trust in BitKey. Your wallet keys are only stored in your head.

Inspired by how Jason Bourne stores his Bitcoin:

http://maxtaco.github.io/bitcoin/2014/01/16/how-jason-bourne-stores-his-bitcoin/

Generating wallet step

1. Boot BitKey in cold-offline mode, remove BitKey USB
2. Generate Warpwallet with a strong passphrase and your e-mail as salt
3. Save public Bitcoin address (e.g., scan qrcode)
4. To ensure private keys do not survive in RAM, turn off computer running BitKey and disconnect power source for 15 minutes.

After generating wallet, you can send Bitcoin to this address.

Safety warning regarding salts: do not use Warpwallet without a salt. You're not going to forget your e-mail and using a salt makes attacks vastly more difficult.

Public Service Announcement regarding Warpwallet passphrases:

1. Humans are poor sources of randomness and much more predictable using statistical models than they think. Technology is ever moving forward and cracking techniques always get better, never worse. You may not be familiar with the state of the art, so be extra careful.

   The ideal passphrase is 6 to 8 truly random diceware words. If you're going to try and come up with a random passphrase yourself, be paranoid. They really are out to get you. At least use zxcvbn to measure passphrase strength. It's not perfect, but it should give you a clue. You'll want at least 65 bits of entropy for a salted warpwallet, especially if you are going to be storing funds