0

I know that you can create a Mnemonic + PW to encode a seed to derive keys. What I want is to encrypt an existing mnemonic with a password that generates the same seed as the unencrypted mnemonic.

Background is, that I have an existing seed sentence that I want to encrypt into an new mnemonic without changing the underlying entorpy.So I can replace my existing paper copy with an encrypted one.

Is this possible already? Or any reasons why it does not make sense at all?

Update
I came up with an proposal implementation:
https://github.com/Niondir/go-bip39/blob/master/encyrption_test.go

It uses SHA256(pw) to generate the key for an AES-CTR with an empty IV to encrypt the entropy that is derived from the mnemonic. I'm open for discussion of the parameters and ciphers, but this might not be the best place for that discussion.

Improve this question
5
  • Why not encrypt it normally, then decrypt before use?
    – RedGrittyBrick
    Commented May 5, 2021 at 14:08
  • Since there is no "normally" - when encrypting it into some random looking data, it does not have the same backup properties (e.g. error correction). I want to store a mnemonic which needs an additional password to get the "real" mnemonic.
    – Tarion
    Commented May 5, 2021 at 14:28
  • I came up with an proposal implementation like this: github.com/Niondir/go-bip39/blob/master/encyrption_test.go It uses SHA256(pw) to generate the key for an AES-CTR with an empty IV to encrypt the entropy that is derived from the mnemonic. I'm open for discussion of the parameters and ciphers, but this might not be the best place for that discussion.
    – Tarion
    Commented May 5, 2021 at 14:32
  • 1
    Your use case is unclear to me, it seems you want seed(phrase) == seed(enc(phrase, pw))?
    – RedGrittyBrick
    Commented May 5, 2021 at 14:37
  • @RedGrittyBrick I guess yes. Take a look into my implementation, it solves what I want. More like: seed(plainPhrase) == seed(decrypt(encPhrase, pw))
    – Tarion
    Commented May 5, 2021 at 14:50

1 Answer 1

Reset to default
1

First things first. There are 3 values in play;

  1. The entropy
  2. The mnemonic phrase
  3. The seed

The entropy is just random data. The mnemonic is the same random data, but mapped to a wordlist plus a checksum. The seed is derived from the mnemonic and a password.

A mnemonic can be converted back to the entropy that was used to create it. But it is the seed that is used to generate your wallet addresses.

When using a different password you are not actually encrypting the mnemonic but just changing the derived seed. The password is used as the salt to pbkdf2.

It is impossible to find the mnemonic+password for a given seed, and therefor it is impossible to find the mnemonic for a given seed and password. It is what pbkdf2 was explicitly designed for.

Improve this answer
5
  • Hey, I do understand this. There is a specification to add a "passphrase" to the mnemonic phrase, but as you said, it changes the seed. What I need is to encrypt my mnemonic phrase for a paper backup that someone might find, with a password I have in mind without changing the already used seed. That's what my implementation does.
    – Tarion
    Commented Jan 16, 2022 at 9:55
  • "When using a different password you are not actually encrypting the mnemonic but just changing the derived seed. The password is used as the salt to pbkdf2." That's why the existing password scheme in BIP39 does not work for me.
    – Tarion
    Commented Jan 16, 2022 at 9:58
  • You can encrypt the mnemonic whichever way you want, but it is not BIP39 compliant and can only be decrypted by your own implementation. I would rather encrypt the mnemonic using an industry standard cipher and store the ciphertext instead of the mnemonic. Store it as an qrcode instead of text for easier recovery.
    – Ferdy Pruis
    Commented Jan 16, 2022 at 12:39
  • Well, you are right. One would need to extend BIP39 which probably will not happen. But I like the idea of having the result at least look like BIP39 so you have plausible deniability and someone who finds my backup can just access some empty wallet (could even be filled with some small amount of coins). In the end my implementation does use industry Standard cipher.
    – Tarion
    Commented Jan 19, 2022 at 22:18
  • 1
    Thats exactly the design of the current BIP39 passphrase; generate a new mnemonic. Use one passsword to generate a wallet with a tiny amount of coins. Use another password for your actual wallet. Should you ever be required to give up your password, give the first one. But the result of this design is you can not change the passsword afterwards.
    – Ferdy Pruis
    Commented Jan 21, 2022 at 6:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.