Hardware gated Salvium wallet with post-quantum encryption at rest
checksums-sha256.txt file on the release page.If you have not used a Salvium wallet before, the Salvium documentation explains the privacy model, the view key vs spend key distinction, and how transactions work.
There are several ways to hold Salvium. WhiskyWallet exists because the available options did not solve a specific problem the right way: how to give users meaningful at rest protection for their spend key, on hardware they actually own, without depending on a hardware wallet vendor's permission to ship.
The conventional answer is a hardware wallet. WhiskyWallet investigated that path thoroughly. Tangem cards do not expose the cryptographic primitives Salvium needs. Ledger requires a third party security audit costing tens of thousands of dollars per submission, repeated on every update. Trezor has paused integration of new coins indefinitely. Each of these gatekeepers has a structural reason that small ecosystems cannot scale through.
The WhiskyWallet answer inverts the question. The spend key remains in software, but the wallet file is encrypted at rest with a wallet master key derived from strong cryptographic primitives. That key can optionally be derived from a FIDO2 hardware authenticator, gating wallet decryption on the user's physical presence with the key. This is implemented on desktop and Android today. The authenticator never holds the spend key, but unlock requires the user to touch it.
This is not a hardware wallet. It is a hardware gated wallet. The threat model is different and the document at whiskymine.io/wallet-fido2-rfc.html is honest about what each approach protects against.
hmac-secret extension, vendor agnostic across YubiKey, SoloKey, Nitrokey, Feitian, and other compliant keys.salvium: uri and the send screen fills itself.| Platform | Architectures | Status |
|---|---|---|
| Linux | x86_64 | ✓ Beta |
| Windows | x86_64 | ✓ Beta |
| Android | arm64-v8a | ✓ Beta, on Google Play |
| macOS | Intel, Apple Silicon | ◯ Planned |
| iOS | arm64 | ◯ Planned |
Every platform is built from the same Rust core with platform specific UI layers. The same seed produces the same wallet across platforms; users move between platforms by restoring from seed.
WhiskyWallet is honest about what it protects against and what it does not. This section is required reading before trusting WhiskyWallet with significant value.
The wallet file is encrypted on disk using a layered cryptographic construction.
hmac-secret output is expanded with HKDF-SHA256 in place of Argon2id.The result is that an attacker who copies a WhiskyWallet file off your disk cannot decrypt it without your PIN or hardware key, and cannot decrypt it later even with quantum computing capabilities sufficient to break classical asymmetric primitives.
For users with these threat models, FIDO2 hardware unlock raises the bar significantly by requiring physical authenticator presence at unlock time. It is available on desktop and Android today. Even then, WhiskyWallet is not a substitute for a true on device transaction signer, which Salvium does not currently have a viable path to.
WhiskyWallet does not support biometric authentication, neither through platform authenticators (Face ID, Touch ID, Android BiometricPrompt) nor through fingerprint equipped hardware keys.
Users who require biometric unlock convenience are encouraged to use a different wallet. WhiskyWallet is not trying to be a wallet for everyone; it is a wallet for users who share its assumptions.
WhiskyWallet trusts the cryptographic primitives in the underlying Rust ecosystem, the OS isolation between processes on the user's machine, and the integrity of the published binary which the user verifies via checksums-sha256.txt.
WhiskyWallet does not trust any cloud service. There is no remote dependency for any wallet operation other than blockchain sync. There is no third party transaction signing. There is no biometric implementation in the trust path.
FIDO2 unlock lets users enroll a hardware authenticator and require a physical touch to decrypt the wallet file at unlock time. The authenticator does not hold the spend key. It holds a credential that, when challenged with a stored salt, produces the wrapping key for the wallet master key. Without the authenticator, the wallet file cannot be decrypted even with full knowledge of the encrypted contents. A key is enrolled per device, since the encrypted wallet file is never copied between devices; you restore from seed and enroll the key on each device.
WhiskyWallet's FIDO2 unlock is vendor agnostic. Any FIDO2 authenticator with the hmac-secret extension will work. Tested or expected compatible models include:
hmac-secret extensionA compatibility matrix with tested results will be published as testing accumulates.
WhiskyWallet's FIDO2 unlock will not use biometric verification on hardware keys that have it (such as YubiKey Bio or Feitian K9). These keys will work in touch only mode if used with WhiskyWallet, and the wallet will warn the user at enrollment time if a biometric capable key is presented.
All releases are published on GitLab, and the Android app is on Google Play. The latest release is v0.2.8.
After downloading, verify the binary against the checksums-sha256.txt file in the same release. Do not skip this step. The verification protects against a tampered binary and is the user's responsibility.
Download the AppImage from the latest release, verify it, mark it executable, and run it.
# Verify
sha256sum --check --ignore-missing checksums-sha256.txt
# Run
chmod +x WhiskyWallet-Grid-x86_64.AppImage
./WhiskyWallet-Grid-x86_64.AppImage
A macOS build is planned and not yet distributed.
