The Stack Overflow podcast is back! Listen to an interview with our new CEO.
10

to answer the first part; generally speaking people will want to backup their whole wallet, not specific PKs. so using a HD wallet and making a backup of the seed (either the seed or a BIP39 mnemonic doesn't matter) matches what people using 'normal' wallets do, you backup your whole wallet in 1 place (most wallets have a backup/export file for the whole ...


9

In fact, the reason Electrum 2.x changed to a 13-word seed* and is incompatible with BIP39 is because they added a version number to the end of the seed. This has the purpose of allowing future versions of Electrum update the seed format while still understanding how to derive all the addresses from previous seed versions. Standard Electrum seeds have 128 ...


8

There are different "backup-standards". Some use BIP39 (mnemonic) which lacks of a flexible wordlist and versioning. Its used by Leger, Trezor, Bitpay/Copay, etc. Electrum uses a different – more flexible – mnemonic backup concept. Though, it's incompatible with BIP39. But then, there is also the BIP32 keypath which can be different among wallets. Example:...


8

There is nothing stopping a word to be repeated more than once. In a 24 word mnemonic, with 2048 possible words in the dictionary (BIP 39), there is a probability of at least one duplicate around 12.7% of the time (variation of the birthday paradox).


7

I see Shamir Secret Sharing recommended; yet One Time Pad or XOR is an elegant way to split a BIP39 seed. It's a method simple to describe (apt for a will), easy to verify (trust only yourself) and like SSS is information-theoretic secure [1]. It can be computed entirely with paper and pencil eliminating risks from malware and best of all the resulting ...


7

Doing this requires three things: Permutations of the seed words The address you're trying to locate The derivation path for that address. In this specific case, the address is the one this puzzle on reddit leads to, so we will assume the derivation path is m/49'/0'/0'/0/0 This is a simple nodejs script using bitcoinjs-lib to read seeds from a file, ...


7

BIP 39 is not in Bitcoin Core largely for implementation reasons and because BIP 39 is not as secure as it could be. The structure of Bitcoin Core's wallet doesn't really allow for BIP 39 to be implemented. The current structure doesn't allow for 512 bit seeds as BIP 39 specifies, and adding it would require some significant changes to the wallet code. ...


6

(The language used in this post is Python) Breadwallet uses BIP39 to generate the 128-bit master seed from the 12-word mnemonic. The master seed is then used to generate a set of wallets/accounts containing chains of addresses, using BIP32. First off, import hashlib and binascii, we're going to need them later. import hashlib from binascii import hexlify, ...


5

someone on blockchain support ask me to tell him my back up fund 12 word in order to reverse my bitcoin which was unconfirmed in my transaction Sorry to say, you were definitely scammed. You cannot reverse a bitcoin transaction in that way, the scammer only told you that so that you would give them the 12 word phrase. With that phrase, the scammer could ...


4

There are multiple questions being asked here. Firstly, some background info. BIP39 is a standard that includes word lists. The English one can be found at https://github.com/bitcoin/bips/blob/master/bip-0039/english.txt What is a mnemonic frequency analysis? This is a fancy way of them saying that they figured out the minimum number of letters they ...


4

I went to https://iancoleman.github.io/bip39/ and after generating a dozen or so mnemonics I got audit again guess butter minute predict grid image fresh kit west will before noodle supply magic bread protect mimic butter credit tragic recipe clarify So this confirms the other answers: assuming this is a correct implementation, repeats are allowed.


4

While theoretically possible, the algorithms involved mean that it is practically impossible. You would need to compute the seed from your mnemonic word according to BIP 39, and then derive the keys and address from that according to BIP 32. Generating the seed from the mnemonic alone requires executing the PBKDF2 function, which is specifically designed to ...


4

It simply means that BIP39 seeds have no way to tell you when they were created - If you need to check one for transactions, you have to start at the genesis block and work your way up to the present day. This is in contrast to the traditional Bitcoin-qt wallet.dat, which maintains a date for when the address was created. Usually, it will not check for ...


4

From where I can get bip39 ( 2048 words ) 12 words length possible combinations . There is no such list, because it is simply too large. From the 2048 words, 12 word mnemonics are 11 words + 1 checksum word. However, the checksum calculation only affects part of the 12th word, so you are still looking at 12 word combinations This gives you 2048^12, or 5....


4

Bitcoin Core does not use a seed phrase. Your password is simply the encryption password for the wallet.dat file. No private keys are derived from the password. In order to recover your Bitcoin, you must have the wallet.dat file.


