Can you encrypt not just the private key, but also the public keys (ie bitcoin addresses) in an Armory wallet?

I would imagine that the paranoid darknety bitcoin user has an interest in keeping not only their private keys safe (so nobody can steal their bitcoins), but also has an interest in keeping their public keys safe (so nobody knows what addresses they control). With bitcoin armory, at least by default, a wallet's public information is available without any password protection when you load the program. Is there an option to encrypt all the wallet's information, so you can be safe in case, say, some jerk steals your computer and scrapes it for information about you?

B T

Posted 2014-09-25T06:31:46.340

Reputation: 1 134

Answers

I would get a Tails USB and store the Armory application and wallet files in encrypted storage. That way not only can they not tie your addresses to you, but if you access bitcoin related sites only through Tails, it would be hard to show you even know anything about bitcoin.

Tyler

Posted 2014-09-25T06:31:46.340

Reputation: 591

Ya, I'd rather not have to restart my computer just to use bitcoins tho. – B T – 2014-10-15T00:37:30.683

The main reason I recommended Tails is that it is very security hardened. You can secure your bitcoins from physical theft through encryption, but a key logger could easily steal you password and bypass the encryption. – Tyler – 2014-10-15T01:00:50.587

If you still would like to use your normal OS, then in Linux you can create an encrypted directory with encfs. I don't know how to create one on win/osx. But Google does. Whatever your platform, just create an encrypted folder and store the armory files there. – Tyler – 2014-10-15T01:03:52.093

Definitely both good ideas. If someone puts a key logger on my computer and steals all my files, I'm pretty screwed even if i have an encrypted directory tho. I need some bare-minimum convenience in my life tho, so I'm going to use encryption. I have a slightly different method I'll post as an answer. – B T – 2014-10-15T07:11:20.863

That's what I meant. The key logger negates encryption, but Tails (or another very secure OS) prevents the key logger. And once you send bitcoin from the address, your public key is known anyway. So if you want to keep the public address secret, it can't be your convenience wallet anyway. IE, once you send overstock 1btc from your address, your public key is public and linked to your identity (shipping address and your name in overstock's database). – Tyler – 2014-10-15T07:18:13.033

If I was going to spend btc frequently, I would have a sperate wallet kept at a bare minimum balance that is secured with a normal encryption/password scheme. This way, the address can be known publicly without it being known how much money you have and the larger part of your savings could be stored using the hypersecure but somewhat inconvenient method I described. – Tyler – 2014-10-15T07:22:31.633

Tyler gave the most secure answer, but what I ended up deciding to do is the following:

Create a wallet and save the backup
Re-encrypt the backup in an archive (I used 7zip) Update: 7zip has a couple security issues, and I can't recommend using it. It can leave unencrypted copies of encrypted files in temporary folders, and certain ways of adding a file into an encrypted directory can add it unencrypted and decrypt your filenames. The 7z protocol is great, but 7zip itself is shitty at encrypting stuff.
Delete the backup file with Eraser
Delete the 2 armory wallet files with Eraser (located in C:\Users\\AppData\Roaming\Armory on windows). One of the files will be named exactly the same thing as your backup, the other will be identical plus a "_backup" at the end of the filename. Make sure you don't delete the files for your other wallets.

Whenever you need to use the wallet:

A. Open the archive and copy out the wallet B. Restore the wallet in Armory C. Use it, and once you're done.. D. Delete the copied out wallet with Eraser, and the 2 armory files as in steps 3 and 4 above

Again, this isn't as safe as Tyler's suggestion of using Tails, since you are copying something to the filesystem, and using a machine that maybe has some kind of virus. I opted to choose convenience over security in that regard here.

B T

Posted 2014-09-25T06:31:46.340

Reputation: 1 134

Not to keep nagging you with negativity, but in journaling filesystems like NTFS and most used by Linux, there is no guaranteed secure way to delete files apart from wiping the whole disk/partition. See the first post by Joel (who, I believe, is a developer of Eraser): http://eraser.heidi.ie/forum/viewtopic.php?f=2&t=5481

– Tyler – 2014-10-15T07:53:29.587

2Jeez, can we live in the future already where people actually build well thought through OSs and programs? I just found out the program i've been using to encrypt (7zip) has left decrypted copies of my files in a temp folder. It sounds like i should look into an encrypted directory, since tails is too much trouble for me. – B T – 2014-10-16T01:15:50.673