0

Suppose that someone seized my seed with a phrase of 12 words. I deliberately changed the order of words in a phrase in such a way that the only way to get a real phrase is to go through all the possible combinacies of the current 12 words.

1) How many combinations will it be necessary to go through an attacker in order to find a real seed? How long can it take?

2) Do you find such precaution really effective?

2

1) The answer is 12! = 479,001,600 possible mnemonics (less if there are repeated words). Out of these only ~29,937,600 (1 in 16) produce a valid seed. This is definately brute forcable.

2) No, if you want to do this use a longer mnemonic (and make sure you permute them in a truly random way)

  • thank for answer. Im whant to use Electrum. What are my options for enhancing seed phrase backup? @Mike-D – entarex11 Oct 31 '18 at 12:32
  • create a new wallet with 24 words mnemonic (not with electrum, they don't support bip39) and then import it to electrum and move your funds there. – Mike D Oct 31 '18 at 12:43
  • What should I to import to electrum ? I generated 24 seed from iancoleman.io/bip39 , but electrum don't whant to import it. – entarex11 Oct 31 '18 at 12:51
  • make sure you tick BIP39 in the options dialog – Mike D Oct 31 '18 at 13:44
  • "every passphrase generates a valid seed" github.com/bitcoin/bips/blob/master/… – JBaczuk Oct 31 '18 at 18:44
0

Permutation(12,12) = 12! = 479,001,600

Vanitygen on GTX 1080 can derive 50 million addresses in one second. 479/50 = ~9.5 thus it'll take 9.5 seconds to derive all addresses and find your private key. As this was a master password instead of a private key, it will take a little longer. Let's say at most 2 minutes.

Not effective at all, except that it might take up to week day for the thief to think of rearranging the words.

  • thank for answer. Im whant to use Electrum. What are my options for enhancing seed phrase backup? @MCCCS – entarex11 Oct 31 '18 at 12:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.