I'm thinking about a way to split the bip39 words (by hand) and I would like to have some opinions on it.
The aim is to store the word list in several locations, I came with something inspired by one-time-pads.
Example with a 6 words list: wrist orient foil naive shock predict
Step 1: convert the words with their numeric index
Words (W):
1: wrist -> 2035
2: orient -> 1252
3: foil -> 723
4: naive -> 1173
5: shock -> 1586
6: predict -> 1357
Step 2: Prepare two sets, each half filled with random numbers between [0; 2047]
Set 1 (S1):
1:
2:
3:
4: random -> 1050
5: random -> 1779
6: random -> 556
Set 2 (S1):
1: random -> 1889
2: random -> 1074
3: random -> 914
4:
5:
6:
Step 3: fill the missing values of each set in order that S1[i] + S2[i] = W[i]
Set 1 (S1):
1: (2048 + W[1] - S2[1]) % 2048 -> (2048 + (wrist=2035) - 1889) % 2048 -> 146
2: (2048 + W[2] - S2[2]) % 2048 -> (2048 + (orient=1252) - 1074) % 2048 -> 178
3: (2048 + W[3] - S2[3]) % 2048 -> (2048 + (foil=723) - 914) % 2048 -> 1857
4: random -> 1050
5: random -> 1779
6: random -> 556
Set 2 (S2):
1: random -> 1889
2: random -> 1074
3: random -> 914
4: (2048 + W[4] - S1[4]) % 2048 -> (2048 + (naive=1173) - 1050) % 2048 -> 123
5: (2048 + W[5] - S1[5]) % 2048 -> (2048 + (shock=1586) - 1779) % 2048 -> 1855
6: (2048 + W[6] - S1[6]) % 2048 -> (2048 + (predict=1357) - 556) % 2048 -> 801
Step 4: write words of the sets with the values as word index
Set 1 (S1):
1: 146 -> banana
2: 178 -> bike
3: 1857 -> trend
4: random -> 1050 -> lobster
5: random -> 1779 -> tattoo
6: random -> 556 -> earth
Set 2 (S2):
1: random -> 1889 -> ugly
2: random -> 1074 -> mail
3: random -> 914 -> impulse
4: 123 -> aunt
5: 1855 -> treat
6: 801 -> goat
Advantages:
- You ends up with two sets that looks like valid bip39 words (except for checksums).
- You can do this with 2 or more sets.
- One (ore more) leaking set does not compromise the private key at all (as long as at least one is kept secret, words are safe).
- In case someone asks (if you are physically threatened) you can give the robber your 1/n part of the key, or plausibly says that you misswritten your words (bad checksum), you cannot find back the key at the moment anyway (other parts are located elsewhere).
To find back the words, you simply have to sum each set:
Words (W):
1: S1[1] + S2[1] -> (146 + 1889) % 2048 -> 2035 -> wrist
2: S1[2] + S2[2] -> (178 + 1074) % 2048 -> 1252 -> orient
3: S1[3] + S2[3] -> (1857 + 914) % 2048 -> 723 -> foil
4: S1[4] + S2[4] -> (1050 + 123) % 2048 -> 1173 -> naive
5: S1[5] + S2[5] -> (1779 + 1855) % 2048 -> 1586 -> shock
6: S1[6] + S2[6] -> (556 + 801) % 2048 -> 1357 -> predict
I'd like to know if someone sees any problem or a better solution for this case.
