Am I safe if 16 words in my 24 word seed are leaked?

Question

I use a 24 word seed for my private key. I split the 24 words into 16 words in three pieces of paper, so one needs to have at least two pieces of paper to recover the wallet. However my question is, if someone gets one piece of paper, can they easily brute force the remaining 8 words?

Answer 1

Ideally you shouldn't share any words and brute forcing with one paper in your case may take time but still possible. Also if someone gets one paper he can try social engineering to get another. Below links might help in understanding things involved in brute forcing.

https://medium.com/@johncantrell97/how-i-checked-over-1-trillion-mnemonics-in-30-hours-to-win-a-bitcoin-635fe051a752

https://twitter.com/JohnCantrell97/status/1274024510786883584

TLDR:

With 8 known words there are 2⁴⁰ (~1.1 trillion) possible mnemonics

To test a single mnemonic we have to generate a seed from the mnemonic, master private key from the seed, and an address from the master private key

Usage of GPU for brute forcing

Tx fee is normally high during such attacks

Open source code that was used:

BIP39-Solver-CPU: This is the CPU benchmark tool he wrote in Rust to get an idea of how long it will take do solve on a CPU for certain number of unknown words.

https://github.com/johncantrell97/bip39-solver-cpu

BIP39-Solver-GPU: This is the actual GPU version he ran on each worker GPU to solve this problem.

https://github.com/johncantrell97/bip39-solver-gpu

BIP39-Solver-Server: This is the actual server he ran that handled distributing the work to all the workers.

https://github.com/johncantrell97/bip39-solver-server

It would take the same system that brute forced the last 4 words of his mnemonic 837 quintillion millennium to brute force all possible 12 word mnemonics.

Answer 2

Andreas Antonpoulos answers this question here. He calls this reduction from 256 bit entropy to 80 bit entropy a "catastrophic reduction in security". He estimates that it would take a cluster of machines up to a decade to brute force the remaining 8 words. It is certainly not an effective long term wealth storage solution. Perhaps it could work as a short term solution whilst you prepared a more robust solution. But most certainly, use at your own risk.

Answer 3

Other answers correctly state that leaking 16 words of a 24 word key significantly compromises security. I would add that you have an alternative option which wouldn't compromise security.

Using Shamir's Secret Sharing, you can encode your key on three separate pieces of paper such that:

• You need at least two pieces of paper to recover the original key
• If someone gets just one piece of paper, they can't learn anything (not even with unlimited resources) about your key from it

It looks like there's at least one easy to use command line implementation of the algorithm for encoding strings, sss-cli. Note that I have not verified its implementation.

Answer 4

It is equally secure as an 8-word passphrase would be.

The actual entropy depends on your dictionary size. To achieve 256 bit entropy, each of the 8 words would have to be chosen out of a dictionary of 2^(256/8) = 4 billion words. English language only has about 200 000 words.

---

There is, however, a different approach you can use to store your passphrase with 2-out-of-3 recovery ratio:

1. For each paper, generate one-time pad with the same length as the passphrase. On computer, you would use XOR with random binary value for this. If you want to compute it on paper, this can be a list of random numbers, which you then add to each letter of the passphrase (A + 1 = B, Z + 1 = A etc.). Be sure to encrypt or remove the spaces to avoid giving away the length of each word.
2. Print on each paper the one-time pad encrypted passphrase, and the one-time pads of the two other papers.

Now anyone who gets only a single paper only has the encrypted passphrase and two random keys. But anyone who has two papers can decrypt the passphrase.