Hardware gated Salvium wallet with post-quantum encryption at rest
SHA256SUMS file on the release page.If you have not used a Salvium wallet before, the Salvium documentation explains the privacy model, the view key vs spend key distinction, and how transactions work.
There are several ways to hold Salvium. WhiskyWallet exists because the available options did not solve a specific problem the right way: how to give users meaningful at rest protection for their spend key, on hardware they actually own, without depending on a hardware wallet vendor's permission to ship.
The conventional answer is a hardware wallet. WhiskyWallet investigated that path thoroughly. Tangem cards do not expose the cryptographic primitives Salvium needs. Ledger requires a third party security audit costing tens of thousands of dollars per submission, repeated on every update. Trezor has paused integration of new coins indefinitely. Each of these gatekeepers has a structural reason that small ecosystems cannot scale through.
The WhiskyWallet answer inverts the question. The spend key remains in software, but the wallet file is encrypted at rest with a wallet master key derived from strong cryptographic primitives. In a future release, that key will optionally be derived from a FIDO2 hardware authenticator, gating wallet decryption on the user's physical presence with the key. The authenticator never holds the spend key, but unlock requires the user to touch it.
This is not a hardware wallet. It is a hardware gated wallet. The threat model is different and the document at whiskymine.io/wallet-fido2-rfc.html is honest about what each approach protects against.
hmac-secret extension, vendor agnostic across YubiKey, SoloKey, Nitrokey, Feitian, and other compliant keys.| Platform | Architectures | Status |
|---|---|---|
| Linux | x86_64, aarch64 | ✓ Beta |
| macOS | Intel, Apple Silicon | ✓ Beta |
| Windows | x86_64 | ✓ Beta |
| Android | arm64-v8a | ✓ Beta |
| iOS | arm64 | ✓ Beta |
All five platforms are built from the same Rust core with platform specific UI layers. The same seed produces the same wallet across platforms; users move between platforms by restoring from seed.
WhiskyWallet is honest about what it protects against and what it does not. This section is required reading before trusting WhiskyWallet with significant value.
The wallet file is encrypted on disk using a layered cryptographic construction.
The result is that an attacker who copies a WhiskyWallet file off your disk cannot decrypt it without your PIN, and cannot decrypt it later even with quantum computing capabilities sufficient to break classical asymmetric primitives.
For users with these threat models, the planned FIDO2 hardware unlock raises the bar significantly by requiring physical authenticator presence at unlock time. Even then, WhiskyWallet is not a substitute for a true on device transaction signer, which Salvium does not currently have a viable path to.
WhiskyWallet does not support biometric authentication, neither through platform authenticators (Face ID, Touch ID, Android BiometricPrompt) nor through fingerprint equipped hardware keys.
Users who require biometric unlock convenience are encouraged to use a different wallet. WhiskyWallet is not trying to be a wallet for everyone; it is a wallet for users who share its assumptions.
WhiskyWallet trusts the cryptographic primitives in the underlying Rust ecosystem, the OS isolation between processes on the user's machine, and the integrity of the published binary which the user verifies via SHA256SUMS.
WhiskyWallet does not trust any cloud service. There is no remote dependency for any wallet operation other than blockchain sync. There is no third party transaction signing. There is no biometric implementation in the trust path.
When implemented, FIDO2 unlock will allow users to enroll one or more hardware authenticators and require a physical touch to decrypt the wallet file at unlock time. The authenticator does not hold the spend key. It holds a credential that, when challenged with a stored salt, produces the wrapping key for the wallet master key. Without the authenticator, the wallet file cannot be decrypted even with full knowledge of the encrypted contents.
WhiskyWallet's FIDO2 unlock is vendor agnostic. Any FIDO2 authenticator with the hmac-secret extension will work. Tested or expected compatible models include:
hmac-secret extensionA compatibility matrix with tested results will be published when FIDO2 unlock ships.
WhiskyWallet's FIDO2 unlock will not use biometric verification on hardware keys that have it (such as YubiKey Bio or Feitian K9). These keys will work in touch only mode if used with WhiskyWallet, and the wallet will warn the user at enrollment time if a biometric capable key is presented.
All releases are published on GitLab. The latest release is v0.2.0.
After downloading, verify the binary against the SHA256SUMS file in the same release. Do not skip this step. The verification protects against a tampered binary and is the user's responsibility.
Download the appropriate archive for your architecture from the latest release. Extract and run.
# Verify
sha256sum -c SHA256SUMS
# Extract
tar xf whiskywallet-v0.2.0-linux-x86_64.tar.gz
cd whiskywallet-v0.2.0
# Run
./whiskywallet
To install system wide:
sudo install -m 755 whiskywallet /usr/local/bin/
sudo install -m 644 whiskywallet.desktop /usr/share/applications/
Download the .dmg for your architecture (Intel or Apple Silicon). Open the DMG and drag WhiskyWallet to your Applications folder.
The first launch will require right click and select Open, because WhiskyWallet is not signed with an Apple Developer certificate by default. After the first launch, normal launching works.
