thanks!

is there an easy way to put my private key on the cdrom together with tails OS?
once booted in tails what would be safest way to sign a transaction?

Related:

BTCVault
 - http://dswd.github.io/btcvault/security.html
 - http://bt.irlbtc.com/view/163763.0

USB wallet (Puppy Linux):
 - http://bt.irlbtc.com/view/257672.0

I would go with the OS on a (not-rewritable) CD so it can't be altered in any way. From TAILS or virtually any other Linux distro you can use TrueCrypt or LUKS  (Linux native filesystem encryption) to format an encrypted partition on a USB stick. I'd recommend making several USB sticks just in case of accidental damage. I'd recommend making more than one OS CD (or keeping the ISO somewhere safe) for the same reason.

On the encrypted USB sticks, you can store a plaintext file containing your private keys, possibly along with the addresses they map to. You could also keep a copy of vanitygen or bitaddress.org on the USB sticks in case you need to make new keys, but if you're keeping multiple copies of your keys this means you'll have to come up with a way to keep each copy in sync.


If you want to use blockchain info, use a watch-only wallet. Import only your addresses as watch-only addresses, no private keys. You only put the key into your web browser's copy of your wallet (not Blockhain's encrypted copy) when you need to spend coins. It's similar to using a paper wallet, a lot of the steps are covered at https://blockchain.info/wallet/paper-tutorial

That tutorial is specific to Android and bitaddress.org but everything it shows can also be done through the web interface. Speaking of paper wallets, if you're confident that you can store the paper safely and securely (and especially if you have a web cam) you could skip the USB stick altogether and just use bitaddress.org or blockchain.info paper wallets. If you go that route you don't have to keep a bunch of USB sticks synchronized but you have to store paper and you might have to remaster the TAILS ISO to add zbar or some other QR scanning software. An alternative to webcam + zbar would be to get an actual bar code scanner that supports QR codes and plugs into USB, most of these can emulate a keyboard so no special drivers or software would be needed.

--- another way to do it (the same thing can also be done with Armory) ---

Personally I just use an old laptop with XUbuntu and Electrum installed. LUKS encryption on the hard drive so I have to enter a password to boot, another password to log in (unlocking my encrypted home folder) and a third password to unlock my wallet. With this setup, I can type "electrum deseed" from a terminal window, then copy ~/.electrum/electrum.dat.seedless to ~/.electrum/electrum.dat on another machine. This way I keep the laptop completely offline, while another computer can serve as a watch-only wallet and generate transactions for the laptop to sign. The laptop has no phone line plugged into the modem, no ethernet cable is ever plugged into it (except during installation, and unplugged permanently before I generated the wallet) and I physically removed the wifi card.

All transactions move between the online and offline machines on a LUKS encrypted USB stick, although the USB encryption is probably overkill (nothing goes on that stick that isn't going to end up on the blockchain, so it'll be exposed to the world in a couple minutes anyway).

No need for bitaddress, no need for blockchain and it's a true cold storage because the only machine capable of signing transactions never touches a network. Bonus, since Electrum wallets are deterministic I have nothing to back up except my seed, which is my choice of a 128-bit number (hexadecimal) or 12 words.