I have managed to lose 5 words of my 24 word Ledger Nano S recovery phrase. I have words 1-19 but I am missing words 20-24. I have significant holdings on the wallet so would very much like to recover it if possible. The passphrase is a BIP39 mnemonic (see https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki). I have the bitcoin and ethereum public addresses for this mnemonic. I am wondering if it's feasible to brute force the passphrase.

Each word is 11 bits (2^11 = 2048 possible words). The last (24th) word of the passphrase is of the following form [3 random bits][8 bit checksum]. Therefore I only have to check 2^(55 - 8) = 2^47 = 1.4x10^14 combinations. I would have to compute SHA-512-HMAC with an iteration count of 2048. As far as I understand, that means I'd have to compute 1.4*10^14 * 2048 = 2.87*10^17 hashes in total.

Is there any hardware out there designed for this? I am aware of ASICs that compute sha-256 hashes but not sha-512 hashes. Perhaps I could tweak one to work with sha-512 since they are very similar.

Assuming a fairly typical ASIC hashrate of 1TH/s (10^12 hashes per second), I could exhaust the search space in 2.87*10^5 = 287000 seconds = 3.3 days. I'd probably get there sooner, of course (expected 1.65 days). Time is not something I am worried about. Even if I have to wait months, I don't mind - so if I can get 10GH/s at a reasonable price, that would be great.

I would really appreciate any help/information you could provide to help me out and make sure I haven't missed anything. I could also use GPUs for this (I calculate I can run them at roughly $1/10TH - so it would cost me $28.7k to exhaust the search space, which I will do if there are no cheaper options).

Many thanks, James

migrated from money.stackexchange.com Apr 26 at 23:44

This question came from our site for people who want to be financially literate.

  • 1
    @Thegs I'm not following. By permuting every hash, I can find the one that matches up with my address. – JGoodwin10 Apr 26 at 21:44
  • 2
    I doubt those ASICs exist (unless there's a coin that does exactly those hashes or maybe someone builds them just to do exactly this kind of key recovery, which i guess may one day become lucrative). You're likely gonna be doing CPU or GPU speeds (if you can make/find the right software to do it). Also I think you'll also need to do further checks every time you happen to land on a valid checksum (1 in 256). – Jannes Apr 27 at 0:10
  • 1
    I would not expect it to be possible to "tweak" an SHA256D ASIC. They are designed in hardware to do only one thing. If there were gates to spare, the designers would have used them for more SHA256 units instead of adding an SHA512 option. – Nate Eldredge Apr 27 at 0:11
  • 1
    You can not "tweak" the operation of an ASIC, and truly there's no mining ASIC doing a complete SHA256 hash either. It really depends how much money you have to blow on recovering the seed as to how far you can go, but I think your cost estimates are off by orders of magnitudes. You're forgetting that once every 1:256 attempts you need to do a computationally expensive bip32 dervice and see if any of the addresses match your wallet. – Anonymous Apr 27 at 0:23
  • 1
    @xyious It would be good to note that a "4 Word passphrases" from the set of "all words" is not the same as BIP39's 2048 word list. 2048^5 is "only" 36,028,797,018,963,970 possibilities compared to diceware's 7776^5 which is 789 times larger. Diceware is still a very limited set of words, so the comparison to passphrase strength doesn't seem applicable IMHO. – Jonathan Cross May 21 at 17:57

You may be able to find some luck writing an OpenCL wrapper for either john the ripper or OCLHashCat, as I'm fairly certain you can't retool ASICS (unless you get your hands on a good FPGA and gate it for ripping through the SHA512 space).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.