To verify the download from the command line before opening:
shasum -a 256 -c SHA256SUMS
Download the .zip archive. Extract to a folder of your choice. Run whiskywallet.exe.
Windows SmartScreen may warn about the binary on first launch because WhiskyWallet is not signed with an EV certificate. Click More info, then Run anyway, after verifying the SHA256 sum.
To verify in PowerShell:
Get-FileHash whiskywallet-v0.2.0-windows-x86_64.zip -Algorithm SHA256
Compare the output to the value in SHA256SUMS.
Download the .apk from the release page. Sideload the APK using your file manager. Android will require enabling "Install from unknown sources" for the file manager app the first time.
A Google Play release is not currently planned. Sideloading is the supported install path.
To verify the APK before installing:
sha256sum whiskywallet-v0.2.0.apk
iOS distribution is via TestFlight during the beta period. The TestFlight link is published on the release page. Install TestFlight from the App Store, then accept the WhiskyWallet invite.
A regular App Store release is planned for a later version. The TestFlight beta is the supported install path during v0.x.
WhiskyWallet is built around a portable Rust core that handles all cryptographic operations, wallet file format, and transaction construction. Platform specific layers handle UI and platform integration.
This means the wallet behaves consistently across platforms. The same seed produces the same wallet on Linux as on iOS. The Rust core ensures cryptographic consistency.
WhiskyWallet is closed source. This is a deliberate choice. The wallet's threat model includes supply chain attacks, and a closed source maintainer has full control over what code is built into a release, what dependencies are pulled in, and how the binary is constructed. There are no third party pull requests to vet, no fork drift to track, no supply chain surface area introduced by community contributions.
This trade off is real. Users who require open source verification of wallet software should choose a different wallet. WhiskyWallet's commitments instead rest on:
SHA256SUMS for every release, so users always know they are running the binary the maintainer published.No. A hardware wallet stores the spend key on a separate device and signs transactions on that device. WhiskyWallet stores the spend key in encrypted form on your computer or phone. The planned FIDO2 hardware unlock gates decryption on a physical authenticator touch, but the spend key still lives in software at the moment of signing.
If you need true hardware wallet protection for Salvium, no current option exists. WhiskyWallet has investigated Tangem, Ledger, and Trezor and documents the structural barriers in the Why WhiskyWallet section.
Biometric templates cannot be rotated. A fingerprint or face that is compromised cannot be changed, so a leaked biometric is a permanent compromise of that authentication factor. Biometrics also have weaker legal protection against compulsion than knowledge based authentication in many jurisdictions. WhiskyWallet does not believe these tradeoffs are appropriate for a wallet that holds value.
Salvium has a specific cryptographic profile (Carrot v1, RingCT, key images) and a specific community. Multi-coin wallets dilute the security and usability of every coin they support. WhiskyWallet does one thing well rather than many things adequately.
Telemetry collects information about users that the project does not need. WhiskyWallet has no analytics, no error reporting beyond what the user chooses to share, and no remote configuration. The wallet works the same with or without internet connectivity, other than blockchain sync.
The only correct way to back up a WhiskyWallet is to record your seed phrase, securely, offline. Your seed is shown to you when you create or restore a wallet, and you can re-display it from the wallet's settings while the wallet is unlocked. Write it down on paper, store it somewhere safe, and never enter it into a computer or photograph it.
Do not attempt to back up the wallet by copying files. WhiskyWallet's data at rest is encrypted with post-quantum cryptography and is not designed to be portable, restorable, or interpretable outside of the application. The seed phrase is the only supported recovery artefact.
Yes. Restore from your seed phrase on each platform you want to use. Open WhiskyWallet on the destination device, choose restore from seed, enter your seed, set a PIN, and the wallet rebuilds. The same seed produces the same wallet everywhere.
Do not attempt to copy wallet data files between devices. WhiskyWallet's data at rest is encrypted with post-quantum cryptography and is not designed to be portable across installations. Restore from seed is the only supported workflow.
No. WhiskyWallet is closed source. The maintainer retains full control over what code is built into each release, which is part of WhiskyWallet's defence against supply chain attacks. Users who require open source verification of wallet software should choose a different wallet. See the architecture section for the full reasoning.
WhiskyWallet is built and maintained by Whisky as part of the WhiskyMine project, which serves the Salvium ecosystem. Development is funded by the maintainer's personal time and by community contributions where applicable. There is no token, no fundraising, no investor structure.
WhiskyWallet does not have a public source repository or issue tracker. Support, bug reports, and feature requests are handled through the channels below.
Whisky [SAL] in the official Salvium Discord server. The wallets channel is the appropriate venue for general WhiskyWallet questions and bug reports that are not security sensitive.When reporting a bug, please include:
Security vulnerabilities should be reported privately to the maintainer rather than discussed in public channels. Contact through Discord direct message to Whisky [SAL] is the fastest path. The maintainer aims to acknowledge security reports within 48 hours.
WhiskyWallet is part of the broader WhiskyMine ecosystem of Salvium tooling. Other projects and resources are at whiskymine.io. For general Salvium discussion, the official Salvium Discord and the Salvium documentation are the primary venues.