How to set up a Raspberry Pi Zero (air-gapped) running latest version of Electrum Desktop Wallet.
Running a bitcoin electrum wallet on a Raspberry Pi Zero has a number of advantages. First, it doesn’t connect to the internet, has no WiFi access, or Bluetooth access, so you can safely type your seeds into the device. Keep your wallet files encrypted and the operating system secured with a strong password.
If you run a 3 of 5 multisig wallet, and only keep two keys on the device, even if you mess up and have 2 keys compromised, your funds will still be safe
This simulates having a hardware wallet, without the associated problems with them. (They are extremely fiddly to use especially multisig, sometimes don’t connect properly by USB, and the firmware changes are a real pain.)
Using a Raspberry Pi Zero is cheaper, more flexible, but it is fiddly to set up. This article should make it easier (benefit from the pain I suffered). Once it is set up though, it is a joy to use.
This article will guide you with some command line. I promise, it will be easy if you follow the instructions, but I do expect you to know how to navigate around the file system in Linux. If you don’t, then watch this 11 minute video to learn some SSS (super simple stuff).
If it’s mildly interesting, watch this one as well, it’s a bit longer:
Get the equipment:
- The Raspberry Pi Zero (not the Pi Zero W — we don’t want wireless access)
2. Get the official power supply
3. A case (optional but better to get it)
4. HDMI adaptor
5. A powered Micro USB OTG Hub Adapter (the Pi Zero has only one USB slot)
6. Get a few micro SD cards (they come with SD slot adaptors) — You need 2, but spare ones are good to have. Especially if you will run your own node.
7. Non-Bluetooth USB keyboard and mouse (you probably have these lying around).
8. USB Flash drive
9. A USB webcam such as this one:
Setup: Internet connected Raspberry Pi OS
You need to install python 3, and an Electrum installation on a Raspbian Operating System with an internet connection. This is a different computer to the final Pi Zero we are building. You then transfer the necessary files from that computer to a USB drive, and then to the air-gapped Raspberry Pi. You then manually install the files via the command line on that device (explained later).
If you already have a Raspberry Pi with internet access (Raspberry Pi Zero W or Raspberry Pi 3 or 4), use that, otherwise, use a Debian Linux computer (I think that should work), or, use a Mac or Windows computer with internet access, and run a virtual machine with Raspberry Pi OS on it.
ACTUALLY NO! I TESTED USING A VIRTUAL MACHINE AND THAT DOES NOT WORK BECAUSE MAC AND WINDOWS HAVE DIFFERENT CHIP ARCHITECTURE SO THE TRANSFERRED FILES DON’T WORK ON THE PI (ARM CHIP). YOU NEED A SECOND PI, ANY PI, WITH INTERNET CONNECTION. I HAVE EDIT THE ARTICLE TO REMOVE INSTRUCTIONS FOR RUNNING RASPIAN OS ON A WINDOWS/MAC.
Internet connected Raspberry Pi
Create two SD card images using any internet connected computer. One card for the internet connected Raspberry Pi and one for the Air-gapped Pi.
Go to https://www.raspberrypi.org/downloads/raspberry-pi-os/ and download Raspberry Pi OS (32-bit) with desktop. The 64 bit version won’t work on the Pi Zero, make sure you use the 32 bit version.
Next, verify the digital signature. (This makes sure the software you have downloaded has not been tampered with).
The digital signature I copied from the website looks like this:
SHA-256:9d658abe6d97f86320e5a0288df17e6fcdd8776311cc320899719aa805106c52It will be different when there is a new version.
This is different (and slightly less secure than gpg signatures).
Open the terminal, and navigate to the directory containing the downloaded file.
Type shasum -a 256 NameOfTheFile (there should be a digital signature output. Compare it is the same as the published signature)
Next, download and install Balan Etcher.
I was unable to find the digital signature for this. If you know how, please let me know and I’ll update this article.
Etcher is self explanatory to use. Insert your micro SD card and flash the Raspberry Pi software (.img file) onto the SD card. Do the same for the second micro SD card.
The internet connected Raspberry Pi
Run the Raspbian OS machine, (DO NOT UPDATE THE OPERATING SYSTEM — it will ask you to update. Click cancel), open the browser, and navigate to www.Electrum.org and click the “Download” page:
The Linux Appimage would have been a nice way to download and install Electrum for the Raspberry Pi (it’s just a double click away from installation with no command line) — but the Raspberry Pi chip architecture is ARM, and Appimages don’t work on ARM machines. So we have to use Python and command line (explained in bottom half of the Electrum picture).
