Why is it bad to split up a wallet seed redundantly?

Question

I have been reading a lot about wallet security and this seems to be universally considered a bad idea (see for example this video or this answer), but I am struggling to see why it is not a good choice in some circumstances.

Let's say I have three moderately secure locations I can store information in - my own home and the homes of some close family, perhaps. I want to arrange things so access to the information at any two of those locations allows me to access my bitcoin, in case one location suffers natural disaster or theft, but I don't want anyone to be able to access my coins just by having access to one of those locations.

I create a wallet with a 24 word seed. I don't use Shamir's secret sharing algorithm, because I see this is widely advised against (see for example this article) and is a potential source of risk from cryptography I don't fully understand. Instead, I use a naive scheme I can perform entirely by hand where for each group of three words in the seed, I split them up like this:

Location A	Location B	Location C
word 1	word 1
word 2		word 2
	word 3	word 3

So each of the three locations has 2/3 of the words, i.e. 16 words. It's easy to confirm (by experiment, if necessary) that I can reconstruct the full seed from any two of the three locations.

If an attacker gets access to the words in a single location, they only need to guess eight words in order to access the funds. That's superficially 8*11=88 bits of entropy, but since the seed contains some checksum bits I will handwave this down to 80 bits in practice.

My understanding is that 80 bits is not considered incredibly secure, but it is not trivial to break either. If I consider my storage locations reasonably secure and don't expect targetted theft ("we know he has a lot of bitcoins, we are going to break in to steal the words from one location, we have a cluster of machines on standby to brute-force the missing words") but am just trying to protect myself against opportunistic theft ("we broke in to steal the household electronics and any cash lying around, but we also found these bitcoin seed words!"), is it ridiculous to consider this acceptable?

The obvious alternative would seem to be a 2-of-3 multisig scheme. If each of those wallets uses a 12 word seed, an attacker getting access to a single location has to guess 12 words or 128 bits of entropy, which is obviously stronger. On the other hand, with 2-of-3 multsig:

• An attacker getting access to a single location will get a copy of the master public keys I have to store at each location and can therefore see the wallet balance and transactions, which may incentivise a targetted attack or compromise my privacy in other ways.

• The need to store the master public keys in each location adds a level of complexity and risk to the backup. I am probably more likely to lose my bitcoin through a mistake than the actions of an attacker whatever scheme I choose. If the paper in any one location suffers minor damage, I might still be able to make out a seed word - it's English, after all, and I know it comes from a certain list of words - whereas the gibberish string of characters which is the master public key doesn't have this extra redundancy.

It feels like this seed-splitting scheme has its own set of tradeoffs, but it's not obvious to me that it is outright bad. What am I missing?

Answer 1

Your analysis is correct. The weakness in this scheme is that if one location is compromised, only 80 bits of security are left. But 80 bits is sufficient for practical purposes and would likely take at least a decade to break assuming a highly-resourced attacker was willing to devote significant resources to breaking it.

This assumes the original seed was chosen in an unbiased manner. If there are any defects in the scheme used to generate the original seed, there might not be enough security left if 2/3 of the key is compromised.

Obviously, doing this with a 12 word seed would be a complete disaster.

Answer 2

I disagree with the "decade" assumption.

By my math it takes roughly 4.3 trillion years to brute-force 8 missing words on a single GPU. Which means that even a billion-fold increase in efficiency, through ASICS and more hardware, remains safe. A trillion-fold increase in efficiency would cost more than the funds being secured.

To arrive at the 4.3 trillion years number:

BIP-39 provides 128 bits of entropy per 12 words. Per word known, this reduces by 11 bits. For 8 words, then, that is 2^84 combinations, or roughly 19 trillion trillion.

A single GPU with OpenCL code optimized to stay in its fastest 64kb of memory and run parallel on all cores did 143,000 combinations per second as per https://medium.com/@johncantrell97/how-i-checked-over-1-trillion-mnemonics-in-30-hours-to-win-a-bitcoin-635fe051a752

A year has 31,536,000 seconds.

1.93e+25 / 143,000 / 31,536,000 = 4.3 trillion, give or take.

Granted that assuming that all possible combinations need to be checked is not a safe assumption. The likelihood of finding the correct one early goes up as the computation nears its end. But that does not reduce the magnitude of the task meaningfully.

Checking this math and poking holes in it will be very welcome. I'm relying on it to be correct, right now.