What is air-gapped signing?
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 5 min
In short
Air-gapped signing keeps the device holding your keys permanently off any network. Unsigned transactions travel in on a QR code or SD card, and the signed result travels back out the same way. With no communication path at all, remote extraction of the key is off the table.
Key points
- The signing device never touches a network
- Data moves by QR code or SD card
- A narrower attack surface than USB-connected devices
- Skipping the on-device review negates the whole benefit
Definition
A signing method in which the device holding the private key is physically isolated from any networked device, with only the data needed for signing carried across by hand.
The flow runs like this: an online wallet builds an unsigned transaction and displays it as a QR code. The signing device's camera reads it, you review the details on its own screen, and it signs. The signed transaction appears as a QR code on the signing device, the online machine reads that, and broadcasts it. The key never leaves.
USB hardware wallets also keep keys inside, but a USB data path exists, leaving room for firmware or driver vulnerabilities. Air-gapped designs remove that path physically. Keystone, AirGap Vault and SD-card-based devices such as Coldcard work this way.
What the method cannot automate is deciding what you are signing. Unless you compare the destination and amount shown on the signing device against what you intended, malware on the online machine can substitute an address and you will sign it. Even on a small screen, check the first and last characters.
Watch out for
- · Without reviewing destination and amount on the signing device, the air gap buys you nothing
- · Update firmware only through the official procedure with signature verification
- · Connect the signing device to a network even once and the assumption is gone