# Split BIP39 words by hand

I'm thinking about a way to split the bip39 words (by hand) and I would like to have some opinions on it.

The aim is to store the word list in several locations, I came with something inspired by one-time-pads.

Example with a 6 words list: `wrist orient foil naive shock predict`

Step 1: convert the words with their numeric index

``````Words (W):
1: wrist   -> 2035
2: orient  -> 1252
3: foil    -> 723
4: naive   -> 1173
5: shock   -> 1586
6: predict -> 1357
``````

Step 2: Prepare two sets, each half filled with random numbers between [0; 2047]

``````Set 1 (S1):
1:
2:
3:
4: random -> 1050
5: random -> 1779
6: random -> 556

Set 2 (S1):
1: random -> 1889
2: random -> 1074
3: random -> 914
4:
5:
6:
``````

Step 3: fill the missing values of each set in order that S1[i] + S2[i] = W[i]

``````Set 1 (S1):
1: (2048 + W[1] - S2[1]) % 2048 -> (2048 + (wrist=2035) - 1889) % 2048 -> 146
2: (2048 + W[2] - S2[2]) % 2048 -> (2048 + (orient=1252) - 1074) % 2048 -> 178
3: (2048 + W[3] - S2[3]) % 2048 -> (2048 + (foil=723) - 914) % 2048 -> 1857
4: random -> 1050
5: random -> 1779
6: random -> 556

Set 2 (S2):
1: random -> 1889
2: random -> 1074
3: random -> 914
4: (2048 + W[4] - S1[4]) % 2048 -> (2048 + (naive=1173) - 1050) % 2048 -> 123
5: (2048 + W[5] - S1[5]) % 2048 -> (2048 + (shock=1586) - 1779) % 2048 -> 1855
6: (2048 + W[6] - S1[6]) % 2048 -> (2048 + (predict=1357) - 556) % 2048 -> 801
``````

Step 4: write words of the sets with the values as word index

``````Set 1 (S1):
1: 146 -> banana
2: 178 -> bike
3: 1857 -> trend
4: random -> 1050 -> lobster
5: random -> 1779 -> tattoo
6: random -> 556 -> earth

Set 2 (S2):
1: random -> 1889 -> ugly
2: random -> 1074 -> mail
3: random -> 914 -> impulse
4: 123 -> aunt
5: 1855 -> treat
6: 801 -> goat
``````

• You ends up with two sets that looks like valid bip39 words (except for checksums).
• You can do this with 2 or more sets.
• One (ore more) leaking set does not compromise the private key at all (as long as at least one is kept secret, words are safe).
• In case someone asks (if you are physically threatened) you can give the robber your 1/n part of the key, or plausibly says that you misswritten your words (bad checksum), you cannot find back the key at the moment anyway (other parts are located elsewhere).

To find back the words, you simply have to sum each set:

``````Words (W):
1: S1[1] + S2[1] -> (146 + 1889) % 2048 -> 2035 -> wrist
2: S1[2] + S2[2] -> (178 + 1074) % 2048  -> 1252 -> orient
3: S1[3] + S2[3] -> (1857 + 914) % 2048  -> 723 -> foil
4: S1[4] + S2[4] -> (1050 + 123) % 2048  -> 1173 -> naive
5: S1[5] + S2[5] -> (1779 + 1855) % 2048  -> 1586 -> shock
6: S1[6] + S2[6] -> (556 + 801) % 2048  -> 1357 -> predict
``````

I'd like to know if someone sees any problem or a better solution for this case.