generate encrypted archive bundle; add QR code image files

[petjal]

Well, this started out about asking for QR codes, but then it morphed into the archive bundle.

It would be nice to have this utility generate an encrypted archive of a bundle of files containing all the generated data, including secrets, derivation paths, public keys and addresses, taproot something or other, etc. See https://blog.muun.com/why-not-just-a-mnemonic/

Add creation of QR code image files (png, pdf) of private and public info.

Suggest option of encryption of archive bundle to one or more public keys if available.

[grondilu]

I may look into this but probably not anytime soon, as I don't know much about it and thus it would probably require a bit of work.

[petjal]

https://www.linux-magazine.com/Online/Features/Generating-QR-Codes-in-Linux

$ sudo apt install qrencode

$ qrencode -o - --level=H 'Hello World!' | gpg --encrypt --recipient grondilu | gzip -9 > qrcode.png.gpg.gz
gpg: 061E9A95517E3DE1: There is no assurance this key belongs to the named user

sub  rsa2048/061E9A95517E3DE1 2014-03-31 Lucien Grondin <[email protected]>
 Primary key fingerprint: 09FE 832C 04B8 AF93 07B8  7190 CFCB 011D C365 7EA1
      Subkey fingerprint: 7F54 F71F 7F38 A44B 51C4  D0E3 061E 9A95 517E 3DE1

It is NOT certain that the key belongs to the person named
in the user ID.  If you *really* know what you are doing,
you may answer the next question with yes.

Use this key anyway? (y/N) y

qrcode.png.gpg.gz

[grondilu]

Well ok apparently creating a qrcode is simple enough, but what data would you like to encode, and in which format?

Note that I'm pretty sure encoding private data as a qrcode would be a terrible idea.

[petjal]

My current task is to move my holdings from my handful of hot wallets on my phone, each to a single public address in my soon-be-created offline cold wallet, perhaps generated with bitcoin-bash-tools.

I think it would be safer and easier to use the sending wallets to scan the QR codes of the receiving addresses, rather than trying to transcribe them. The private QR codes would hopefully make it easier and safer to restore the cold wallet many years from now.

I expect to store all the cold wallet public and private strings and QR codes piped directly into a strongly encrypted files (never touching disk or screen).

Attached are example encrypted QR code png files from the "input" I pasted at the "read" prompt. Input copied from output of https://github.com/iancoleman/bip39/releases/download/0.5.4/bip39-standalone.html

Simple proof of concept:

$ read input ; echo "$input" | tr ',' '\n' | while read line ; do qrencode --output - --level=H "$line" | gpg --output $(echo "$line" | sha256sum | cut -c 1-8).png.gpg --encrypt --recipient 2094685D6963005C38C062AFDF13BCA5502AA02E ; done

actor october pipe health foster improve awful open great illness kitchen canvas,b1208bc5cb8bd688fe1ebba8dc5fde7cc94493e440ca35f3ba0381f0cb6e60b3d4d600636a967ac42d5a0555c29a77741acf4961c479ea29d8ccfd7c4bd99e97,zprvAWgYBBk7JR8Gjca1R9Qak2rVJvfs9pGunKWeNvS4Zg9v1gB1NiUtZaWPwQVThNcxNFvYArm32Z66pJrUhQ3Mh17xZTUsXv6QPT3YZpABcyj,artwork crack risk winner gate beauty lab disease dad crowd film step,zprvAcP7mqYxEh6muaDuwBNVQzFRKUkjXqk3YkGF4ha8S5WbRmQXfquCCvvD3gCKXWrf4yT6jERtsjZQcW2WzXCu63ziiBBqxdiFfVegRXkXd88,zpub6qNUBM5r54f584JP3CuVn8C9sWbDwJTtuyBqs5yjzR3aJZjgDPDSkjEgtveMzKaRkdmDavN8hXZRfNRsL63CgFna2HyNbrKFc48cS2h6eJP,m/84'/0'/0'/0,zprvAf5QHMsjNzbHMweJjwAqDRQA48XEboaQim4JxsfEQmPrnrJEgHLpbU1133y5MHLb36Q7emLr8yDk9iKy2tCruZYt7mimLohuYWTpQaVHRu2,zpub6t4kgsQdDN9aaRimqxhqaZLtcAMj1GJG5yyumG4qy6vqfedPDpf59GKUtJF6bf5ERB1odkxpbiHQ1iC3VuETLmYdKHE7M4hAMrukoRK5G6j,m/84'/0'/0'/0/0',bc1qdcvsg5m4ckslhnns9unvdgthv8qu6wunsx4tgn,021beaf17e4feef24af83bf6add2c52a863e58ef58cd9df284f16bf2a27e262205,L1XUq4gJTwYHkDyzxdYnkn7twJuWSCeeEwSrXv7QLFG9Pb3WP5Es

$ ls

032a230d.png.gpg  1acc8fde.png.gpg  4ae9c7ae.png.gpg  87069511.png.gpg  99fb79d5.png.gpg  c51b4238.png.gpg  ce20b9ba.png.gpg1126ce9d.png.gpg  1b63e160.png.gpg  6f54a1b2.png.gpg  87c52ba7.png.gpg  b0bdfc05.png.gpg  c77396a8.png.gpg  [email protected]_key.gpg

$ tar czf test.tar.gz *.gpg

test.tar.gz

Test private key also provided here as a convenience for testing; password = password

TODO: pipe "input" through "gpg --encrypt" as well.

Something like that.

[grondilu]

I expect to store all the cold wallet public and private strings

You only need to store the master private key, and only that key needs to be encrypted (though if you store some of its private children, you should also encrypt them, but again you have no reason to store them).

There is not much point in storing a public extended key, though if you do it should indeed be encrypted, not to protect your funds but to protect your privacy (leaking a public extended key reveals all its non-hardened public(I think ?) child keys).

Edit: Now that I think about it, I realize there are actually quite a few reasons to store children keys, both private and public. You want to store you master key in a safe place and you want to avoid having to access it as much as possible. Thus it makes sense to store some of the children and access those preferentially. I'm no expert whatsoever in HD wallet standard practices though, so please do ask around.

I still don't quite see how qrcodes are useful. They are convenient for a smart phone but you can still copy-paste a bitcoin address easily enough.

If you want to store all your funds in a cold wallet, you only need a bitcoin address, which you can obtain from your master key. Then there is no need whatsoever to encrypt that bitcoin address, and encoding it in a qrcode is only marginally more convenient.