I use a 24 word seed for my private key. I split the 24 words into 16 words in three pieces of paper, so one needs to have at least two pieces of paper to recover the wallet. However my question is, if someone gets one piece of paper, can they easily brute force the remaining 8 words?
Ideally you shouldn't share any words and brute forcing with one paper in your case may take time but still possible. Also if someone gets one paper he can try social engineering to get another. Below links might help in understanding things involved in brute forcing.
With 8 known words there are 2⁴⁰ (~1.1 trillion) possible mnemonics
To test a single mnemonic we have to generate a seed from the mnemonic, master private key from the seed, and an address from the master private key
Usage of GPU for brute forcing
Tx fee is normally high during such attacks
Open source code that was used:
BIP39-Solver-CPU: This is the CPU benchmark tool he wrote in Rust to get an idea of how long it will take do solve on a CPU for certain number of unknown words.
BIP39-Solver-GPU: This is the actual GPU version he ran on each worker GPU to solve this problem.
BIP39-Solver-Server: This is the actual server he ran that handled distributing the work to all the workers.
It would take the same system that brute forced the last 4 words of his mnemonic 837 quintillion millennium to brute force all possible 12 word mnemonics.
Thanks I recall I read someone putting a challenge with missing words in mnemonic and this is it. Aug 6, 2020 at 15:16
1Can you share the important parts of the information behind the links? Now, if the links are gone, most of your answer will be as well.– MastAug 7, 2020 at 5:52
Added a TLDR section in the above answer. You can also use web.archive.org to archive the links.– user103136Aug 7, 2020 at 12:39
Am I correct to assume that in my case, whoever having only one piece of paper needs to brute force 2^(11*8) combinations (8 words)? Aug 7, 2020 at 13:37
Difference here is 24 words seed and then converted to 16 words. So calculation depends on this conversion as well. I am not sure what will be the exact formula for it.– user103136Aug 7, 2020 at 14:53
Andreas Antonpoulos answers this question here. He calls this reduction from 256 bit entropy to 80 bit entropy a "catastrophic reduction in security". He estimates that it would take a cluster of machines up to a decade to brute force the remaining 8 words. It is certainly not an effective long term wealth storage solution. Perhaps it could work as a short term solution whilst you prepared a more robust solution. But most certainly, use at your own risk.
Oh wow this is exactly what I am looking for. I would have marked your answer as accepted but the other answer provides a more concrete calculation of the problem. Aug 7, 2020 at 13:48
Antonpoulos' math doesn't make sense. There are 2048^8 combinations and PDKDF2 requires hashing 2048 times. So you have to hash up to 2048^9 times. Assuming a super powerful ASIC can hash at 100 trillion times a second, you find that it would take 100 million years on average. But maybe he's imagining some entirely new technology emerging in the future. Jun 29, 2022 at 16:50
Other answers correctly state that leaking 16 words of a 24 word key significantly compromises security. I would add that you have an alternative option which wouldn't compromise security.
Using Shamir's Secret Sharing, you can encode your key on three separate pieces of paper such that:
- You need at least two pieces of paper to recover the original key
- If someone gets just one piece of paper, they can't learn anything (not even with unlimited resources) about your key from it
It looks like there's at least one easy to use command line implementation of the algorithm for encoding strings, sss-cli. Note that I have not verified its implementation.
It is equally secure as an 8-word passphrase would be.
The actual entropy depends on your dictionary size. To achieve 256 bit entropy, each of the 8 words would have to be chosen out of a dictionary of 2^(256/8) = 4 billion words. English language only has about 200 000 words.
There is, however, a different approach you can use to store your passphrase with 2-out-of-3 recovery ratio:
- For each paper, generate one-time pad with the same length as the passphrase. On computer, you would use XOR with random binary value for this. If you want to compute it on paper, this can be a list of random numbers, which you then add to each letter of the passphrase (A + 1 = B, Z + 1 = A etc.). Be sure to encrypt or remove the spaces to avoid giving away the length of each word.
- Print on each paper the one-time pad encrypted passphrase, and the one-time pads of the two other papers.
Now anyone who gets only a single paper only has the encrypted passphrase and two random keys. But anyone who has two papers can decrypt the passphrase.