Air-Gapped Encryption: Best Practices

What "Air-Gapped" Actually Means

An air-gapped computer is physically disconnected from all networks. No Wi-Fi. No Ethernet cable. No Bluetooth. No cellular modem. The "gap" in the name is literal: there is nothing but air between that machine and every other machine on Earth. Data can only enter or leave via physical media, such as a USB drive carried by hand.

The concept is simple, but the implication is powerful. Every cyberattack you have ever heard of, from ransomware to state-sponsored espionage, requires a network connection to work. The attacker needs a way to reach your machine (to deliver the malware) and a way to get data out (to exfiltrate what they stole). If there is no network connection, neither step is possible. The attacker would need to physically walk up to the machine and plug something in, which is a much harder problem to solve than sending a phishing email.

Air-gapping is not new. Governments have used it for decades to protect classified information. The NSA's "red/black" separation doctrine (described in NSA/CSS Policy Manual 3-16) requires that systems processing classified data be physically isolated from unclassified networks. Financial institutions use air-gapped hardware security modules (HSMs) for signing transactions. Cryptocurrency exchanges keep the majority of their holdings in air-gapped "cold wallets" that never touch the internet.

Why Air-Gapping Matters for Encryption

Encryption is only as good as the secrecy of two things: your password and your encryption keys. If an attacker gets either one, they can decrypt everything.

On a networked computer, there are many ways an attacker could steal these:

• Keylogger malware records every keystroke, including the password you type when encrypting a file. The malware sends those keystrokes to the attacker over the internet.
• Remote access trojans (RATs) give an attacker live access to your machine. They can wait until you decrypt a file, then copy the decrypted contents from memory or disk.
• Supply chain attacks compromise the encryption software itself. A trojanized version might look and behave normally but silently send your keys to an attacker.
• DNS exfiltration can smuggle data out through ordinary-looking DNS queries, bypassing most firewalls. Even if you block all obvious network traffic, a compromised program can encode your password as a series of DNS lookups.

Air-gapping eliminates all of these attack vectors simultaneously. If the machine has no network connection, malware cannot send your password anywhere. A RAT cannot call home. A supply chain attack cannot exfiltrate keys. DNS exfiltration has no DNS server to talk to.

The machine becomes a sealed vault. Data goes in, gets encrypted, and encrypted data comes out. Nothing else leaves.

How QNSQY Enforces Air-Gapping on Linux

Simply disconnecting your Wi-Fi is not a true air gap. Software can reconnect Wi-Fi, enable a hidden Bluetooth adapter, or use a cellular modem you did not know existed. The air gap needs to be enforced at a level that software cannot override.

On Linux, QNSQY's CLI uses seccomp-bpf (Secure Computing mode with Berkeley Packet Filter) to block all network system calls at the kernel level. This is not an application-level setting or a firewall rule. It is an instruction to the Linux kernel itself: "if this process attempts any network-related system call, kill it immediately."

Here is what that means in practice. When you run:

qnsqy encrypt -i secret.txt

QNSQY installs a seccomp-bpf filter before doing any cryptographic work. This filter tells the kernel to block system calls like socket(), connect(), sendto(), recvfrom(), and sendmsg(). These are the low-level functions that every network operation on Linux must use. Without them, no program can open a network connection, period.

The enforcement is absolute. If any code inside the QNSQY process, whether it is QNSQY's own code, a compromised library, or injected shellcode, attempts to make a network call, the kernel does not return an error. It kills the entire process with the SIGKILL signal. There is no way for the process to catch this signal, ignore it, or recover from it. The process simply ceases to exist.

The seccomp filter is also one-directional: once installed, it cannot be removed or weakened. Even if an attacker gains full control of the QNSQY process, they cannot disable the filter or add exceptions to it. This is a kernel guarantee, not an application promise.

What Happens If Code Tries to Phone Home

Imagine a worst-case scenario: a compromised dependency inside QNSQY tries to exfiltrate your password to an attacker's server. The call chain would look like this:

1. Malicious code calls connect() to establish a TCP connection to the attacker's server.
2. The kernel intercepts the connect() system call before it executes.
3. The seccomp-bpf filter matches connect() against its block list.
4. The kernel sends SIGKILL to the process. The process is terminated instantly.
5. The TCP connection is never established. Zero bytes are transmitted. The password is safe.

This is not a theoretical protection. The seccomp-bpf filter is the same technology used by Chromium's sandbox, Docker's default security profile, and Android's app sandbox. It is battle-tested in production at enormous scale.

All Platforms: Zero Telemetry by Design

Even on platforms where kernel-level network blocking is not available, QNSQY is designed to never contact the internet during normal encryption or decryption operations:

• No automatic update checks. QNSQY never checks for updates in the background. You download updates manually from the website.
• No analytics or telemetry. There is no code in QNSQY that collects usage statistics, crash reports, or performance data. Zero data is sent anywhere.
• No license verification during crypto operations. Your tier status is cached locally. The only network communication is to the billing API when you explicitly log in or check your subscription.
• Full offline operation. Every encryption, decryption, signing, verification, hashing, and shredding operation works without any internet connection.

