Airgapped Signing

The centrifuge halls at Natanz were never connected to the internet. Iran's uranium-enrichment programme sat behind a true air gap — and in 2010 the Stuxnet worm wrecked its centrifuges anyway, carried across the gap on USB sticks by people just doing their jobs. Security engineers have told that story ever since, because it teaches the exact lesson bitcoin holders need before they buy an "airgapped" signer: the gap is not a property of the device, it is a discipline about what crosses it. Used well, an air gap is the strongest practical barrier a holder can put between their keys and the internet. Used as a talisman, it is a word on a product page.

Start with the mechanics. An airgapped signing setup splits the wallet in two: a watch-only wallet on your connected computer, which knows your addresses and balances but holds no keys and can sign nothing; and a signer that holds the keys and never connects to anything — no USB data, no Bluetooth, no WiFi. The two halves exchange only inert data: the online side builds an unsigned transaction, the offline side signs it, and the signature travels back. Malware on your laptop can watch everything and steal nothing, because nothing on the laptop can spend.

The courier between the halves is the PSBT — the partially signed bitcoin transaction, a standard container that carries a transaction across the gap by QR code or SD card. This is where the gap earns its keep: a QR code is a narrow, auditable channel. It carries exactly the payload it displays, cannot probe the device it is shown to, and both sides can inspect what crossed. Compare a USB cable, which connects two computers' full software stacks — drivers, firmware, protocol parsers — every layer of which is attack surface that has nothing to do with the transaction. Narrowing the channel is the whole design.

The workflow, end to end: build the transaction in the watch-only wallet; carry the unsigned PSBT across the gap; read every detail on the signer's own screen — destination, amount, fee, change — and only then approve; carry the signed result back and broadcast it. The verification step is not optional ceremony. The signer's screen is the one display in the room that malware on your computer cannot draw on, which makes it the only place a transaction can be trusted as read. An airgapped signer approved blind is a very expensive rubber stamp.

Now the Stuxnet lesson, honestly applied. The gap is only as good as what crosses it: an SD card is itself a small computer with firmware, and a QR workflow is only as trustworthy as your habit of actually reading what is displayed. And the gap does nothing about failures that were born offline. The Cipher School's entropy module documents an airgapped, security-first device whose broken random number generator cost holders over a thousand BTC — no connection required, because the flaw shipped in the box. Airgapping removes the network attacker; it does not audit your vendor, verify your entropy, or back up your seed. Those disciplines stack; none substitutes for another.

Practically: this is the natural next rung after Module 2's hardware doctrine. Devices built for QR-first signing keep the channel narrow by construction, and stateless designs — which hold no seed at all until you present it, then forget it at power-off — remove even the resting device as a theft target, at the cost of entering the seed each session. Whichever tool you choose, rehearse the loop with pocket change first: build, carry, read, sign, return, broadcast. The gap protects the keys; the rehearsal protects you from the gap's real enemy, which is your own improvisation on the day it matters.