You have 2 computers. One is 100% offline and, thus, trusted. Other is online. Private keys are stored on the offline computer and the online computer has no access to it. Is there any way to sign a transaction using the offline computer, then manually (i.e., typing in a keyboard) transfer it to the online computer, so that it transmits it to the blockchain?
5 Answers
We at MyEtherWallet.com implemented an offline transaction tool to do exactly this. While most people who are cold-storage fanatics know command line and the inner-workings of gas price and nonce, this allows you to do it via GUI.
Navigate to the "Offline Transaction" tab via your online computer. Here you will generate the current gas price and nonce.
Enter the FROM address in the field. Please note, this is the address you are sending FROM, not TO. This generates the nonce and gas price.
Move to your offline computer. Enter the TO ADDRESS and the AMOUNT you wish to send.
Enter the GAS PRICE as it was displayed to you on your online computer in step #1.
The GAS LIMIT has a default value of 21000. This will cover a standard transaction. If you are sending to a contract or are including additional data with your transaction, you will need to increase the gas limit. Any excess gas will be returned to you.
Enter the NONCE as it was displayed to you on your online computer in step #1. If you wish, enter some data. Data is optional. If you enter data, you will need to include more than the 21000 default gas limit. All data is in HEX format. Select your wallet file -or- enter/paste your private key and unlock your wallet.
Press the "GENERATE SIGNED TRANSACTION" button.
The field below this button will populate with your singed transaction. Copy this and move it back to your online computer, or you can use the QR code provided.
On your online computer, paste the signed transaction into the text field in Step 3 and click "SEND TRANSACTION". This will broadcast your transaction.
Alternatively, you could use other services in order to broadcast the signed transaction. Etherscan has a field you can use to broadcast transactions.
drcode on reddit made a tool to decode a signed transaction so you can verify it's doing what it says it is doing.
FYI, everything on MyEtherWallet is almost 100% offline. The only thing that leaves your computer while sending is the signed transaction, which is generated by your browser. We also receive the nonce and gas price, which is why you must generate those bits of information online.
I've set something like this up myself. I've bought a silly simple laptop which runs a node which for obvious reasons it isn't connects to the network and has never been online. I use this device to sign transactions using the unofficial RPC method eth.signTransaction. You then take this method's output and stick it on a USB, move the contents to my other computer and send the transaction using eth.sendRawTransaction.
Because the offline computer can't determine the nonce (it doesn't have any state and will think the nonce is always 0) you must therefore always supply the correct nonce yourself; this isn't so hard, you'll just have to do a eth.getTransactionCount(addr) on the computer that does have access to the Internet.
-
2Insightful, thanks. Call me paranoid, though, but your computer is still open to a virus that is carried through pen drive. Ideally, the offline machine can send data to the online machine, but not the other way around. Feb 5, 2016 at 15:41
-
You could type over the hex if you'd like (probably not) or use some other tool to secure this process. Feb 5, 2016 at 21:36
-
@Jeffrey W.: +1, interesting... Can you edit your answer to expand a bit on what the nounce is in this case? When does it goes up? Does it increment by 1? What's the role of this nonce, etc. I'm asking that because I'm an early Ethereum user and had no idea there was a nonce here: so I read your answer and suddenly hear about that nonce and really have no clue what it is about. Feb 5, 2016 at 23:29
-
1
-
@CedricMartin This may help with nonce ethereum.stackexchange.com/q/1172/42– eth ♦Feb 14, 2016 at 0:01
If you can install Node.js onto your offline computer, and copy some javascript files (w/ module dependencies that were retrieved on an online computer using npm), then 2 similar libraries come to mind.. either of which could be used to sign a raw transaction.
The resulting transaction is just a hex-encoded string that can be copied from the offline computer, then broadcast to the Ethereum network from any online computer.. either using a local Ethereum node, or sending it to one (or more) public gateway servers that will accept and forward raw transactions.
libraries:
- ethereumjs-tx
- very popular and the de-facto standard library to use
- ethereumjs-tx-sign
- does basically the same thing
- imho, I think that it's API is easier to use.. especially for things like:
- signature verification
- decoding raw transactions back to human-readable data structures
- its installed size is orders of magnitude smaller
public Ethereum gateways:
I use now the following method. On an offline airgapped computer with a verified downloaded version of myetherwallet and a private key saved in keepass. I have the public From address available on my smartphone. On my smartphone, on the offline page of mew, I enter the from address to retrieve the nonce & gas price. I manually enter these details on my offline computer. I enter the destination address on my offline computer.(you can qr scan this with a qr gun) I generate the transaction and sign it. I copy paste the code in QtQr to create a QR code. (For some reason, the qr code made from mew was either too small) I scan this code with my smartphone and broadcast it on etherscan or myetherwallet.
It's not much of a feature or achievement to create basic transactions using some esoteric MyEtherWallet "offline GUI" (which needs to be connected to the internet and thus is very much an "online GUI" despite the deceptive name). Etherscan was providing this functionality ages before MEW.
What WOULD BE impressive would be to be able to use an intuitive/native GUI for sending, swapping, and interacting with dApp contracts (even perhaps via their web portals) but rather than putting your funds at risk by having to have your private key (a.k.a keystore) on the internet-connected machine (with only an web dialog box with an "OK" button between your funds and abuse by a malicious adversary) having just the public address used by MEW and/or the dApps and them providing raw transations to copy/download for offline signing (by whatever means, nobody cares about a GUI on the backend) as well as a facility to either broadcast the signed transaction or check if/when it has been broadcast.
I don't know why this is currently so unnecessarily difficult. Why won't MEW let me simply provide my public ETH address to use the GUI on my internet-connected machine?
Error 1016.