Re: [bitcoin-dev] Proposal for Palindromic (Reversible) Mnemonics

[Steven Hatzakis via bitcoin-dev]

Hi Michael, thanks for the feedback.
To answer your question, the motivation was partly that some applications
do not accept passphrases, making mnemonics less versatile in those cases
in terms of vault separation when logging in to those services, although I
agree in that specific context reversible mnemonics don't add further
security (like a passphrase can) but it shouldn't lessen security either
(in terms of entropy and bit-security).

Of course, If someone finds a plaintexts recovery phrase (i.e. hacker) then
there is no security to prevent the funds being moved out whether it is
reversible or not (unless again a passphrase was present, and even that can
be brute forced so protecting the words are key) unless it represented some
multi-sig key or was a Shamir secret share (such as is being proposed under
SLIP0039 by Satoshi Labs, and Ian Coleman hosts a prototype).

I think comparable to vanity addresses, reversible mnemonics could be part
novelty, but I do think there is also an actual utility. I am not
suggesting they are used 100% of the time, rather a user could choose to
generate one manually or check if their existing one is already reversible.
Those options could be provided at the software level and then it would be
up to the user to chose. Bottom line, I think that users who have smaller
amounts in hot wallets could find it useful to have reversible mnemonics
for switching from one service to another without having to access yet
another mnemonic. Whereas, for those creating them offline (cold storage)
it could provide an additional vault and additional passphrase options.
Here's an example:

Vault #1 normal mnemonic
Vault #2 normal mnemonic w/passphrase
Vault #3 reversed mnemonic
Vault #4 reversed mnemonic w/passphrase


Best regards,

Steven Hatzakis


On Tue, Dec 4, 2018 at 4:16 PM Michael Dunworth  wrote:

> Cool idea, and appreciate the explainer surrounding it!
>
> What are the motivators to have it? Simplifying the recovery process
> (easier to remember?) - Would love to know more from that if you're happy
> to share! That'd help gauge the security considerations.
>
> Security thoughts:
> - Probability of guessing is one thing, probability of getting access to a
> keyword/phrase is another thing. So if the recovery/accessibility becomes a
> motivator, that then can broaden the attack vectors pretty significantly.
> Which would result in a significant decrease in the security (IMO?).
> - Broadcasting the use of reversable mnemonics would become an attack
> vector potentially. Now any members of the security team or members within
> close proximity could learn that reversible phrases are used, and
> insulating this information from becoming public knowledge would become
> it's own security consideration. If it's already a 6.25% (1/16) chance
> they're reversible, I wouldn't want it publicly known that it's a 100%
> chance.
> - Feels like it could be useful in terms of a "duress password" although
> that might be implemented similarly to what Joseph mentioned where you
> would route the reverse phrase to somewhere other than the core assets.
>
> May be misunderstanding or have bad maths this early in the morning, but I
> think I'd be nervous to implement something like this without a pretty
> clear upside. Seems like it only adds additional risk?
>
> Thank you.
>
> Kind regards,
>
> Michael.
> ᐧ
>
> On Tue, Dec 4, 2018 at 5:11 AM Steven Hatzakis via bitcoin-dev <
> bitcoin-dev@lists.linuxfoundation.org> wrote:
>
>> Thanks, James and Joseph, for the feedback,
>> It has been a fun experiment!
>>
>> I just want to note that the plausible deniability was not the motive but
>> just an example use-case, there are perhaps other use-cases that would be
>> on the user to decide. I think having a mnemonic that is also reversible
>> could be useful for other reasons - convenience related perhaps.
>> *Re security:* I am still not convinced entirely that security is
>> reduced at all because one still has to search through all entropy in the
>> range of 2^128 to see whether any of those are reversible (unless there is
>> a way to only search the field of 2^124 that are reversible, which I don't
>> think is possible because the hash-derived checksum cannot be determined
>> before hashing, only afterward). Therefore, security should still be 2^128
>> for a 12-word mnemonic whether it is reversible or not (as one in every 16
>> people that already have one (12-word) is reversible, they just might not
>> realize it, so we can't say those are less secure).
>>
>> Best regards,
>>
>> On Tue, Dec 4, 2018 at 2:16 PM James MacWhyte  wrote:
>>
>>> I agree with Joseph. If you want plausible deniability, it would be
>>> better to simply hide the funds 

Re: [bitcoin-dev] Proposal for Palindromic (Reversible) Mnemonics

[Steven Hatzakis via bitcoin-dev]

Thanks, James and Joseph, for the feedback,
It has been a fun experiment!