The only exception is the qnsqy login command, which contacts the billing API (billing.quantumsequrity.com) to authenticate your account. This connection uses PQC envelope encryption (ML-KEM-1024 + X25519 + AES-256-GCM) and transmits only authentication tokens, never file contents, passwords, or keys.

Setting Up an Air-Gapped Workflow

There are three approaches to air-gapped encryption, each with different levels of security and convenience.

Option 1: Dedicated Offline Machine (Maximum Security)

This is the gold standard, used by governments and military organizations for classified data.

1. Acquire a dedicated machine that has never been connected to any network. A used laptop with its Wi-Fi card physically removed works well. Some organizations buy purpose-built air-gapped workstations with all wireless hardware removed at the factory.
2. Install the operating system from verified media. Use an official Linux ISO (Fedora, Ubuntu, or Debian) written to a USB drive. Verify the ISO checksum against the distribution's published hash before writing it.
3. Install QNSQY from a USB drive. Download the .deb or .rpm package on a separate, internet-connected machine. Copy it to a USB drive. Walk the USB drive to the air-gapped machine and install it: sudo dpkg -i qnsqy_7.2.35-1_amd64.deb
4. Transfer files to encrypt via USB. Copy your sensitive files to a USB drive and bring them to the air-gapped machine.
5. Encrypt on the air-gapped machine. Run qnsqy encrypt -i secret.txt as normal.
6. Transfer the encrypted files out via USB. Copy the .qs files back to the USB drive. These encrypted files are safe to store on networked systems.
7. Shred the unencrypted originals on the air-gapped machine: qnsqy shred secret.txt -f

This workflow ensures that unencrypted data never touches a networked machine. Even if every other computer in your organization is compromised, the air-gapped machine and the data processed on it remain safe.

Option 2: Temporary Air Gap (Good for Occasional High-Security Operations)

Sometimes you need air-gapped security but do not have a dedicated offline machine. You can temporarily air-gap your regular computer:

1. Disconnect from all networks. Turn off Wi-Fi (do not just disconnect; turn off the adapter entirely). Unplug Ethernet cables. Disable Bluetooth. On Linux: nmcli networking off && rfkill block all
2. Verify disconnection. Run ip link show and confirm all network interfaces are DOWN. Try ping 8.8.8.8 and confirm it fails.
3. Perform your encryption/decryption. On Linux, the seccomp sandbox provides kernel-level enforcement regardless of your manual network state.
4. Shred any temporary files that were created during the operation.
5. Reconnect to the network only after sensitive data is no longer in memory or on disk in unencrypted form.

This approach is weaker than a dedicated offline machine because the computer has been on a network before and may already have malware installed. The seccomp sandbox mitigates this (malware cannot exfiltrate during the QNSQY process), but malware could potentially capture data before or after the QNSQY process runs.

Option 3: Virtual Machine Isolation (Convenient for Regular Use)

A virtual machine with no network adapter provides a software-defined air gap:

1. Create a VM with no network adapter. In VirtualBox, VMware, or QEMU/KVM, remove or disable all network adapters in the VM settings. Do not use NAT, bridged, or host-only networking. The VM should have zero network interfaces.
2. Install QNSQY inside the VM. Use shared folders (not network shares) to transfer the installer.
3. Transfer files via shared folders. VirtualBox's "Shared Folders" feature and VMware's "Shared Folders" both work without network connectivity, using the hypervisor's paravirtualized interface instead.
4. Encrypt inside the VM. The VM has no network interfaces, so even if malware compromises the VM, there is no network to exfiltrate through.

This is the most convenient option for regular air-gapped work. The VM starts in seconds, the shared folder provides easy file transfer, and you do not need dedicated hardware. The security is weaker than a physical air gap because a hypervisor escape vulnerability could theoretically bridge the gap, but such vulnerabilities are rare and highly valuable.

USB Transfer Best Practices

The USB drive is the bridge across the air gap. If that bridge is compromised, the air gap is meaningless. Follow these practices:

• Use write-protected USB drives when transferring data TO the air-gapped machine. Hardware write-protection (a physical switch on the drive) prevents malware on the air-gapped machine from writing itself to the USB drive and spreading to other machines.
• Use dedicated USB drives that are never plugged into untrusted machines. Ideally, maintain two sets: "inbound" drives (for bringing data to the air-gapped machine) and "outbound" drives (for taking encrypted data out).
• Format drives between uses. After each transfer, format the USB drive completely. This prevents data remnants from previous transfers from leaking.
• Consider USB data blockers (sometimes called "USB condoms"). These devices physically disconnect the data pins on a USB cable, allowing only power to pass through. Use these when you need to charge a device from the air-gapped machine without risk of data transfer.
• Verify file integrity after transfer. Use qnsqy hash -i file.txt on the source machine and qnsqy hash-verify -i file.txt --hash <hash> on the air-gapped machine to confirm files were not corrupted or modified during transfer.

