7

Trezor's SLIP39 makes it possible to apply Shamir's secret sharing to a Bitcoin wallet seed.

How do SLIP39 and BIP39 relate to each other?

I.e. it seems possible to derive SLIP39 from BIP39 words but this is messy, and deriving BIP39 from SLIP39 is not possible at all?

Or in Tony's words, what are the the details of calculating the BIP32 master seed from entropy using both schemas?

I want to know this because I was first under the impression that the relationship was quite strong and it would be possible to derive BIP39 words that can be used to recreate a wallet, but this does not actually seem to be the case.

There's some useful information here but it's not very concise answer: https://github.com/iancoleman/slip39/issues/1

Improve this question
2
  • 1
    Are you looking for a grand scheme answer (what is SLIP39 and what is BIP39), or asking about the details of calculating the BIP32 master seed from entropy using both schemas?
    – Tony Sanak
    Feb 23, 2020 at 21:27
  • Yeah, explaining the difference about BIP32 master seed derivation between SLIP39 and BIP39 will be great.
    – furunodo
    Feb 24, 2020 at 14:22

1 Answer 1

Reset to default
10

BIP39 (Bitcoin Improvement Proposal) describes the implementation of a mnemonic sentence (set of easy to remember words from a predefined wordlist of 2048 words) that can be mapped to a binary seed from which you get a master key which in turn is used as per BIP32 for the generation of deterministic wallets.

SLIP39 (Satoshi Labs Improvement Proposal) has to do with the Shamir Secret Sharing Scheme (SSSS). This is a way to break up any secret into N parts so that any M of the N parts can reproduce the original secret. It is not limited to, but in the context of bitcoin it is mostly used for breaking up a mnemonic sentence from BIP39 or the seed of an HD wallet and giving each piece to a different party so that reconstruction of the secret would require collaboration/collusion of at least M parties. You still get with SLIP39 a mnemonic word sentence like you do with BIP39, only the words originate from a different wordlist. So if you see a mnemonic sentence, you can lookup its words against the online published wordlists of BIP39 and SLIP39 and recognize where it comes from.

SLIP39 is actually pretty neat, in that it allows for a two-level scheme where you have group-shares and within each group you define member-shares where you define an overall group threshold and within each group a separate member threshold.

For example I can split a master secret across four groups like:

  • Group-share 1: 1-of-1 for myself = single member-share and the threshold to fulfill this group-share is one i.e. I can do it by myself since I have the single member-share
  • Group-share 2: 1-of-1 same as Group-share 1
  • Group-share 3: 2-of-5 for my family = five member-shares (mom, dad, brother, sister, wife) and the threshold to fulfill this group-share is two i.e. any two family members together can reproduce it
  • Group-share 4: 3-of-6 for friends = six member-shares (alice, bob, charlie, david, eva, frank) and the threshold to fulfill this group-share is three i.e any three of my friends together can reproduce it

And finally you set a group-threshold of two i.e. to recover the master secret the goal is to reconstruct any two of the four group-shares.

Now, to recover the master secret here are a couple of possible recovery scenarios.

Scenario 1: I can do it all by myself since I have two member-shares from two of the four group-shares (Group-1 and Group-2) that both require a single member-share.

Scenario 2: alternatively my family members and friends can come together. In particular any two family members (to fulfill Group-3) and additionally any three friends (to fulfill Group-4). This way again two (the group threshold) of the four group-shares can be fulfilled.

Improve this answer
3
  • 1
    Can a wallet setup using Shamir's Secret Sharing (SSS) with SLIP39 protocol later be recovered onto a BIP39 wallet? i.e. A wallet is created based on SLIP39 on a Trezor device and then later recovered on a Ledger BIP39 based wallet?
    – AdamHurwitz
    Mar 27, 2021 at 16:01
  • SLIP39 and BIP39 are not compatible according to SatoshiLabs.
    – AdamHurwitz
    Mar 27, 2021 at 17:09
  • 1
    yes BUT you have derive the SLIP39 back to the original secret > BIP32 which you can use as input for any other hardware wallet. But deriving the SLIP39 with the minimum required keys of the group to get the master key = BIP32. Some expernal program slip39.com/posts/ethereum-slip39-account-generation/… explained here needs to be used. So it's no trivial deal. And you have to use a computer which is not so safe. There is no direct way to enter slip39 codes into a hardware wallet that does not support it other then manually decode the bip-32.
    – Stephan
    Nov 18, 2022 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.