Abstract : Download and verify the tools at bitaddress.org and coinb.in. Move them to an offline computer. Use bitcoin securely and by hand without much technical knowledge at all.
Welcome to episode one of the public coin toolbox with me your host funkenstein the dwarf. In this episode we'll be talking about some very useful tools which are not quite the simplest. If you are new to using public coin, you might want to try using a simple wallet program first. Those are so easy that any elementary school student can immediately and intuitively use them. Today we'll be covering a more intermediate level use case which is more educative and also more secure: javascript tools. You might think of this as "bitcoin by hand" because you are going to do yourself some of the things that a wallet program does.
I am still shocked to be using javascript for some of the highest required security procedures I need to do! The thing is, it's easy - it works - and you can do it offline. Yes that means airgapped and in a Faraday cage if you are very paranoid. The reason things developed like this is quite convoluted, but basically almost every computing device these days has by default a javascript interpreting browser on it. Even though this is not what those tools were built for, we can use them to do what we need - collect, hold, and spend public coin. We can do all this (at least the parts that touch the private keys) on a machine that is not connected to the internet.
For the purposes of this tutorial we will consider mainnet bitcoin (BTC, the first public coin) and not bother discussing other flavors of public coin. For other flavors, these tools exist as well and the procedure is mostly unchanged.
Bitaddress.org is a great project, it has all the cryptography on one page. No libraries are used! You can learn quite a lot by reading the source. It's well worthwhile to be very familiar with this stuff. Here's a brief outline of how to do simple high level security bitcoin.
1) Key Generation
Get bitaddress.org from the repo on github or the website itself. Verify it with gpg signature. In addition you likely want to test it with some test pairs you have handy, that you know are valid, when you go to generate new keys (using "wallet details" to do so). This confirms that the thing is giving the correct public keys and addresses corresponding to the private keys.
When you load it in a browser (on your raspberry pi or whatever) it will generate a new key for you. You don't need to use this. Copy the generated private key and paste it in the "Wallet details" form, and press "submit". It will give a bunch of information about the keypair. Grab the private key in hex form from below and paste that in the "private key" field. Now change a bunch of the digits. Or all of them. Roll some dice if you like. You are making a high quality private key here, never touched by an online box, generated by real entropy, using code that you verified yourself by testing other pairs, and perhaps verifying that the code was signed by somebody that you trust. If this offline box is in a Faraday cage, your confidence in this keypair being secret can be quite high indeed. Cool huh?
Once you have some keypairs, save them in a text file using your favorite text editor. They will look something like this:
5KGNVkXRDpxgyWESXVVHoKHPL5cS8kkAKPenxR6qrMuX1LdGfoa
04BF09D8B91FF4DCCD418A34C2ECC7EE1B54FE52C4CEBC1A8CFC08D4AB95E7BA0A211996B025DA78069545A2CE693471773853DDE07720B78505AC0F056BF239F7
1JE8cshsJF3BUqZSjeLchtvqmjnEiky1QL
(private key, public key, bitcoin address)
The associated bitcoin addresses and public keys can be made public and are ready to receive coin. Send funds to one yourself or give your fund manager, broker, or customer the public keys.
2) Storage
Take the file with the private keys that you generated with this method, and put it in a cold storage method of your choice. This means you could encrypt them with a symmetric key algo like twofish (I like this one, using gpg) using a nice long password you will always remember, and copy them to several drives that you leave around in a few houses. I like to just put them in a text file including the public keys and associated addresses as well, for convenience (those can of course be generated from the private key anyway, but if you have them already might as well save them). Or you could print them out on paper and hide them in a few places unencrypted (safer in the event of you forgetting the password). If these are really serious funds we are talking about, ideally this is one key out of many that control a multisignature trust. Remember to not put plaintext private keys on an online machine, and to back them up in multiple places!
3) Spending
You aren't going to be using this method for day to day spending, but sometimes you might want to go access these funds, to move them to a spending wallet or to sign a transaction for a multisignature fund. What you need to do is get your private keys loaded and on screen on your offline machine. Then you need to build a transaction to sign with them (unless you have one already from your multisignature trust manager). Coinb.in has a great javascript tool for doing this. Load it up in a browser and select "New Transaction".
Put in the private key you will be spending from in the "WIF (wallet input format) private key" field. If you are making a new transaction you need to know what outputs will be inputs for your transaction. You can get this information from any block explorer on an online machine, by searching the bitcoin address that holds the funds. Put the transaction ID (or IDs) of the output(s) you want to spend, with the necessary information, into the fields of the new transcaction form. Make sure you account for all the value of the inputs - anything left over will be collected by the miner as a fee. This means you probably want to use one of your secure addresses built in step 1 as a recipient of the "change". Once you have double checked this and all amounts, and everything looks good in the transaction, click "submit" and a signed hex transaction will appear on screen.
Now you just need to broadcast this transaction. You can save it in a text file and move it to a USB stick, and bring that to an online machine. Once there, you can use a service like blockchain.info ("Push raw transaction") or the online coinb.in site ("Broadcast") to publish it , or use a running bitcoin node if you have one.