Platform Limitations: An Honest Assessment

Kernel-level network blocking with seccomp-bpf is a Linux-only feature. Here is the honest picture on each platform:

• Linux CLI: Full kernel-level enforcement. seccomp-bpf blocks all network system calls. This is the strongest air-gap enforcement available. Even root cannot override the seccomp filter once installed.
• Linux GUI: Cannot use full seccomp network blocking because the GUI needs sockets to communicate with the display server (Wayland). Landlock filesystem sandboxing is still applied. For maximum security on Linux, use the CLI.
• macOS: Uses Apple's deprecated sandbox_init() API, which provides weaker guarantees than Linux seccomp. Apple has not provided a modern replacement with equivalent capabilities. For true air-gapped security on macOS, physically disconnect from the network.
• Windows: There is no kernel-level mechanism to block network access from within an application. Windows applications can use Windows Firewall rules, but these can be disabled by other software running as Administrator. For air-gapped security on Windows, you must physically disconnect the machine from all networks.

This is why the QNSQY website and documentation state "Air-Gapped*" with an asterisk: kernel-level enforcement is Linux CLI only. On other platforms, air-gapping depends on physical disconnection, which QNSQY cannot enforce programmatically.

Advanced: Hardening the Air Gap

For environments handling classified, military, or life-safety-critical data, the basic air gap can be strengthened further:

• Physically remove network hardware. Open the machine and disconnect the Wi-Fi card and Ethernet adapter. Remove Bluetooth modules. A software-disabled adapter can be re-enabled by software; a physically absent adapter cannot.
• Disable wireless in BIOS/UEFI. Even with the hardware removed, disable wireless options in the firmware settings and set a BIOS password to prevent re-enabling.
• Use a Faraday cage or shielded room. Radio-frequency signals can be used to exfiltrate data from air-gapped machines through electromagnetic emanations. TEMPEST-rated shielding blocks these signals. The NSA's TEMPEST program (documented in NSTISSAM TEMPEST/1-92) defines standards for electromagnetic emanation security.
• Disable audio hardware. Researchers have demonstrated data exfiltration through ultrasonic audio (frequencies above human hearing) transmitted by speakers and received by nearby microphones. Muting is not sufficient; disable the audio hardware in BIOS.
• Use power line isolation. Some academic research has demonstrated data exfiltration through power line fluctuations. A UPS (uninterruptible power supply) with power conditioning provides isolation from the main power grid.

These measures are only necessary for the highest security environments. For most use cases, the basic air gap (physical network disconnection plus QNSQY's seccomp sandbox) provides excellent protection.

Real-World Use Cases

Air-gapped encryption is used in practice by:

• Government and military organizations for classified data at all levels. NIST SP 800-123 (Guide to General Server Security) recommends network isolation for servers processing sensitive data.
• Hospitals and healthcare providers for patient records that must comply with HIPAA. An air-gapped encryption workstation ensures that protected health information (PHI) cannot be exfiltrated during processing.
• Law firms for documents protected by attorney-client privilege. A data breach of privileged communications can result in case dismissal or malpractice liability.
• Cryptocurrency custodians for cold wallet management. The private keys that control millions of dollars in cryptocurrency are generated and stored on air-gapped machines. The keys never exist on a networked computer.
• Journalists and human rights organizations for protecting sources in hostile environments. If a source provides documents about government corruption, those documents must be encrypted before they can be transferred to any networked system.
• Research institutions for trade secrets, unreleased patents, and proprietary research data. Industrial espionage is a real threat, and air-gapping eliminates the most common attack vector.

A Complete Air-Gapped Encryption Walkthrough

Here is a concrete example of encrypting a sensitive document on an air-gapped Linux machine:

# On the air-gapped machine, verify no network interfaces are active
ip link show
# You should see only "lo" (loopback) as UP

# Copy the file from USB to the local disk
cp /mnt/usb/confidential_report.pdf /tmp/

# Encrypt the file
qnsqy encrypt -i /tmp/confidential_report.pdf -o /mnt/usb/confidential_report.pdf.qs

# Verify the encrypted file was created
ls -la /mnt/usb/confidential_report.pdf.qs

# Shred the unencrypted copy
qnsqy shred /tmp/confidential_report.pdf -f

# The USB drive now contains only the encrypted file
# It is safe to transport and store on networked systems

The encrypted .qs file can be emailed, uploaded to cloud storage, or backed up to a remote server. Without the password, the contents are computationally inaccessible, protected by ML-KEM-512 + X25519 hybrid key encapsulation and AES-256-GCM authenticated encryption.

Sources

1. NIST SP 800-123: Guide to General Server Security - https://csrc.nist.gov/pubs/sp/800/123/final
2. Linux kernel seccomp documentation - https://docs.kernel.org/userspace-api/seccomp_filter.html
3. NSA Systems Security Engineering (air-gap guidance) - https://www.nsa.gov/Cybersecurity/
4. NIST FIPS 203: ML-KEM Standard - https://csrc.nist.gov/pubs/fips/203/final
5. NIST SP 800-53 Rev. 5: Security and Privacy Controls (SC-7 Boundary Protection) - https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

Related Articles

• Linux GUI Security: Achieving 100/100
• Getting Started with QNSQY CLI
• Post-Quantum Cryptography for Government and Defense