0

I reading that 'humans are bad at randomness' and one should always let an algorithm choose your seed for you.

While I agree that maybe it's not advised to make my brain wallet 'zoo' x 23 + checksum as an easy to remember phrase, but besides the obvious, what real risks are there to choosing your own seed?

I've also read that if you use the date as your seed's seed (akward phrase, the seed of the random function that my nmemonic seed is created from) then if that is known by an attacker they can use that to crack my wallet really easily.

What else could go wrong? for instance if i decide to use all the food words out the list, but change 1 of those to an easy to remember alternative, then I've a bunch of food words and one randomly out of place non-food word (seams ok to me). Are there brute force algorithms that could take advantage of that?

Improve this question

2 Answers 2

Reset to default
3

The BIP39 word list consists of 2048 words.

For a regular, 24 word mnemonic, you have: 2048^23 ways to arrange the non checksummed words. At 1 trillion combinations per second, this would take you ≈ 3.3×10^46 times the age of the universe to compute, even before you bother checking the checksum options.

Now, let's say that out of these 2048 words, 500 are food items (this is an illustrative example, I haven't actually counted them). Now, your combinations are some combination of 22 items (possibly repeating) from those 500, plus a random word from the 2048.

This evaluates as 500^22 * 2048 * 21. At 1 trillion combinations per second, this would take you ≈ 2.4×10^46 times the age of the universe to compute. While this is still an extremely large number, it is still nearly 30% less than the initial case, which is a non-trivial loss of entropy.

Moreover, if an attacker is able to discover even a few words from your mnemonic (maybe a friend peaked at it while visiting, or you entered a fragment into a scammy wallet before catching on, or any number of other scenarios), your possible combinations go down extremely fast. Even a perceived small loss of entropy can mean the difference between being brute forceable after 6 known words and being brute forceable after 19 known words.

In 2019, with access to reliable entropy generation in nearly every device, it is simply not worth it to attempt to come up with convoluted schemes.

Improve this answer
4
  • I get the reduction in entropy, but in the 'food items' example, obviously an already extreme example, but even in that case, the attacker would have to have the knowledge that I've chosen food items, which they presumably do not, but working on the presumption that that knowledge will never become available, what are the risks? Great answer but still kinda not the answer i was looking for.
    – Ninjanoel
    Oct 29, 2019 at 13:40
  • 2
    @Ninjanoel The answer is that you simply cannot reason about how secure or insecure it is. You should assume an attacker has knowledge of the process you used to come up with the phrase; not because they certainly will, but because you need to protect against the worst case. You cannot eatimate how random something is you came up with yourself Nobody can; humans are just terrible at this.
    – Pieter Wuille
    Oct 29, 2019 at 16:28
  • Ahhhh, I know what you saying but huge parts of me still wanna argue!! lol. Like, if I told you my process was the same as rolling a die three times and choosing the word that best "continues the story", so I'm left with a random but human readable "cards against humanity" style story that's easy to remember. Ignoring the risk of someone else seeing my phrase, have I got something that is easier to brute force than computer randomness? Again, I agree with most of your answer
    – Ninjanoel
    Oct 29, 2019 at 19:57
  • You have something that is absolutely massively easier to guess than brute force. Whether it is so much easier as to make attacking easy I cannot tell you.
    – Pieter Wuille
    Oct 31, 2019 at 0:10
0

The way seed words are generated, you start with the numeric seed entropy (usually in hexadecimal notation), and the BIP39 standard converts that to seed words. Not every combination of words from the wordlist is valid.

How you generate your seed entropy is up to you, but starting with the words doesn't necessarily work. You could very easily come up with an invalid sequence.

If you are truly confident you can create a sequence of words that is easy to remember, yet random-looking enough to resist being cracked, then you can hash that and create seed entropy that way. Nobody recommends this approach, though. Brain wallets are routinely cracked and drained because many people who create them massively overestimate how strong their password/passphrase is.

Improve this answer
4
  • I don't understand this bit: "then you can hash that and create seed entropy that way", do you mean the "easy to remember words" are just any words? not the actual 24 word seed?
    – Ninjanoel
    Mar 17, 2020 at 16:11
  • Correct. You don't start with making up your own seed words, the words are a result of the seed entropy. Each word signifies part of the hexadecimal sequence, plus a checksum. If you insist on using a word sequence of your own choosing, then there is no guarantee that it is a valid sequence.
    – John C.
    Mar 18, 2020 at 8:13
  • your solution intrigues me, but one of my considerations is that I need to make this something I can explain to my mother, inheritance and all that, not sure requiring a custom application (exe - you aren't suggesting this is done by hand are you) to retrieve the seed phrase would have much longevity. the application becomes as important as the words, but adds huge inconvenience and risk. am i misunderstanding? Bare in mind, there are some things I wont say on the public internet about my personal security measures, but rest assured I know how the words work, I'm asking about the entropy risk.
    – Ninjanoel
    Mar 18, 2020 at 11:48
  • The entropy involved in selecting your own words is clearly going to be inferior to a truly random source. The question you need to answer is whether or not your word choices are good enough to seem random to a would-be cracker. Most folks are not up to the task.
    – John C.
    Mar 19, 2020 at 10:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.