Tolkien's word for a thing kept but not used. Held in the Mathom-house at Michel Delving, taken out rarely, never thrown away. Which is what a master key is.
A hardened, QR-first overlay on drduh/YubiKey-Guide's NixOS live ISO. Turns any laptop with a removable radio into a dedicated offline machine for PGP master key custody, subkey provisioning, and release signing.
Mental model: this is not a computer you use. It is a vault you visit.
A Thurin Labs project. Thurin identity rests on a PGP key: Signet attests it to an Ethereum address, the Scry explorer displays it, and the identity card embeds it. mathom is where that key is generated and kept.
Depends on whether the radio comes out. Be honest about which tier you're on - the claims are genuinely different:
| Tier | Measure | Claim you can defend |
|---|---|---|
| 1 | WLAN card physically removed | No network interface exists |
| 2 | Antennas disconnected + kernel built without radio drivers + lockKernelModules |
No network interface can be brought up |
| 3 | Generated module blacklist only | No network interface is configured |
Older business laptops (ThinkPad T/X, Latitude, EliteBook) usually have the
WLAN in an M.2 or mini-PCIe socket → tier 1. Many modern ultrabooks solder it
or split it into the chipset (Intel CNVi) → tier 2 at best. Run
tools/vault-survey on a candidate machine (or boot
this ISO and run vault-survey) for a provisional assessment — but software
cannot see solder; the definitive test is a screwdriver.
This ISO defaults to tier-appropriate hygiene either way: a module blacklist generated from the kernel tree at build time, every network service off, no web server, console only. The security property is the hardware you removed; the software is defense in depth.
- An overlay, not a fork. The upstream flake - community-tested, actively
maintained, with the full guide baked into the image is inherited via
extendModules.mathom-overlay.nixis the entire diff, and it is meant to be read. - QR-first transport.
qrencode/zbarin both directions, chunked with indexed envelopes and checksums (qr-out/qr-in/qr-joinon the vault,online/qr-sendandonline/qr-recvon your everyday machine). No electrical path ever exists between the online machine and this one. - LUKS container helpers (
vault-open/vault-close/vault-backup) so secrets live in one backup-able encrypted file on an SD card. - Session discipline: clock enforcement (
vault-clock), no suspend/hibernate, lid closes to poweroff, no auto-mounting, pinned inputs so rebuild-and-compare means something.
Scope: PGP custody and signing only. No wallet software, no seeds; that custody belongs on purpose-built hardware.
On an x86_64 Linux host with Nix (flakes enabled):
nix build .#iso
sudo dd if=result/iso/mathom.iso of=/dev/sdX bs=4M status=progress conv=fsyncCheck the device name twice. That's the command that eats the wrong disk.
docs/build.md- the full design and build guide: hardware selection, physical prep, media, the threat model, and what the air gap does not buy you. Read it before trusting this with real keys.docs/ritual.md- the session card. Print it, tape it inside the lid.docs/upstream-findings.md- the recorded review of the upstream flake that the overlay is adjusted against.docs/hardware/- one survey file per assessed machine. Contributions of new surveys are the easiest way to add value without touching the design.
The heavy lifting: the key-generation workflow, the guide itself, the Nix integration is drduh/YubiKey-Guide, which is actively maintained and excellent. This repo is a readable diff on top of it, nothing more.
- Thurin Labs
- GitHub
- Codeberg (mirror)