I am currently in the process of setting up an air-gapped computer which will be dedicated to managing cryptographic key (including: generation of GPG key/subkey, management of a small CA, generation of SSH key).

I am wondering if there are OS already existing that are dedicated to this purpose. I see multiple things that can be nice to have for this kind of computer:

  • no support for any network driver
  • a well design entropy generator (since there will not much entropy source)
  • common cryptographic tool coming pre-installed

And certainly more things to take care that I can come up with or know about.

I took a look at those OS:

  • Tails: come with a lot of tools ,plus it support a read-only OS with persistent encrypted data; but more dedicated to safe surf.
  • DEESU/Liberté linux: pretty interesting, seems to support customization, but seems to be quite old now. (At least the last binary release)
  • OpenBSD: last time I played with it, it was pretty easy to deactivate driver in the kernel. But need to be modified/customized since the default install is pretty bare.

Is there any project or other OS I am not aware of that will fit the role of air-gapped computer?

Thank you for any pointer on this.


As far as I am aware there are none, it's quite a specific niche. Nevertheless it should be easy to configure any of the BSDs/Linux Distro's to serve your needs.

I speak mostly from FreeBSD experience but it should be pretty similar for other BSDs and Linux. It's easy to compile a kernel and just deselect all networking stuff. On an average cpu this takes 3-5 minutes for Freebsd. Probably even faster if you exclude a lot of things. In addition to this you could disable the network ports in the bios.

But you should be asking yourself what your threat model is and whether you want 'online' or 'offline' signing/key generation. If your threat model includes local attackers, do you even want a system that is running continuously? Vulnerable to cold boot attacks, badusb attacks and bios exploits?

If I were to setup a separate air gapped system, I would simply use a tails or freebsd live cd. Use a write once cd-r/dvd-r. After you've written it you can confirm on multiple independent machines via checksums that you have a live cd that has not been tampered with. Now use this live cd to boot on your 'air gapped' hardware and once booted you decrypt an hard drive with your secret keys and you can do your operations.

Advantage of using a live cd is that you can keep it updated by simply creating a new one that has patches included. If you were to setup a separate system without networking it would be tricky to keep updated/secure. By only booting the live cd when necessary and thus leaving the hard drive offline and encrypted you also avoid being vulnerable to cold boot attacks or other local host attacks against a running system.

So some food for thought, first properly define what your threat model is; who or what are you looking to defend against? And then address that.

Another solution could be something like a usbarmory, it's a fully functional computer with no input devices other than usb. Very tamper proof and small enough that you're able to keep the device with you at all times.

Now let's talk about entropy. There is a variety of things you could do here, obviously the more entropy the better. I think the random number generator of neither Freebsd, OpenBSD or Linux can be considered vastly superior to the others. They're all quite solid.

Some extra reading material: RNG of Linux, RNG of OpenBSD and RNG of FreeBSD

All of them do a good job of mixing different sources of randomness. If you want extra randomness because there aren't a lot of entropy sources you could consider getting an extra separate hardware RNG, for example OneRNG.

All distros/bsds will come with OpenSSL preinstalled, OpenBSD will come with LibreSSL. LibreSSL can also easily be installed on Freebsd. So all common cryptographic operations should be doable out of the box.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.