How secure is Secure Print?

Question

Armory gives the option of Secure Print for making paper backups. I understand that the developers give this option in case your printer stores a cache, or if the wallet could otherwise be compromised in transit from your computer to your printer. In other words, it is not intended as an encrypted paper backup, but just as a feature to help securely print your paper wallet.

My question is, even though this feature was not intended to make an encrypted paper backup, is it secure enough to enable one to widely disperse paper backups, assuming only the actual wallet owner controls the generated password (which I think is around 10 characters)? What type of encryption cipher does it use?

Answer 1

The source code (qtdialogs.py) has this to say about SecurePrint:

  # USE PRINTER MASK TO PREVENT NETWORK DEVICES FROM SEEING PRIVATE KEYS
  # Hardcode salt & IV because they should *never* change.
  # Rainbow tables aren't all that useful here because the user
  # is not creating the password -- it's *essentially* randomized
  # with 64-bits of real entropy. (though, it is deterministic
  # based on the private key, so that printing the backup multiple
  # times will produce the same password).

So it is 64-bit, or ~10^19 combinations. Armory uses a scrypt-based key derivation function for the SecurePrint code. It takes a noticeable amount of time (not long at all, but not seemingly instant) on my computer to calculate the wallet keys/ID from the SecurePrint code. Let's say an attacker has your printout, and it takes 0.1 seconds per attempt. He would need about 58 billion CPU years to find the right private key by guessing the SecurePrint code. So yes, it would appear that it is secure enough to disperse paper backups, as long as you're not going to have an extremely valuable (e.g. billions of dollars) wallet.

You might consider whether scrypt ASICs (which will come in some form, unless Litecoin and its kin die off) can attack your key as well. I wouldn't expect it to be faster by a factor of 500 billion (which would put the time down near a month), but if you consider this to be a "lifetime wallet", you might not want to have this as a potential weakest link.

Warning: I'm not an expert in Armory, just some guy who took a look at the code and knows a bit about cryptography. If you decide to post your SecurePrint-secured paper wallet all over the Internet and someone steals your bitcoins, don't come crying to me.