4

This is specified in BIP 39 itself: To create a binary seed from the mnemonic, we use the PBKDF2 function with a mnemonic sentence (in UTF-8 NFKD) used as the password and the string "mnemonic" + passphrase (again in UTF-8 NFKD) used as the salt. The iteration count is set to 2048 and HMAC-SHA512 is used as the pseudo-random function. The length of the ...


3

One can use Shamir's Secret Sharing Scheme, but the input ASCII string must be under 128 ASCII characters in length. Fortunately, the 2048 English BIP 39 words are guaranteed to be unique from their 1st four characters, sometimes even fewer characters. Let's assume the 24 recovery words are "bunker wreck real edge inflict aerobic buddy mercy divorce wolf ...


3

No, the BIP39 construction does not avoid repeating words. It is possible for a word to show up multiple times, but since there are 2048 words it is fairly unlikely for repeats to show up in randomly generated keys.


3

You could and it's probably not a direct security issue, but it's a senseless waste of time trying to find it again. Keep in mind that doing this destroys the PBKDF2 key stretching used in the seed needlessly. Electrum stores a checksum with their 12 word seed (making it a 13 word seed) if you really desire that functionality, though it's clear if you have ...


3

Thomas Voegtlin , the developer of Electrum explains the reasoning in the first 10 minutes of this interview. I think he also posted same thing to Bitcoin dev mailing list some time ago. https://letstalkbitcoin.com/blog/post/epicenter-bitcoin-69-thomas-voegtlin-electrum-spv-wallets-and-bitcoin-aliases His main point against BIP39 is that it doesn't include ...


3

The seed phrases in 2.0 are longer because 8 extra bits are required in order to store the seed version number. (default entropy is 128 bits) Note that the number of words in the seed phrase depends on the size of the wordlist used in the generation. Currently, the English wordlist used in Electrum has 2048 words, which results in 13 words per seed phrase. ...


3

Mnemonic phrase from 2015 or earlier, and not an Electrum seed? Then there is a high probability it is blockchain.info's legacy wallet recovery mnemonic. Which can be recovered here https://blockchain.info/wallet/forgot-password


3

This could also be coinomi (an android app HD wallet that supports many currencies, including ETH). They used a 15 word seed. They have a recovery tool here, https://coinomi.com/recovery-phrase-tool.html -- or use can use their app again to unlock. AFAIK no other vendor seems to quite support restoring their phrases -- but you can use their tool to derive ...


3

You probably know that HMAC-SHA256/HMAC-SHA512 and thus PBKDF2 are one-way functions. There would be no way how to reconstruct the seed from the generated sentence in your setup, which is the only purpose of such sentence.


3

BIP 32 is not a mnemonic specification, so it has 0 possible combinations. I assume you are talking about BIP 39. In that case there are are 2048^12 combinations for 12 word mnemonics, 2048^18 for 18 word mnemonics, and 2048^24 for 24 word mnemonics. However BIP 39 currently supports 8 languages, so there are (2048^12 + 2048^18 + 2048^24)*8 possible ...


3

How most HD wallets work is that they take (or generate) a mnemonic, the mnemonic is used to generate the HD wallet master key, and the master key is used to generate the keys in the wallet. Bitcoin Core doesn't yet support the first part of that: it generates a random master key without using a mnemonic. So there is no mnemonic. If you would like to get ...


3

Wouldn't it be saver to generate a mnemonic passphrase manually by just taking random words from a lookup table? No, it would not be. This method may even be insecure if you are actually doing it manually. A BIP 39 mnemonic, if generated properly, is secure. It is just as secure if you randomly choose words too. This is because both methods require a ...


3

mnemonics are the seed. you use that to get your private key. the rest of the story as you have pointed out, is about deriving child key pairs. The process is deterministic (as the letter D in HD), meaning that you can get the same tree of child keys from the root seed whenever you do that. This could go "indefinitely", so how would you know when to stop? ...


3

Your mnemonic is creating an extending private key for deterministic wallets, which is different than a WIF Private Key. An extended private key can deterministicly generate millions of private keys, so that you can regenerate all those same addresses in the future as long as you have the extended private key or your mnemonic seed. Example of extended ...


3

Does it just try all possible addresses related to that seed's master key ? (This seems impractical imo). No, this is actually impossible to do since there is effectively an infinite number of addresses that can be generated from a single master private key. Instead wallets generate keys at standardized derivation paths and assume that other wallets follow ...


Only top voted, non community-wiki answers of a minimum length are eligible