Air-Gapped Signing: QR, microSD and USB Compared

A signing device keeps your key away from an internet-connected machine. But the two still have to communicate: the computer sends a transaction to sign, the device sends back a signature. That channel is the remaining attack surface, and the three common designs — USB cable, microSD card, QR code — expose different amounts of it.

What air-gapped actually means

The term is used loosely. Strictly, it means no electrical or networked connection between the device and any online machine. A cable is a connection. A card carried by hand is not. A camera reading a code is not.

The distinction matters because a connection lets software on the computer address the device directly. Without one, the computer can only produce data that a human physically transports, and the device only ever sees what arrived in that package.

USB: connected, and the difference that makes

USB is the most convenient option and the only one where the host machine can talk to the device. In practice this means firmware updates, address verification and application management all work smoothly, which is why most consumer devices use it.

The exposure is that USB is a rich protocol, and the device's implementation of it is code that processes input from a machine you must assume is hostile. Vulnerabilities in that layer have historically been a productive target, not because the key was reachable but because the parsing was.

The mitigation is the screen. Whatever the host sends, the device displays what it is about to sign, and the user approves on the device. That defence is only as good as the display and the user's habit of reading it — which is why devices with screens too small to show a full address are conceding something real.

microSD: transport by hand, no protocol

With microSD, the computer writes an unsigned transaction file to a card, you move the card to the device, the device signs and writes the result back, and you carry it home. There is no data path at all.

The attack surface shrinks to the file format parser — still code, still processing untrusted input, but far smaller than a USB stack. The card itself is a physical object that could in principle be tampered with, which is a meaningfully different threat model from a remote one.

The cost is friction. Every transaction is a physical round trip, firmware updates arrive the same way, and you need a computer with a card reader. For a device used a few times a year on large amounts, that friction is close to free. For weekly use it is not.

QR: no connection, no removable media

QR signing displays the unsigned transaction as a code on the computer, the device reads it with a camera, and displays the signature as a code the computer reads back. Nothing physical passes between them.

This removes the removable-media question entirely and keeps the parser small — the device processes an image into a known data format and nothing else. It is arguably the cleanest of the three on exposure.

Two practical costs. Large transactions need several codes in sequence, which is slower and occasionally fiddly. And the device needs a decent camera and a large enough screen to display codes reliably, which pushes up the hardware cost.

The screen is the real control

Whichever transport is used, the defence against a compromised computer is the same: the device shows what it is about to sign, and you check it there rather than on the screen that may be lying.

This is why display size is a security property rather than a comfort one. A device that cannot legibly show a destination address, an amount and — for contract interactions — what the call actually does, forces users into approving without reading. At that point the transport barely matters, because the verification step that all three designs rely on has been skipped.

It also means the strongest transport paired with a poor screen is weaker than a cabled device with an excellent one, which is not the ordering the terminology implies.

Choosing

• Infrequent signing on large amounts: air-gapped by microSD or QR. The friction is paid rarely and buys the smallest attack surface.
• Regular signing and multi-chain use: USB, with strict discipline about reading the device screen every time.
• Contract interactions rather than simple transfers: prioritise the largest, clearest display you can get, whatever the transport.
• Any option: confirm the device shows the full destination address, not a truncated version you cannot meaningfully check.
• Any option: assume the computer is compromised when you decide what to verify. That assumption is the reason the device exists.