Install dependencies
Before you do install dependencies, navigate using the terminal to…
/var/cache/apt/archives/
and move all the files to a temporary folder (we’ll put them back later).
Install the dependencies by copying the command provided on the Electrum website next to the heading “Install dependencies” — do not copy what is shown in this screenshot above; use the current command from the Electrum website because as the software is upgraded, the dependencies might change, and this article might be out of date.
Once you do this there will be new files in
/var/cache/apt/archives/
We will deal with them later.
Then Download the package with the wget command as shown on the website, or click the Python Electrum-4.0.3.tar.gz link to download.
Check the signature. This is SUPER important.
Checking gpg signatures is a good skill to have, especially if you are a Bitcoiner. If you have an extra half and hour, watch this video, I find it is a good explanation. Perhaps watch it at 1.5x speed. You can skip this if you like, I’ll be explaining the steps anyway, but not as comprehensively as this video.
On the Electrum Download page, there is a quick blurb about verifying gpg signatures:
Click on the link, ThomasV’s public key, and save the file.
In the command line, navigate to where you downloaded the file. Type
gpg --import ThomasV.ascIn the command line, options longer than one letter are specified with a two “-”s, and options specified with a single letter are with a single “-”.
Make sure the file name matches to what you typed in the command line. If it is still not working, try making sure the file is saved as a .asc file and not .txt file. That requirement may be operating system dependent, I haven’t checked.
Next, download the signature. It is a link located to the right of the software file download link. The software filename ends in tar.gz The signature is exactly the same filename with a .asc on the end. Make sure the signature file does not end in .txt. Macs like to do that when you download .asc files, so remove the .txt.
Download both the signature file and the software file to same directory, then in the terminal, navigate to that directory.
Type
gpg --verify FileNameOfSignatureEnter the signature file name, not the software file name. This command works if the file name and signature file differ only by a .asc If they don’t, you ned to chance the file name, OR, modify the command like this:
gpg --verigy FileNameOfSignature FileNameOfSoftwareYou should get a long output which contains the words Good signature from “Thomas Voegtlin (https://electrum.org) <thomasv@electrum.org>
You’ll also see WARNING: This key is not certified with a trusted signature!
Don’t worry about that…
Seriously, it’s normal.
Move the files
In terminal, navigate to where Electrum .tar.gz file is downloaded. Type this to unzip it: tar -xvf ElectrumFileName.tar.gz
We are not going to “install” Electrum. We simply can run it from the command line. Test it now to see it works. First navigate to the newly unzipped Electrum directory. You should see a collection of files including the file run_electrum. Next, you can type ./run_electrum or python3 run_electrum. As long as you are in the correct directory, it should work. Shut down the program.
Get a new, unbesmirched, USB stick and format it. (I’ve always wanted to use the word “unbesmirched”!).
Next, in the directory /var/cache/apt/archives/, copy all the files with the .deb extension to new directory on a USB stick. You can move the files that previously existed back to this directory if you are going to keep using this operating system. If you get a “permission denied” error, use the “sudo” command in the terminal to move files. eg:
sudo mv Path_and_filename Destination_directory/Next, copy the unzipped Electrum directory to the USB stick. (Alternatively, if you didn’t delete the zipped file, you can copy that, and unzip it on the Pi Zero.)
Shut down the Pi OS, you’re done with it.
If you do want to use that OS again, then, if you moved any files out of /var/cache/apt/archives/ to a temporary directory, then move them back.
Setup: Air-gapped Pi
Next, boot up the Raspberry Pi Zero with the other flashed SD card.
Copy the contents of the USB’s deb directory to /var/cache/apt/archives/
In the terminal, navigate to that directory and type sudo dpkg -i *.deb to install the dependencies.
Next, copy the Electrum directory on the USB to the Raspbian OS Desktop.
Finally, you can run Electrum. Navigate to the Electrum directory. Type ./run_electrum and, hopefully, it should be working. Phew.
How to spend from this wallet without breaking the air-gap, explained here
I would love to hear your feedback, and how your project went. Send nodes — armantheparman@gmail.com ; Twitter: @parman_the