I just want to note that the plausible deniability was not the motive but
just an example use-case, there are perhaps other use-cases that would be
on the user to decide. I think having a mnemonic that is also reversible
could be useful for other reasons - convenience related perhaps.
*Re security:* I am still not convinced entirely that security is reduced
at all because one still has to search through all entropy in the range
of 2^128 to see whether any of those are reversible (unless there is a way
to only search the field of 2^124 that are reversible, which I don't think
is possible because the hash-derived checksum cannot be determined before
hashing, only afterward). Therefore, security should still be 2^128 for a
12-word mnemonic whether it is reversible or not (as one in every 16 people
that already have one (12-word) is reversible, they just might not realize
it, so we can't say those are less secure).

Best regards,

On Tue, Dec 4, 2018 at 2:16 PM James MacWhyte  wrote:

> I agree with Joseph. If you want plausible deniability, it would be better
> to simply hide the funds somewhere in the HD chain. Same if you want a
> second vault tied to the same phrase.
>
> You are reducing security by eliminating all entropy that doesn't fit the
> reversible criteria, although in practice it doesn't make a difference
> because the numbers are so big. However, it doesn't seem like a very useful
> feature to have.
>
> Thanks for doing all that work though, it was fun to read about your idea
> and what you found out through experimenting!
>
> James
>
>
> On Mon, Dec 3, 2018 at 1:00 PM Joseph Gleason ⑈ via bitcoin-dev <
> bitcoin-dev@lists.linuxfoundation.org> wrote:
>
>> I have a suggestion.  If you are concerned about plausible deniability,
>> then it might make sense to just have the single mnemonic seed lead to a
>> single xprv key (as usual) and then do a private key derivation from that
>> based on a password string.  The password can be simple, as it is based on
>> the security of the seed, just as long as the user feels they need for
>> deniability.
>>
>> A simple reverse scheme like you describe would just be another thing a
>> person would know to check if given some seed so I don't see it as
>> providing much value, but I could be missing something.
>>
>> On Mon, Dec 3, 2018 at 10:45 AM Steven Hatzakis via bitcoin-dev <
>> bitcoin-dev@lists.linuxfoundation.org> wrote:
>>
>>> Hi All,
>>>
>>> I've developed a method to check if a mnemonic is also valid when the
>>> words are put into reverse order (not the entropy), where a given 12 or
>>> 24-word mnemonic could be valid both in little endian and big endian
>>> format. I've coined these "Palindromic Mnemonics", but perhaps more
>>> user-friendly is "reversible mnemonics."
>>>
>>> Purpose:
>>> A checksum-valid reversible mnemonic allows two separate vaults to be
>>> connected to the same mnemonic string of words, where all a users must do
>>> is enter the words in reverse order (the last word becomes first, second to
>>> last becomes second, and so on) to access the secondary (reversed words)
>>> vault. This utility could provide multiple use-cases, including related to
>>> combinations with passphrases and plausible deniability, as well as
>>> conveniences for those wishing to use a separate vault tied to the same
>>> string of words.
>>>
>>> Security:
>>> For any randomly generated 12-word mnemonic (128-bits of security) the
>>> chances of it also being reversible are 1/16 (I believe), as a total of 4
>>> bit positions must be identical (4 bits from the normal mnemonic and
>>> another 4 bits from the reversed string must match). For a 24-word
>>> mnemonic, those values increase to 8 bits which need to match 8 bits from
>>> the reversed string, leading to about 1 in every 256 mnemonics also being
>>> reversible. While the message space of valid reversible mnemonics should be
>>> 2^124 for 12 words, that search must still be conducted over a field of
>>> 2^128, as the hash-derived checksum values otherwise prevent a way to
>>> deterministically find valid reversible mnemonics without first going
>>> through invalid reversible ones to check. I think others should chime in on
>>> whether they believe there is any security loss, in terms of entropy bits
>>> (assuming the initial 128 bits were generated securely). I estimate at most
>>> it would be 4-bits of loss for a 12-word mnemonic, but only if an attacker
>>

