18

Cold transaction signing was recently merged into master. How would one go about using it?

For those who don't know, this feature allows you to:

  1. Create and export an unsigned transaction on an online machine, with a watch-only wallet.
  2. Sign and export the transaction on an offline machine with all your secrets.
  3. Submit the signed transaction to the intertubes back on the the online machine.
10

You need to have a cold and hot wallet pair for the same account.

In the hot wallet, make a transaction. It doesn't have the spend key, so instead of actually sending the transaction to the Monero network, it will save the necessary information to a file called unsigned_monero_tx (no choice of name for now).

Next step is to transfer that information to the cold wallet's computer. Depending on your degree of security, you may use a USB drive, transcribe it by hand, or find some file transfer program that uses QR codes, or whatever else you want.

On the cold wallet, run sign_transfer. This will load that file, and display the details of the transaction, then prompt you whether you want to sign it. If you do, the signed transaction will get written to signed_monero_tx. Which you get to copy back to the hot wallet computer.

On the hot wallet, run submit_transfer. This will relay the transaction to the Monero network, as well as update balance and spend state of the outputs.

Note that this system does not need the cold wallet to have a blockchain, as the unsigned_monero_tx contains all the information the cold wallet needs to sign the transaction. Only the hot wallet needs to talk to the daemon.

  • Does this mechanism support transaction ID's? Both after sign_transfer and submit_transfer, I did not see the transaction ID in the confirmation prompt (v0.10.0.0-38727f7 built from HEAD). – dpzz Nov 10 '16 at 1:14
  • Retried with a new address, which seemed to work.. The transaction ID is visible in the block explorer, but unfortunately, my change never returned. I would recommend extreme caution when using this experimental feature, definitely don't do it with large amounts. – dpzz Nov 13 '16 at 16:06
  • 1
    There appears to be a scanning bug for now that explains my previous comment. GitHub issue 1339 is open for this. – dpzz Nov 14 '16 at 0:14
  • 1
    FYI: All 3 issues mentions by @Tom have been resolved. – Jonathan Cross Apr 12 '17 at 1:06
  • 1
    Yep, it's all working great now. Also, the Monero GUI app (monero-core) also makes this process even simpler, if you run online (watch-only) and offline (full) wallets (although it does still have some idiosyncracies at this stage) – Tom Apr 12 '17 at 10:22
6

First, we assume you have a fully-synced node and fully-refreshed watch-only wallet on the hot computer. Also, we assume you have wallet software on the cold computer (don't need the node, just monero-wallet-cli).

  1. Using watch-only wallet, command export_outputs <filename>. There will be a file with <filename> created in the working folder*.
  2. Copy the file to the cold wallet computer.
  3. Using cold wallet, command import_outputs <filename>*. The cold wallet now has all the outputs and can prepare a signed key image for every one of them (unless something new was received after step 1. It won't display the correct balance because it can't check the spent status of the key images, as it is offline.

--- Stop here if you only want to monitor incoming transfers and don't care to see the correct balance and when something has been spent ---

  1. Using cold wallet, command export_key_images <filename>. There will be a file with <filename> created in the working folder*.
  2. Copy the file to the hot wallet computer.
  3. Using watch only wallet, command import_key_images <filename>*. The watch wallet is now aware of spent status for each output and it shows the correct balance (unless something new was received in the meantime, after step 1.

--- Stop here if you only want to monitor the balance with the watch only wallet. Goto 1. after each newly received funds. Continue for cold spending. ---

  1. Using watch only wallet and transfer command as you would normally, prepare an unsigned transaction. The syntax is the same as if it was a full wallet, but in this case the watch wallet will automatically save the TX to the unsigned_monero_tx file* and a message Unsigned transaction(s) successfully written to file: unsigned_monero_tx will be displayed.
  2. Copy the file to the cold wallet computer.
  3. Using cold wallet, command sign_transfer, to sign and export the transaction. Note that the wallet will look for the file to sign in the working folder*. The signed transaction will be automatically saved to the file* signed_monero_tx and a message Transaction successfully signed to file signed_monero_tx, txid ... will be displayed.
  4. Copy the file to the hot wallet computer.
  5. Using the watch wallet, command submit_transfer and the transaction will be sent to the network. The signed_monero_tx file* must be located in the working folder so it can be found by the wallet. A message Money successfully sent, transaction: ... will be displayed.
  6. Goto 1. because you need the signed key image for the change output.

*Note on folders and file locations, as it could create some confusions. The wallet will look for the files and export them to the folder from where it was started, ie where your command prompt / shell was when you called monero-wallet-cli. It may or may not be the same folder as your actual wallet files or monero-wallet-cli, depending on how you go about it.

For example, your wallet could be on some USB drive like f:\temp\, and your wallet software on c:\monero\ and your shell working folder could be c:\.

If you remain in c:\ with the shell, you could start the wallet by its full path and specify the wallet file location: c:\monero\monero-wallet-cli.exe --wallet-file f:\temp\mywallet. In this case, all the import/export stuff would be read/written to c:\ because that's still your shell's working folder.

It would be probably feel more natural to cd into the wallet folder. Do f: to change drive and then cd f:\temp\. Then, simply start the wallet from that location by its full path again: c:\monero\monero-wallet-cli.exe --wallet-file mywallet. Notice how you don't have to write the full wallet path now as you're already there with your shell. In this case, all the files mentioned above would be written or read from the same folder as the wallet files.

  • Great thorough writeup, thanks! – Tom Dec 21 '17 at 18:08

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.