offline air-gapped electrum

[22bits]

I am a little confused about one point and how this works.  When I set up a 'air-gapped' offline wallet (running off tails for example), how does Electrum know about an incoming transaction?  So say I send the new air gapped .01 BTC, how would it see it to add it to the balance so I could later create a transaction to send it and then get it signed on the offline wallet?

[hosseinimr93]

You need to have two wallets. One of them should be an offline wallet and the other one should be a watch-only wallet on an online device.
The offline wallet is used for signing transactions and the online wallet is used for seeing your balance and transactions history, creating unsinged transactions and broadcasting transaction.

[22bits]

Thank you, thought about this after posting the question also.  All makes sense now, the offline wallet always can be 'zero' because its only job is to sign transactions.  It does nothing else.

[AB de Royse777]

You need to have two wallets. One of them should be an offline wallet and the other one should be a watch-only wallet on an online device.

@22bits, to create the watch only wallet go to Wallet > Information.

From the pop up you will know "Master Public Key" of the wallet if it's a standard wallet.

Restore the wallet in an online device using the "Master Public Key". This new wallet (actually it's a same wallet) is your watch-only wallet. You can check balance, get addresses, create transactions. Everything except sign and broadcasting a transaction. Once a transaction is created then export the file or texts and from the offline wallet (main wallet) use Tools > Load transaction > depending on your exporting choice go for From File or From Text or one of other two options. Sign the transaction and export it again to follow the same options from the watch-only wallet (Tools > Load transaction > ...... ). Now you will see the broadcast button is active. Finally, broadcast the signed transaction.

All makes sense now, the offline wallet always can be 'zero' because its only job is to sign transactions.

Yes, the watch-only wallet helps you to check balance and everything else

[un_rank]

All makes sense now, the offline wallet always can be 'zero' because its only job is to sign transactions.  It does nothing else.

Yes, it can possibly not be in sync with the blockchain cause it is offline. It just signs transactions.

Restore the wallet in an online device using the "Master Public Key". This new wallet (actually it's a same wallet) is your watch-only wallet. You can check balance, get addresses, create transactions. Everything except sign and broadcasting a transaction.

Online watch-only wallets are used to broadcast transactions. It can do everything except signing the transaction, cause you need the master private key to do that.
Offline air-gapped wallets cannot broadcast transactions.

- Jay -

[Z-tight]

Once a transaction is created then export the file or texts and from the offline wallet (main wallet) use Tools > Load transaction > depending on your exporting choice go for From File or From Text or one of other two options. Sign the transaction and export it again to follow the same options from the watch-only wallet (Tools > Load transaction > ...... ). Now you will see the broadcast button is active. Finally, broadcast the signed transaction.

I use the QR code option for importing created transactions from the watch-only wallet into the air-gapped wallet, and also for importing signed transactions into the online watch-only wallet for broadcasting, i think this option is more user-friendly.

After creating the tx in the watch-only wallet, you click on the QR code, and you use the offline wallet to scan this QR code, the transaction will be imported into the offline wallet, after signing, you click on the QR code and use the watch-only wallet to scan the QR code, once it is imported into the online wallet, you can now broadcast the transaction to the network.

[Yamane_Keto]

Thank you, thought about this after posting the question also.  All makes sense now, the offline wallet always can be 'zero' because its only job is to sign transactions.  It does nothing else.

To understand it more deeply, you need a private key that enables you to sign transaction. That private key in the case of air-gapped was not and will not be on a device connected to the Internet, after you prepare the air-gapped and download electrum, you create a new wallet and get 12 wallet seeds.

from your seed you will get master node that will generate many if child private keys (Xpriv) then you can obtain the master public key (XPUB,) which enables you to manage and generate new addresses, all of which can be controlled by those seeds. This process is generated without the need to connect to the Internet, but if you do it in an environment connected to the Internet, no one will be able to access to your private key. Safely use that master public key in any online environment to check your balance or generate new addresses.

How to obtain it was explained above.

That public key starts with Xpub

Edit thanks hosseinimr93

The master public key starts with xpub, only if your wallet is legacy.
If your wallet is native segwit (which is the default wallet type, when you generate a new wallet on electrum), your master public key would start with zpub.

[22bits]

I use the QR code option for importing created transactions from the watch-only wallet into the air-gapped wallet, and also for importing signed transactions into the online watch-only wallet for broadcasting, i think this option is more user-friendly.

Interesting about scanning the QR code, what do you use the scan it?  Not sure how I would have the airgapped computer read a QR code.

[hosseinimr93]

That public key starts with Xpub

The master public key starts with xpub, only if your wallet is legacy.
If your wallet is native segwit (which is the default wallet type, when you generate a new wallet on electrum), your master public key would start with zpub.

[Sidney986]

See this link for adding camera

https://bitcointalk.org/index.php?topic=5369457.0

[Sarah Azhari]

You need to have two wallets. One of them should be an offline wallet and the other one should be a watch-only wallet on an online device.
The offline wallet is used for signing transactions and the online wallet is used for seeing your balance and transactions history, creating unsinged transactions, and broadcasting transactions.