[bitcoin-dev] Proposal for Palindromic (Reversible) Mnemonics

[Steven Hatzakis via bitcoin-dev]

Hi All,

I've developed a method to check if a mnemonic is also valid when the words
are put into reverse order (not the entropy), where a given 12 or 24-word
mnemonic could be valid both in little endian and big endian format. I've
coined these "Palindromic Mnemonics", but perhaps more user-friendly is
"reversible mnemonics."

Purpose:
A checksum-valid reversible mnemonic allows two separate vaults to be
connected to the same mnemonic string of words, where all a users must do
is enter the words in reverse order (the last word becomes first, second to
last becomes second, and so on) to access the secondary (reversed words)
vault. This utility could provide multiple use-cases, including related to
combinations with passphrases and plausible deniability, as well as
conveniences for those wishing to use a separate vault tied to the same
string of words.

Security:
For any randomly generated 12-word mnemonic (128-bits of security) the
chances of it also being reversible are 1/16 (I believe), as a total of 4
bit positions must be identical (4 bits from the normal mnemonic and
another 4 bits from the reversed string must match). For a 24-word
mnemonic, those values increase to 8 bits which need to match 8 bits from
the reversed string, leading to about 1 in every 256 mnemonics also being
reversible. While the message space of valid reversible mnemonics should be
2^124 for 12 words, that search must still be conducted over a field of 2^128,
as the hash-derived checksum values otherwise prevent a way to
deterministically find valid reversible mnemonics without first going
through invalid reversible ones to check. I think others should chime in on
whether they believe there is any security loss, in terms of entropy bits
(assuming the initial 128 bits were generated securely). I estimate at most
it would be 4-bits of loss for a 12-word mnemonic, but only if an attacker
had a way to search only the space of valid reversible mnemonics (2**124)
which I don't think is feasible (could be wrong?). There could also be
errors in my above assumptions, this is a work in progress and sharing it
here to solicit initial feedback/interest.

I've already written the code that can be used for testing (on GitHub user
@hatgit), and when run from terminal/command prompt it is pretty fast to
find a valid reversible mnemonics, whereas on IDLE in Python on a 32-bit
and 64-bit machine it could take a few seconds for 12 words and sometimes
10 minutes to find a valid 24-word reversible mnemonic.
Example 12 words reversible (with valid checksum each way):

limit exact seven clarify utility road image fresh leg cabbage hint canoe

And Reversed:

canoe hint cabbage leg fresh image road utility clarify seven exact limit


Example 24 reversible:

favorite uncover sugar wealth army shift goose fury market toe message
remain direct arrow duck afraid enroll salt knife school duck sunny grunt
argue

And reversed:

argue grunt sunny duck school knife salt enroll afraid duck arrow direct
remain message toe market fury goose shift army wealth sugar uncover
favorite


My two questions 1) are how useful could this be for you/users/devs/service
providers etc.. and 2) is any security loss occurring and whether it is
negligible or not?

Best regards,

Steven Hatzakis
___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] BIP- & SLIP-0039 -- better multi-language support

[Steven Hatzakis via bitcoin-dev]

Hi Weiji, and Everyone,

I think this is an important topic so sharing my two cents in case in
helps: It makes sense for users to know that they can't merely just
translate a word from one language into another and expect the same
underlying entropy to be mapped, as the wordlists are not the same (i.e.
words differ at the same index values across languages).

However, while the words for each language cannot translate directly to
their equivalent in another language, in terms of entropy (bits), the
underlying entropy is, in fact, the same, when comparing mnemonics
generated across languages (see English/Spanish comparison below) when
sourced from the same initial entropy.

