MIME-Version: 1.0
References: <CAFUsdzpsoia+1XZs2qzWbanYoOT1g_+43=iGutyKYrCjFCCM5w@mail.gmail.com>
	<CAH+Axy7YXDC4M0o9WHwaR2k46nWYBtM9VetXyBMx=B9-fxupug@mail.gmail.com>
In-Reply-To: <CAH+Axy7YXDC4M0o9WHwaR2k46nWYBtM9VetXyBMx=B9-fxupug@mail.gmail.com>
From: Trey Del Bonis <j.delbonis.3@gmail.com>
Date: Tue, 5 Mar 2019 20:37:35 -0500
Message-ID: <CAFUsdzpfWe8pcdBWf5hrOoydWTwOwyGPrbOoYW221naNxKGUcQ@mail.gmail.com>
To: James MacWhyte <macwhyte@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Fortune Cookies to Bitcoin Seed
Precedence: list

>Mid-level hardware can check 50k addresses per second, which means it woul=
d only take around 2 hours to check all possibilities.

Yes that's a problem that I'm now realizing exists.  Whoops!  Changing
the parameters to a 25-of-50 setup gets us ~129 bits in that case,
which is better but still somewhat crappy as 25 is a lot of words to
remember.  You'd be *far* better off just memorizing a BIP-39
seedphrase.  Maybe it would make sense to include in the hash some
extra secret phrase as extra entropy?  Probably not worth it.

>Maybe they only print 35 different combinations and assume people don't ea=
t Chinese food enough to notice?

Upon some later research I found that this is actually the case from
certain vendors, which is unfortunate.

>I'm not sure why you would want to go this route :)

Because it was a fun idea I had while eating Chinese take-out the other day=
. :)

On Tue, Mar 5, 2019 at 8:06 PM James MacWhyte <macwhyte@gmail.com> wrote:
>
> On Tue, Mar 5, 2019 at 4:39 PM Trey Del Bonis via bitcoin-dev <bitcoin-de=
v@lists.linuxfoundation.org> wrote:
>>
>> Keeping 20 around is a little excessive but it gives 390700800 possible =
wallets. So security can be trivially parameterized based on how secure you=
 want your wallet to be if someone finds your stash.
>
>
> Mid-level hardware can check 50k addresses per second, which means it wou=
ld only take around 2 hours to check all possibilities. So please don't thi=
nk this presents any kind of challenge to someone who finds your 20 pieces =
of paper and assumes you would only keep them if they are hiding your walle=
t ;)
>
> Entropy-wise, simply using a strong RNG would provide a better result tha=
n relying on the printing company. Maybe they only print 35 different combi=
nations and assume people don't eat Chinese food enough to notice?
>
> If it's poor entropy and doesn't really provide any protection against be=
ing brute forced if found, I'm not sure why you would want to go this route=
 :)
>
> James