Building an Airgapped Bitcoin Laptop: Part 3 - Cryptographic Verification & Flashing Hardened Ubuntu

Why Ubuntu for an Airgapped Signer?

Some privacy purists might ask why we choose Ubuntu rather than a specialized live OS. Here is our reasoning:

• Accessibility & Broad Compatibility: Ubuntu is the most widely tested, accessible, and well-documented Linux distribution in the world. It provides out-of-the-box hardware driver support for almost any older laptop without needing an internet connection.
• Aligned with Yeti Cold 2.0: This series loosely follows the security principles of the open-source Yeti Cold 2.0 protocol, which utilizes Ubuntu as a stable, long-term support foundation for offline Bitcoin Core key storage.
• Extensible for Future Distros: Once you master this workflow, you can easily experiment with other operating systems or live distributions such as Superbacked or Tails.

Prerequisites & Files to Download

On your standard online computer (in this walkthrough, a Windows PC), prepare the following tools and files:

Step-by-Step: Cryptographic Signature & Hash Verification

Before writing the ISO to a USB flash drive, we must verify that the checksum file is authentic and that our downloaded ISO matches the checksum exactly.

Step 1: Install Gpg4win

Run the Gpg4win installer downloaded to your PC. Accept the default options, proceed through the setup wizard, and complete the installation.

Step 2: Import the Official Ubuntu Signing Keys

Open Windows PowerShell from your Start menu. Fetch Ubuntu's official image signing keys directly from the keyserver:

Allow the command a few seconds to query the keyserver and import the public certificates into your local GPG keyring.

Step 3: Verify the GPG Signature on SHA256SUMS

Navigate in PowerShell to the folder containing your three downloaded files (the ISO, SHA256SUMS, and SHA256SUMS.gpg):

Look closely at the terminal output. You should see a line that explicitly states:

Understanding the "WARNING: This key is not certified with a trusted signature": This warning is completely normal in GPG. It simply means you have not personally established a trusted web-of-trust signature on Ubuntu's key. The critical confirmation is that the signature is Good and originates from Ubuntu's legitimate key fingerprint.

Step 4: Calculate the SHA-256 Hash of Your ISO

Now that we know the SHA256SUMS text manifest is genuine, calculate the SHA-256 fingerprint of the downloaded ISO file on your local storage:

Depending on your storage speed, PowerShell will take 30 to 60 seconds to compute the hash across the multi-gigabyte image. Open the SHA256SUMS text file in Notepad and compare the generated hash string:

• Every character in the 64-character hexadecimal string must match identically.
• Once matched, you have mathematical certainty that the ISO was not corrupted during download and contains zero unauthorized modifications.

Creating the Bootable USB Drive with Rufus

With our verified ISO in hand, we burn it to an empty USB flash drive (16GB or 32GB is plenty):

1. Insert USB Thumb Drive: Plug your flash drive into your PC. Ensure any important data on this drive is backed up elsewhere, as the entire drive will be wiped.
2. Launch Rufus: Open the Rufus application. Under Device, verify that your USB flash drive is selected.
3. Select the Verified ISO: Under Boot selection, keep it as Disk or ISO image and click the SELECT button. Choose your verified Ubuntu ISO from your Downloads folder.
4. Partition & File System: Leave the partition scheme and target system at their default settings (FAT32 / default cluster size).
5. Write the Image: Click START. If Rufus presents a popup stating "ISOHybrid image detected", select the recommended option: Write in ISO Image mode, and click OK.
6. Confirm Formatting: Confirm the warning prompt that all partitions on the USB drive will be destroyed. Let the write process complete until the progress bar reaches 100% Ready.
7. Safely Remove USB: Close Rufus and safely unplug the USB flash drive from your computer.

Step-by-Step: Installing Encrypted Ubuntu on Your Airgapped Laptop

Now, bring the bootable USB drive over to your dedicated, offline laptop (such as the Lenovo ThinkPad T530 prepared in Part 2):

Step 1: Access the Boot Loader Menu

Plug the USB flash drive into one of the laptop's USB ports before turning on the computer. Press the power button and immediately tap the boot menu key repeatedly (for Lenovo ThinkPads, this is F12; on other laptops, it may be F2, F10, F11, or Esc).

From the boot menu list, select your generic USB flash disk and press Enter. When the GRUB boot menu appears, choose Try or Install Ubuntu.

Step 2: Navigate the Offline Installer Wizard

Once the graphical installer launches, proceed through the configuration steps:

• Language & Keyboard: Select English (US) or your preferred locale.
• Internet Connection: When prompted to connect to a network, select "I don't want to connect to the internet right now". (Because we physically removed the Wi-Fi card and disconnected Ethernet in Part 2, the machine is naturally incapable of connecting).
• Installation Type: Choose Interactive installation with the default minimal selection.

Step 3: Enable Full Disk Encryption (LUKS)

This is the most critical operational security setting during installation:

Step 4: User Account, Timezone & Installation

Enter your local user account details, create a computer name, and set your user login password. Select your timezone, review the summary screen, and click Install.

Ubuntu will format the internal drive, create the encrypted LUKS partition, and unpack the base operating system.

Step 5: First Boot & Post-Installation Privacy Hardening

When the installation finishes, click Restart Now:

1. Remove Installation Medium: The screen will display "Please remove the installation medium, then press ENTER". Unplug your USB thumb drive and press Enter.
2. Unlock Full Disk Encryption: On initial boot, the system will prompt you for your disk passphrase. Enter it to decrypt the drive.
3. Log In: Enter your user password to reach the Ubuntu desktop.
4. Disable Telemetry & Location: In the initial Welcome wizard, turn off Location Services, decline sending system diagnostic/telemetry reports, choose your preferred theme (Dark mode), and click Finish.

Roadmap: The 5-Part Series Overview

We are steadily transforming our second-hand laptop into an institutional-grade sovereign signing machine: