Return-Path: Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 677A18CC for ; Tue, 4 Dec 2018 21:39:33 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-qk1-f175.google.com (mail-qk1-f175.google.com [209.85.222.175]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id BE63E862 for ; Tue, 4 Dec 2018 21:39:31 +0000 (UTC) Received: by mail-qk1-f175.google.com with SMTP id w204so10625306qka.2 for ; Tue, 04 Dec 2018 13:39:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=5oTjzdwfNQ4hopxlNRU44pKQojT+16ctBEZ5scNLc9s=; b=YN+mfyGFbE4VJ8cYsdB+4ZIsdcDMBVCKhr2984HEmvO7cKF+2M4+V9bO6Lh8PEHFzG cH8KCb85pzziZbAaIReBl7W8v3EH9WSLDBMwjKjyiEfMizp8++3FoihpTUU86/NdqXNw m0HTGP+HNjX57UtkYYe7ui1adKFOiih4QUKl4NW759KcslV1OPhAnCIewZlxf4rdd3sT g27N5Jk72s6XqEvFzIOaBrlOFXGFM6KxtbrO+l+o0lljw7PfoZmJ7C0VpwXikMLzx50z qf9m/OaRNUp4r96f8y01TSC58d+jia/Lv1dhyjebQfAdvoHWLqcQMvSs8VeZIqv7Mf0v sF1A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=5oTjzdwfNQ4hopxlNRU44pKQojT+16ctBEZ5scNLc9s=; b=gDgWFDPMLNsohPNdKq87uBPEsbv64+gZIN6J9E2/2tfGwxZHA4h1LfBUnaguHY1Oxl K3GEoDiOO4NbEvogo3GxqwVDrQRTJehPoQbgdW97ACcC5Wtr0KQr7f0WiPK12ZLS5p3T fP6Kvwiijvh78Y5KlK6b5X8X4lCQf+3pKSH2n9idBh1mZokstQWBIyKQePvWakVahR8y 84LMb0zeNTNg5uuG4wrK68y0WYKNs/E55s+pVv8Lgk1JIW/ZXvB346YVkT72zwdxB2h1 R1nfQJAgOUkOml/Wiuo/r4lAwkIIflnRr83gzDLJgO3C3n2Tc1mhOfV8mKj5GJmzcZzq aTlg== X-Gm-Message-State: AA+aEWYFdVHm1Y1rFAXIkckakKGfB436fxujOWQtDiPV4sf0y/ZO9LOR CbAOQZSzVaXz3LE/OZyd0FzNgyuzAFENLmYv1CM= X-Google-Smtp-Source: AFSGD/XZPPOzSfA9+9a0eQSBz1kqLpLDn21Z9ax72owfzf9tilILCSguML8MWP4ZUE8ambBxxlB7PkipKyis7axpF2s= X-Received: by 2002:a37:af85:: with SMTP id y127mr19256996qke.352.1543959570585; Tue, 04 Dec 2018 13:39:30 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Steven Hatzakis Date: Tue, 4 Dec 2018 23:39:17 +0200 Message-ID: To: mike@sendwyre.com Content-Type: multipart/alternative; boundary="000000000000c09b1f057c39193c" X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, HTML_MESSAGE, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org X-Mailman-Approved-At: Tue, 04 Dec 2018 21:57:45 +0000 Cc: bitcoin-dev@lists.linuxfoundation.org Subject: Re: [bitcoin-dev] Proposal for Palindromic (Reversible) Mnemonics X-BeenThere: bitcoin-dev@lists.linuxfoundation.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Bitcoin Protocol Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Dec 2018 21:39:33 -0000 --000000000000c09b1f057c39193c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Michael, thanks for the feedback. To answer your question, the motivation was partly that some applications do not accept passphrases, making mnemonics less versatile in those cases in terms of vault separation when logging in to those services, although I agree in that specific context reversible mnemonics don't add further security (like a passphrase can) but it shouldn't lessen security either (in terms of entropy and bit-security). Of course, If someone finds a plaintexts recovery phrase (i.e. hacker) then there is no security to prevent the funds being moved out whether it is reversible or not (unless again a passphrase was present, and even that can be brute forced so protecting the words are key) unless it represented some multi-sig key or was a Shamir secret share (such as is being proposed under SLIP0039 by Satoshi Labs, and Ian Coleman hosts a prototype). I think comparable to vanity addresses, reversible mnemonics could be part novelty, but I do think there is also an actual utility. I am not suggesting they are used 100% of the time, rather a user could choose to generate one manually or check if their existing one is already reversible. Those options could be provided at the software level and then it would be up to the user to chose. Bottom line, I think that users who have smaller amounts in hot wallets could find it useful to have reversible mnemonics for switching from one service to another without having to access yet another mnemonic. Whereas, for those creating them offline (cold storage) it could provide an additional vault and additional passphrase options. Here's an example: Vault #1 normal mnemonic Vault #2 normal mnemonic w/passphrase Vault #3 reversed mnemonic Vault #4 reversed mnemonic w/passphrase Best regards, Steven Hatzakis On Tue, Dec 4, 2018 at 4:16 PM Michael Dunworth wrote: > Cool idea, and appreciate the explainer surrounding it! > > What are the motivators to have it? Simplifying the recovery process > (easier to remember?) - Would love to know more from that if you're happy > to share! That'd help gauge the security considerations. > > Security thoughts: > - Probability of guessing is one thing, probability of getting access to = a > keyword/phrase is another thing. So if the recovery/accessibility becomes= a > motivator, that then can broaden the attack vectors pretty significantly. > Which would result in a significant decrease in the security (IMO?). > - Broadcasting the use of reversable mnemonics would become an attack > vector potentially. Now any members of the security team or members withi= n > close proximity could learn that reversible phrases are used, and > insulating this information from becoming public knowledge would become > it's own security consideration. If it's already a 6.25% (1/16) chance > they're reversible, I wouldn't want it publicly known that it's a 100% > chance. > - Feels like it could be useful in terms of a "duress password" although > that might be implemented similarly to what Joseph mentioned where you > would route the reverse phrase to somewhere other than the core assets. > > May be misunderstanding or have bad maths this early in the morning, but = I > think I'd be nervous to implement something like this without a pretty > clear upside. Seems like it only adds additional risk? > > Thank you. > > Kind regards, > > Michael. > =E1=90=A7 > > On Tue, Dec 4, 2018 at 5:11 AM Steven Hatzakis via bitcoin-dev < > bitcoin-dev@lists.linuxfoundation.org> wrote: > >> Thanks, James and Joseph, for the feedback, >> It has been a fun experiment! >> >> I just want to note that the plausible deniability was not the motive bu= t >> just an example use-case, there are perhaps other use-cases that would b= e >> on the user to decide. I think having a mnemonic that is also reversible >> could be useful for other reasons - convenience related perhaps. >> *Re security:* I am still not convinced entirely that security is >> reduced at all because one still has to search through all entropy in th= e >> range of 2^128 to see whether any of those are reversible (unless there = is >> a way to only search the field of 2^124 that are reversible, which I don= 't >> think is possible because the hash-derived checksum cannot be determined >> before hashing, only afterward). Therefore, security should still be 2^1= 28 >> for a 12-word mnemonic whether it is reversible or not (as one in every = 16 >> people that already have one (12-word) is reversible, they just might no= t >> realize it, so we can't say those are less secure). >> >> Best regards, >> >> On Tue, Dec 4, 2018 at 2:16 PM James MacWhyte wrote= : >> >>> I agree with Joseph. If you want plausible deniability, it would be >>> better to simply hide the funds somewhere in the HD chain. Same if you = want >>> a second vault tied to the same phrase. >>> >>> You are reducing security by eliminating all entropy that doesn't fit >>> the reversible criteria, although in practice it doesn't make a differe= nce >>> because the numbers are so big. However, it doesn't seem like a very us= eful >>> feature to have. >>> >>> Thanks for doing all that work though, it was fun to read about your >>> idea and what you found out through experimenting! >>> >>> James >>> >>> >>> On Mon, Dec 3, 2018 at 1:00 PM Joseph Gleason =E2=91=88 via bitcoin-dev= < >>> bitcoin-dev@lists.linuxfoundation.org> wrote: >>> >>>> I have a suggestion. If you are concerned about plausible deniability= , >>>> then it might make sense to just have the single mnemonic seed lead to= a >>>> single xprv key (as usual) and then do a private key derivation from t= hat >>>> based on a password string. The password can be simple, as it is base= d on >>>> the security of the seed, just as long as the user feels they need for >>>> deniability. >>>> >>>> A simple reverse scheme like you describe would just be another thing = a >>>> person would know to check if given some seed so I don't see it as >>>> providing much value, but I could be missing something. >>>> >>>> On Mon, Dec 3, 2018 at 10:45 AM Steven Hatzakis via bitcoin-dev < >>>> bitcoin-dev@lists.linuxfoundation.org> wrote: >>>> >>>>> Hi All, >>>>> >>>>> I've developed a method to check if a mnemonic is also valid when the >>>>> words are put into reverse order (not the entropy), where a given 12 = or >>>>> 24-word mnemonic could be valid both in little endian and big endian >>>>> format. I've coined these "Palindromic Mnemonics", but perhaps more >>>>> user-friendly is "reversible mnemonics." >>>>> >>>>> Purpose: >>>>> A checksum-valid reversible mnemonic allows two separate vaults to be >>>>> connected to the same mnemonic string of words, where all a users mus= t do >>>>> is enter the words in reverse order (the last word becomes first, sec= ond to >>>>> last becomes second, and so on) to access the secondary (reversed wor= ds) >>>>> vault. This utility could provide multiple use-cases, including relat= ed to >>>>> combinations with passphrases and plausible deniability, as well as >>>>> conveniences for those wishing to use a separate vault tied to the sa= me >>>>> string of words. >>>>> >>>>> Security: >>>>> For any randomly generated 12-word mnemonic (128-bits of security) th= e >>>>> chances of it also being reversible are 1/16 (I believe), as a total = of 4 >>>>> bit positions must be identical (4 bits from the normal mnemonic and >>>>> another 4 bits from the reversed string must match). For a 24-word >>>>> mnemonic, those values increase to 8 bits which need to match 8 bits = from >>>>> the reversed string, leading to about 1 in every 256 mnemonics also b= eing >>>>> reversible. While the message space of valid reversible mnemonics sho= uld be >>>>> 2^124 for 12 words, that search must still be conducted over a field >>>>> of 2^128, as the hash-derived checksum values otherwise prevent a way >>>>> to deterministically find valid reversible mnemonics without first go= ing >>>>> through invalid reversible ones to check. I think others should chime= in on >>>>> whether they believe there is any security loss, in terms of entropy = bits >>>>> (assuming the initial 128 bits were generated securely). I estimate a= t most >>>>> it would be 4-bits of loss for a 12-word mnemonic, but only if an att= acker >>>>> had a way to search only the space of valid reversible mnemonics (2**= 124) >>>>> which I don't think is feasible (could be wrong?). There could also b= e >>>>> errors in my above assumptions, this is a work in progress and sharin= g it >>>>> here to solicit initial feedback/interest. >>>>> >>>>> I've already written the code that can be used for testing (on GitHub >>>>> user @hatgit), and when run from terminal/command prompt it is pretty= fast >>>>> to find a valid reversible mnemonics, whereas on IDLE in Python on a = 32-bit >>>>> and 64-bit machine it could take a few seconds for 12 words and somet= imes >>>>> 10 minutes to find a valid 24-word reversible mnemonic. >>>>> Example 12 words reversible (with valid checksum each way): >>>>> >>>>> limit exact seven clarify utility road image fresh leg cabbage hint >>>>> canoe >>>>> >>>>> And Reversed: >>>>> >>>>> canoe hint cabbage leg fresh image road utility clarify seven exact >>>>> limit >>>>> >>>>> >>>>> Example 24 reversible: >>>>> >>>>> favorite uncover sugar wealth army shift goose fury market toe messag= e >>>>> remain direct arrow duck afraid enroll salt knife school duck sunny g= runt >>>>> argue >>>>> >>>>> And reversed: >>>>> >>>>> argue grunt sunny duck school knife salt enroll afraid duck arrow >>>>> direct remain message toe market fury goose shift army wealth sugar u= ncover >>>>> favorite >>>>> >>>>> >>>>> My two questions 1) are how useful could this be for >>>>> you/users/devs/service providers etc.. and 2) is any security loss >>>>> occurring and whether it is negligible or not? >>>>> >>>>> Best regards, >>>>> >>>>> Steven Hatzakis >>>>> _______________________________________________ >>>>> bitcoin-dev mailing list >>>>> bitcoin-dev@lists.linuxfoundation.org >>>>> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev >>>>> >>>> _______________________________________________ >>>> bitcoin-dev mailing list >>>> bitcoin-dev@lists.linuxfoundation.org >>>> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev >>>> >>> _______________________________________________ >> bitcoin-dev mailing list >> bitcoin-dev@lists.linuxfoundation.org >> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev >> > > > -- > Michael Dunworth > Co-Founder, CEO > > > > We're now Wyre, Inc! Read about the rebrand here > . > > Wyre uses blockchain technology to help make your bank transfers faster > than email. > --000000000000c09b1f057c39193c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Hi Michael, thanks for the feedback.=C2=A0=
To answer your question, the motivation=C2=A0was partly that some = applications do not accept passphrases, making mnemonics less versatile in = those cases in terms of vault separation when logging in to those services,= although I agree in that specific context reversible mnemonics don't a= dd further security (like a passphrase can) but it shouldn't lessen sec= urity either (in terms of entropy and bit-security).

O= f course, If someone finds a plaintexts recovery phrase (i.e. hacker) then = there is no security to prevent the funds being moved out whether it is rev= ersible or=C2=A0not (unless again a passphrase was present, and even that c= an be brute forced so protecting the words are key) unless it represented s= ome multi-sig key or was a Shamir secret share (such as is being proposed u= nder SLIP0039 by Satoshi Labs, and Ian Coleman hosts a prototype).=C2=A0

I think comparable to vanity addresses, reversible mnemo= nics could be part novelty, but I do think there is also an actual utility.= I am not suggesting they are used 100% of the time, rather a user could ch= oose to generate one manually or check if their existing one is already rev= ersible. Those options could be provided at the software level and then it = would be up to the user to chose. Bottom line, I think that users who have = smaller amounts in hot wallets could find it useful to have reversible mnem= onics for switching from one service to another without having to access ye= t another mnemonic. Whereas, for those creating them offline (cold storage)= it could provide an additional vault and additional passphrase options. He= re's an example:
=C2=A0
Vault #1 normal mnemonic=C2=A0<= /div>
Vault #2 normal mnemonic w/passphrase
Vault #3 reversed mne= monic
Vault #4 reversed mnemonic w/passphrase

=
Best regards,

Steven=C2=A0Hatzakis=C2=A0

<= /div>

On Tue, Dec 4, 2018 at 4:16 PM Michael Dunworth <mike@sendwyre.com> wrote:
Cool idea, and appreciate the explainer surr= ounding it!

What are the motivators to have it? Simplify= ing the recovery process (easier to remember?) - Would love to know more fr= om that if you're happy to share! That'd help gauge the security co= nsiderations.=C2=A0=C2=A0

Security thoughts:
=
- Probability of guessing is one thing, probability of getting access = to a keyword/phrase is another thing. So if the recovery/accessibility beco= mes a motivator, that then can broaden the attack vectors pretty significan= tly. Which would result in a significant decrease in the security (IMO?).
- Broadcasting the use of reversable mnemonics would become an att= ack vector potentially. Now any members of the security team or members wit= hin close proximity could learn that reversible phrases are used, and insul= ating this information from becoming public knowledge would become it's= own security consideration. If it's already a 6.25% (1/16) chance they= 're reversible, I wouldn't want it publicly known that it's a 1= 00% chance.
- Feels like it could be useful in terms of a "d= uress password" although that might be implemented similarly to what J= oseph mentioned where you would route the reverse phrase to somewhere other= than the core assets.

May be misunderstanding or = have bad maths this early in the morning, but I think I'd be nervous to= implement something like this without a pretty clear upside. Seems like it= only adds additional risk?

Thank you.
<= br>
Kind regards,

Michael.
=3D""=E1=90=A7

On Tue, Dec 4, 2018 at 5:11 AM Steven Hatzakis via bitcoin-dev &= lt;bitcoin-dev@lists.linuxfoundation.org> wrote:
Thanks, James and Joseph, for the feedback,
It has been a fun experiment!= =C2=A0

<= /div>
I just want to n= ote that the plausible deniability was not the motive but just an example u= se-case, there are perhaps other use-cases that would be on the user to dec= ide. I think having a mnemonic that is also reversible could be useful for = other reasons - convenience related perhaps.=C2=A0
Re security: I am still not convi= nced entirely that security is reduced at all because one still has to sear= ch through all entropy in the range of=C2=A02^128 to see whether any of tho= se are reversible (unless there is a way to only search the field of 2^124 = that are reversible, which I don't think is possible because the hash-d= erived checksum=C2=A0cannot be determined before hashing, only afterward). = Therefore, security should still be 2^128 for a 12-word mnemonic whether it= is reversible or=C2=A0not (as one in every 16 people that already have one= (12-word) is reversible, they just might not realize it, so we can't s= ay those are less secure).=C2=A0

Best regards,

On= Tue, Dec 4, 2018 at 2:16 PM James MacWhyte <macwhyte@gmail.com> wrote:
I agree with Joseph. If you wa= nt plausible deniability, it would be better to simply hide the funds somew= here in the HD chain. Same if you want a second vault tied to the same phra= se.

You are reducing security by eliminating all entropy= that doesn't fit the reversible criteria, although in practice it does= n't make a difference because the numbers are so big. However, it doesn= 't seem like a very useful feature to have.

Thanks f= or doing all that work though, it was fun to read about your idea and what = you found out through experimenting!

James


On Mon, Dec 3, 2018 at 1:00 PM Joseph = Gleason =E2=91=88 via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org= > wrote:
I = have a suggestion.=C2=A0 If you are concerned about plausible deniability, = then it might make sense to just have the single mnemonic seed lead to a si= ngle xprv key (as usual) and then do a private key derivation from that bas= ed on a password string.=C2=A0 The password can be simple, as it is based o= n the security of the seed, just as long as the user feels they need for de= niability.

A simple reverse scheme like you describe wou= ld just be another thing a person would know to check if given some seed so= I don't see it as providing much value, but I could be missing somethi= ng.

On Mon, Dec = 3, 2018 at 10:45 AM Steven Hatzakis via bitcoin-dev <bitcoin-dev@lists.l= inuxfoundation.org> wrote:
<= div dir=3D"ltr">

Hi All,=C2=A0

I've developed a method to check if = a mnemonic is also valid when the words are put into reverse order (not the= entropy), where a given 12 or 24-word mnemonic could be valid both in litt= le endian and big endian format. I've coined these "Palindromic Mn= emonics", but perhaps more user-friendly is "reversible mnemonics= ."

Purpose:
A checksum-valid reversible mnemonic allows two separate vaul= ts to be connected to the same mnemonic string of words, where all a users = must do is enter the words in reverse order (the last word becomes first, s= econd to last becomes second, and so on) to access the secondary (reversed = words) vault. This utility could provide multiple use-cases, including rela= ted to combinations with passphrases and plausible deniability, as well as = conveniences for those wishing to use a separate vault tied to the same str= ing of words.

Security:
For any randomly generated 12-word mnemonic (128-bits = of security) the chances of it also being reversible are 1/16 (I believe), = as a total of 4 bit positions must be identical (4 bits from the normal mne= monic and another 4 bits from the reversed string must match). For a 24-wor= d mnemonic,=C2=A0those values increase to 8 bits which need to match 8 bits= from the reversed string, leading to about 1 in every 256 mnemonics also b= eing reversible. While the message space of valid reversible mnemonics shou= ld be 2^124 for 12 words, that search= must still be conducted over a field of 2^128, as the hash-derived checksum value= s otherwise prevent a way to deterministically find valid reversible mnemon= ics without first going through invalid reversible ones to check. I think o= thers should chime in on whether they believe there is any security loss, i= n terms of entropy bits (assuming the initial 128 bits were generated secur= ely). I estimate at most it would be 4-bits of loss for a 12-word mnemonic,= but only if an attacker had a way to search only the space of valid revers= ible mnemonics (2**124) which I don't think is feasible (could be wrong= ?). There could also be errors in my above assumptions, this is a work in p= rogress and sharing it here to solicit initial feedback/interest.

I've already written the code= that can be used for testing (on GitHub user @hatgit), and when run from t= erminal/command prompt it is pretty fast to find a valid reversible mnemoni= cs, whereas on IDLE in Python on a 32-bit and 64-bit machine it could take = a few seconds for 12 words and sometimes 10 minutes to find a valid 24-word= reversible mnemonic.=C2=A0

Example 12 words reversible (with valid chec= ksum each way):

limit exact seven clarify utility road image fresh = leg cabbage hint canoe

And Reversed:

canoe hint cabbage leg f= resh image road utility clarify seven exact limit


Example 24 rev= ersible:

favorite uncover sugar wealth army shift goose fury market = toe message remain direct arrow duck afraid enroll salt knife school duck s= unny grunt argue

And reversed:

argue grunt sunn= y duck school knife salt enroll afraid duck arrow direct remain message toe= market fury goose shift army wealth sugar uncover favorite


My two questions 1) are how useful could this be for you= /users/devs/service providers etc.. and 2) is any security loss occurring a= nd whether it is negligible or not?

Best regards,

=

Steven=C2=A0Hatzakis=C2=A0
_______________________________________________
bitcoin-dev mailing list
= bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mail= man/listinfo/bitcoin-dev
_______________________________________________
bitcoin-dev mailing list
= bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mail= man/listinfo/bitcoin-dev
_______________________________________________
bitcoin-dev mailing list
= bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mail= man/listinfo/bitcoin-dev


--
Michael Dunworth
Co-Founder, CEO=



We'r= e now Wyre, Inc!=C2=A0Rea= d about the rebrand here.

=
Wyre uses blockchain technolog= y to help make your bank transfers faster than email.
--000000000000c09b1f057c39193c--