mkbtcaddr - Generate encrypted bitcoin keypair

Dependencies:

• libssl

• libgpgme

• libdb4.8++

• To install these on debian:

  sudo apt-get install libssl-dev libgpgme11-dev libdb4.8++-dev

• To compile:

  g++ -Wall -o mkbtcaddr mkbtcaddr.cc -lssl -lcrypto -lgpgme

• To reconstruct a wallet from the encrypted keypair, you also need GnuPG and Berkeley DB utilities:

  sudo apt-get install gnupg db5.1-util

Safety precautions / backup procedure:

• Download a GNU/Linux live-CD image and burn it to a physical CD.

• Make sure that the checksum of the physical CD afterwards matches the signature of the ISO file that you downloaded.

• Physically disconnect the computer from the internet. This is to prevent remote attackers from accessing to the machine, either actively (by exploiting holes in the live-CD software) or passively (if the live-CD has a built-in key logger, for example).

• Physically disconnect your harddisks. This prevents any malware on the CD from leaving behind any tracks (like the passphrase, if the live-CD has a key logger).

• Prepare a portable medium like a USB stick by reformatting it.

• Load the source code of this program on to the portable medium and compile it within the live-CD environment.

• Check for any physical keyloggers.

• Do not use a wireless keyboard.

• Use a fresh passphrase. All of the above don't help much if you use the same passphrase regularly on another machine which does have a keylogger installed.

• Run the program. The generated files will be encrypted with the passphrase and are essentially public. (The passphrase should be kept secret, however.)

• BEFORE sending bitcoins to the generated address, make sure the generated files can never be lost: Send the encrypted file to all your e-mail accounts, print out physical copies (put one in your house, one in the bank, and one in a friend's house), and post it online. If you lose either the encrypted file or your passphrase, you've lost your bitcoins.

Decryption procedure:

gpg --decrypt 1JQ3c5P1xeR1hfYecHQ6vMp2kDswn4xnVa.txt

• The output file is a plaintext wallet database in the format of bitcoin version 0.3.23. To actually reconstruct the binary wallet.dat (as used by bitcoin), pipe the output of gpg to the "db_load" program, for example as follows:

  gpg --decrypt 1JQ3c5P1xeR1hfYecHQ6vMp2kDswn4xnVa.txt | db5.1_load new-wallet.dat

• Note that this will OVERWRITE the file new-wallet.dat if it already exists!

• If gpg, db_load, or bitcoin refuses to take your file, don't panic. The worst thing you can do is post your passphrase and/or unencrypted wallet online.