Another way is Explorer, OP shouldn't create 2 wallets or a watch-only wallet for just tracking his balance, he can use Explorer, like blockchain.com. This is more simple and can save his device space.

For example, xpub/zpub I create from electrum:

https://www.blockchain.com/explorer/assets/btc/xpub/zpub6oLs8QUeZV4d4g4686uK5ZC4ApUhMYAG4AQznZpik7gcyqbXBNquxP9ir2XDqpvnkgZAeWUrSatVNjBgspRFuo59o1TuAfTf2EzmdCn6iWA

If OP doesn't know how to get the master public key, he must go to the wallet setting on top, and then click the information, like the picture below:

[22bits]

I will ask this new but related question here as someone using Electrum on Tails might be able to help.  Feedback so far has been great by the way, thanks all   So I will be running Tails offline and then using offline signing in Electrum and use usb thumb drive to go back and forth to broadcast.  I would actually like to do a similar technique with ETH, and see most of the offline signing options available involve using another device like android, but I would like to use the app on Tails the same as Electrum.  Is anyone doing this and what is the app they are using to allow offline signing of ETH transactions and then port over to separate computer to broadcast, same flow as with Electrum? 

[nc50lc]

Interesting about scanning the QR code, what do you use the scan it?  Not sure how I would have the airgapped computer read a QR code.

I have a reply in the link below your reply, but that's only for scanning a raw transaction's QR code.

For the master public key, you can scan it in 'install wizard' menu: "Standard wallet->Use a master key" via the camera icon [] below the area where you normally type/paste the master public key.
For the offline wallet's master public key QR Code, you can display it in the "Wallet->Information" menu using the QR code icon: []

[o_e_l_e_o]

-snip-

He needs a watch only wallet in order to create transactions for his airgapped wallet to sign. You cannot do this with a block explorer. Further, your watch only wallet should be connected to your own node for your privacy. Handing your xpub to a blockchain explorer is a privacy disaster.

[Aikidoka]

~snip~

He doesn't need to create two wallets, it's just one wallet on the air-gapped device. The other one is a watch-only wallet that uses his MPK. I haven't tried any Explorer like the one on blockchain.com, I just clicked on the link you posted and I couldn't find the addresses that belongs to that MPK. Maybe it's not there or I just don't know how?

To be honest, I think Electrum would be better. It shows basically everything and all the addresses of your wallet, as you can see in the picture below. Using any online website by sharing your MPK with them would put your privacy at risk, so in my opinion it's better to use the watch-only wallet created by Electrum.

[Charles-Tim]

Using any online website by sharing your MPK with them would put your privacy at risk, so in my opinion it's better to use the watch-only wallet created by Electrum.

This is one of the worst thing to do. But using Electrum without the use of Tor means no anonymity too. If you want anonymity, you can check address on an explorer with Tor, but inputting your master public key on an explorer is insane.

For privacy, you have no other option than to go for full node wallet, using Tor with it.

For anonymity, you have no option than to use Tor while using a wallet.

If you use IP address on a wallet, no privacy no anonymity too.

But inputting your master public key on an explorer is insane. Watch-only wallet is the proper way.

[khaled0111]

^^
If you want full anonymity and full privacy then you should connect you Electrum wallet to your own server.
Even if you look up one if your addresses on an online explorer (without providing the master public key) then there is a high risk of exposing your other addresses (by tracking change addresses and consumed inputs).
If you want full privacy then better connect to your own servers.

[BitMaxz]

Is anyone doing this and what is the app they are using to allow offline signing of ETH transactions and then port over to separate computer to broadcast, same flow as with Electrum? 

If you talking about ETH then you should make another thread to the altcoin section to get the right response.

And I think there is no app yet for ETH that can make offline transaction but they do have a web version that you can also with your phone check this link here

[new19980]

I use the QR code option for importing created transactions from the watch-only wallet into the air-gapped wallet, and also for importing signed transactions into the online watch-only wallet for broadcasting, i think this option is more user-friendly.

After creating the tx in the watch-only wallet, you click on the QR code, and you use the offline wallet to scan this QR code, the transaction will be imported into the offline wallet, after signing, you click on the QR code and use the watch-only wallet to scan the QR code, once it is imported into the online wallet, you can now broadcast the transaction to the network.

if im using a laptop as an offline air-gapped electrum wallet how to scan the QR code to sign the transaction should i link a camera to the laptop ?

[o_e_l_e_o]

if im using a laptop as an offline air-gapped electrum wallet how to scan the QR code to sign the transaction should i link a camera to the laptop ?

You are going to be unable to scan a QR code without a camera, so yes, you'll need to buy a USB webcam or similar if your laptop does not have a built in webcam.

Your other option is to transfer your transactions back and forth via a USB drive, although this carries a slightly higher risk of transmitting malware or leaking your keys than via QR code.