Download whiskywallet-grid-windows-x64.zip. Extract it and run WhiskyWallet.exe, a single self contained launcher.
Windows SmartScreen may warn about the binary on first launch because WhiskyWallet is not signed with an EV certificate. Click More info, then Run anyway, after verifying the SHA256 sum.
To verify in PowerShell:
Get-FileHash whiskywallet-grid-windows-x64.zip -Algorithm SHA256
Compare the output to the value in checksums-sha256.txt.
Install from Google Play, or download whiskywallet-grid-android.apk from the release page and sideload it. Android will require enabling "Install from unknown sources" for the file manager app the first time.
To verify a sideloaded APK before installing:
sha256sum whiskywallet-grid-android.apk
An iOS build is planned and not yet distributed.
WhiskyWallet is built around a portable Rust core that handles all cryptographic operations, wallet file format, and transaction construction. Platform specific layers handle UI and platform integration.
This means the wallet behaves consistently across platforms. The same seed produces the same wallet on Linux as on Android. The Rust core ensures cryptographic consistency.
WhiskyWallet is closed source. This is a deliberate choice. The wallet's threat model includes supply chain attacks, and a closed source maintainer has full control over what code is built into a release, what dependencies are pulled in, and how the binary is constructed. There are no third party pull requests to vet, no fork drift to track, no supply chain surface area introduced by community contributions.
This trade off is real. Users who require open source verification of wallet software should choose a different wallet. WhiskyWallet's commitments instead rest on:
checksums-sha256.txt for every release, so users always know they are running the binary the maintainer published.No. A hardware wallet stores the spend key on a separate device and signs transactions on that device. WhiskyWallet stores the spend key in encrypted form on your computer or phone. FIDO2 hardware unlock gates decryption on a physical authenticator touch, but the spend key still lives in software at the moment of signing.
If you need true hardware wallet protection for Salvium, no current option exists. WhiskyWallet has investigated Tangem, Ledger, and Trezor and documents the structural barriers in the Why WhiskyWallet section.
Biometric templates cannot be rotated. A fingerprint or face that is compromised cannot be changed, so a leaked biometric is a permanent compromise of that authentication factor. Biometrics also have weaker legal protection against compulsion than knowledge based authentication in many jurisdictions. WhiskyWallet does not believe these tradeoffs are appropriate for a wallet that holds value.
Salvium has a specific cryptographic profile (Carrot v1, RingCT, key images) and a specific community. Multi-coin wallets dilute the security and usability of every coin they support. WhiskyWallet does one thing well rather than many things adequately.
Telemetry collects information about users that the project does not need. WhiskyWallet has no analytics, no error reporting beyond what the user chooses to share, and no remote configuration. The wallet works the same with or without internet connectivity, other than blockchain sync.
The only correct way to back up a WhiskyWallet is to record your seed phrase, securely, offline. Your seed is shown to you when you create or restore a wallet, and you can re-display it from the wallet's settings while the wallet is unlocked. Write it down on paper, store it somewhere safe, and never enter it into a computer or photograph it.
Do not attempt to back up the wallet by copying files. WhiskyWallet's data at rest is encrypted with post-quantum cryptography and is not designed to be portable, restorable, or interpretable outside of the application. The seed phrase is the only supported recovery artefact.
Yes. Restore from your seed phrase on each platform you want to use. Open WhiskyWallet on the destination device, choose restore from seed, enter your seed, set a PIN, and the wallet rebuilds. The same seed produces the same wallet everywhere.
Do not attempt to copy wallet data files between devices. WhiskyWallet's data at rest is encrypted with post-quantum cryptography and is not designed to be portable across installations. Restore from seed is the only supported workflow.
No. WhiskyWallet is closed source. The maintainer retains full control over what code is built into each release, which is part of WhiskyWallet's defence against supply chain attacks. Users who require open source verification of wallet software should choose a different wallet. See the architecture section for the full reasoning.
WhiskyWallet is built and maintained by Whisky as part of the WhiskyMine project, which serves the Salvium ecosystem. Development is funded by the maintainer's personal time and by community contributions where applicable. There is no token, no fundraising, no investor structure.
WhiskyWallet does not have a public source repository or issue tracker. Support, bug reports, and feature requests are handled through the channels below.
Whisky [SAL] in the official Salvium Discord server. The wallets channel is the appropriate venue for general WhiskyWallet questions and bug reports that are not security sensitive.When reporting a bug, please include:
Security vulnerabilities should be reported privately to the maintainer rather than discussed in public channels. Contact through Discord direct message to Whisky [SAL] is the fastest path. The maintainer aims to acknowledge security reports within 48 hours.
The WhiskyWallet privacy policy is at whiskymine.io/privacy.html. The short version: nothing is collected.
WhiskyWallet is part of the broader WhiskyMine ecosystem of Salvium tooling. Other projects and resources are at whiskymine.io. For general Salvium discussion, the official Salvium Discord and the Salvium documentation are the primary venues.