What is the safest method to create a Monero wallet for cold storage?

Question

If I want to create a Monero wallet in the most secure manner possible, what are the best practices in doing so?

Are there any written user guides or video demonstrations of this process?

Answer 1

Ok, here is another version. It's not perfect or detailed and it will probably need some additional research.

Preparation:

1. Get an old computer (and seal its Ethernet port with duct tape – this computer will not touch the Internet again)
2. Get several fresh USB sticks
3. Wipe the old computer and the USB sticks (you can use something like DBAN to wipe everything together)
4. Remove Wi-Fi/Bluetooth cards of your old computer if possible. If not possible, deactivate them in the BIOS.
5. Get some bootable live OS. You can use Ubuntu, but more or less anything goes. (Check the PGP signature, so you know what you downloaded is correct.)
6. Download Monero. All you need is monero-wallet-cli. Put that on a stick, too. (Check the PGP signature, so you know what you downloaded is correct.)

Creating the Wallet:

7. Now boot your old computer with the live OS (only with monitor, keyboard and mouse attached). You can also install the OS, depends on your level of paranoia/convenience.
8. Copy monero-wallet-cli to your old computer. If you run a live OS, the locations you have to copy the executable to might differ (Google is your friend). Also how to mount the USB stick might need some research.
9. In case it doesn't work, install the OS. Since it won't "phone home", this is ok too.
10. Now run monero-wallet-cli. It will create you a fresh wallet. If you intend to save it digitally too (as a .keys file), give it a proper password when asked.

Voilà, you have created your complete secure cold wallet. But wait, it's not done yet.

Data to save:

Now these steps are very important. You have different data to save now. Since most of the data is not allowed to ever touch a computer connected to the Internet again, I would use at least two different USB sticks here.

11. Check your address in monero-wallet-cli (use command address). This is your public address and it is allowed to touch the internet. Copy it to a textfile on USB 1.

12. Now check your seed with command seed. You should save it as a text file on USB 2, but also have to note it down by hand several times. This is all you need to restore your account after all. Make sure the words are correct and that the number/sequence is right, too.

13. In the folder where you ran monero-wallet-cli, three files got created. Copy the .keys file to USB 2.

14. Optionally, you can also save your view key (maybe put it on another USB, so you can decide later how and when it touches another computer)

15. It is also wise to note down the seed together with the monero-wallet-cli version. You can check it with ./monero-wallet-cli --version.

The process is now basically finished. Of course there is lots of variance. You can go with a paper wallet only, by just not doing USB 2 and just keeping the handwritten seed as the only backup. USB 2 should only touch offline computers. Turn off your computer, wipe it again if it was not a live OS, and keep your seed and USB 2 safe.

Please do practice the creating and restoring process before sending any meaningful amount to such a cold wallet

Answer 2

In essence, the most secure method would be to create a live bootable OS on a USB stick, access it on a machine that is not connected to the internet, and then generate your mnemonic seed and address using a GPG-verified program.

But for an actual, detailed response, instead of copy/pasting someone else's guide entirely, I'll refer you to the extensive guide from one of our more fantastic community members, dEBRUYNE:

https://www.reddit.com/r/Monero/comments/48cgmd/an_extensive_guide_for_securely_generating_an/