Importantly, the entropy is a pre-image of the resulting mnemonic and
doesn't change as the language changes, where the only changes are to the
resulting words which depend on the language chosen, for a given entropy
string. Ideally, the wallet/software should deal with these nuances, I
don't think the protocol needs any revision (except for how the BIP39 seed
is derived, perhaps), even if someone made up their own wordlist, as long
as the wallet/software has a copy of it to map those words to the
underlying index values, it's *those underlying index values and the
entropy they map too is what really matters**. *

I fully support the idea for users to back up this pre-image (initial
entropy) as it can also be used to check the validity of the mnemonic and
check that it mapped correctly, see Ian Coleman's BIP39 tool which shows
index values, a feature that I proposed last year and was since
implemented. Below is an example of how two mnemonics generated with the
same entropy will produce different BIP39 seeds.

* Example initial entropy of 128 bits +4 bit checksum derived from hash of
byte array: *

10001101000 01010100100 1101101 1111101 01010001101 00010010001
0110010 10101110100 00100100011 111 01100011010 1100010 (+1110
checksum)

*In English*: minimum fee sure ticket faculty banana gate purse caught
valley globe shift

The same initial entropy above (all 132 bits) produces this mnemonic:

*In Spanish*: mercado faja soledad tarea evadir aries gafas peine búho
tumor gerente reja

And the underlying index values below are the same for both the English and
Spanish mnemonics above:

Word Indexes: 1128, 676, 1744, 1805, 653, 145, 770, 1396, 291, 1927, 794,
1582

*ISSUE AT HAND*:  While the initial entropy is the same, and word indexes
the same for a given entropy, (i.e. same pre-image), the resulting BIP39
seed is not the same when comparing the above English mnemonic with its
Spanish counterpart:

   - *English BIP39 seed:*
   
ce7618075099c89e986f18dc495daa3be190450ed07bef77d4334a54dbc1cd7e205797ffed2615ac0999a5d691f65bf316e2cdbfd2c9d7d90b03e77ff1e6a6f5
   - *Spanish BIP39 seed*:
   
9f164de0fb09af51b5831886e424d6d2479d49b5e5a1b28f5c09467ea36089b144cd94bb9b636b3c27ccff96a8958e5b7ce43cf1dea81423fc66fa7fef0aea2c


*Option 1:* Without changing anything in terms of the entropy
generation/mapping process in the BIP39 spec, the wallet/client-side
software would ideally recognize the language and show the corresponding
index value per wordlist, and reverse-calculate the entropy and then re-map
it to the language selected.

*Option 2*: Perhaps a revision is needed to how the BIP39 seed is generated
in the first place, such as by hashing the entropy instead of the words.
Any thoughts on how viable that could be where the initial entropy is fed
into the PBKDF2 function and not the words?

*Closing thoughts and tiny checksum nitpick: *

  - The multiple BIP39 seeds per language lend some similarities to
BIP44 multi-account, so perhaps this can be an advantage, depends on how it
is applied in UI/UX's (compared to having one BIP39 seed regardless of
language, for a given initial entropy).
  - There is perhaps an opportunity to add greater detail to the BIP39
spec in terms of standards/best-practices for computing checksum values, as
some software may be hashing bits, versus hashing bytes, or hashing the
entropy as a hex string, etc.. for a given entropy, which will result in
different checksum values for the same "valid" mnemonic, that might not be
"valid" in another wallet which may format the data differently before
hashing to compute the checksum.


Best regards,

Steven Hatzakis

___
[bitcoin-dev] BIP- & SLIP-0039 -- better multi-language support*Weiji
Guo* weiji.g
at gmail.com

*Tue Nov 6 16:16:41 UTC 2018*


   - Previous message: [bitcoin-dev] draft proposal: change forwarding
   (improved fungibility through wallet interoperability)
   

   - Next message: [bitcoin-dev] Considering starting a toy full-node
   implementation. Any advice?
   

   - *Messages sorted by:* [ date ]