MIME-Version: 1.0
References: <5797AC88.8030507@gmail.com> <5797C3A7.5030600@jonasschnelli.ch>
In-Reply-To: <5797C3A7.5030600@jonasschnelli.ch>
From: Jochen Hoenicke <hoenicke@gmail.com>
Date: Wed, 27 Jul 2016 10:39:36 +0000
Message-ID: <CANYHNmLot1+-LbisfrPRtgDPnofD7bnQ3By_pgT2RFvLHRm7Hg@mail.gmail.com>
To: Jonas Schnelli <dev@jonasschnelli.ch>, 
	Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary=047d7ba97076ce52c405389ba272
Subject: Re: [bitcoin-dev] BIP proposal: derived mnemonics
Precedence: list

--047d7ba97076ce52c405389ba272
Content-Type: text/plain; charset=UTF-8

Jonas Schnelli via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org>
schrieb am Di., 26. Juli 2016 um 22:10 Uhr:

> Side-note: Bip39 does still use PBKDF2 with 2048 iterations which I
> personally consider "not enough" to protect a serious amount of funds.
>
>
But what are the alternatives?  Put an expensive processor and a decent
amount of memory in every hardware wallet to support scrypt?  Use a million
iterations and just wait 10 minutes after entering you passphrase?  Or
compute the secret key on your online computer instead?

Also, how many iterations are secure?  A million?  Then just add two random
lower-case letters to the end of your passphrase and you have a better
protection with 2048 iterations. If you want to be able to use your
passphrase with cheap hardware and be protected against a high-end computer
with multiple GPUs that is almost a mllion times faster, then you have to
choose a good passphrase.  Or just make sure nobody steals your seed; it is
not a brainwallet that is only protected by the passphrase after all.

Regards,
  Jochen

--047d7ba97076ce52c405389ba272
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_quote"><div dir=3D"ltr">Jonas Schnelli=
 via bitcoin-dev &lt;<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.or=
g">bitcoin-dev@lists.linuxfoundation.org</a>&gt; schrieb am Di., 26. Juli 2=
016 um 22:10=C2=A0Uhr:<br></div><blockquote class=3D"gmail_quote" style=3D"=
margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Side-note: B=
ip39 does still use PBKDF2 with 2048 iterations which I<br>
personally consider &quot;not enough&quot; to protect a serious amount of f=
unds.<br><br></blockquote><div><br></div><div><span style=3D"line-height:1.=
5">But what are the alternatives?=C2=A0 Put an expensive processor and a de=
cent amount of memory in every hardware wallet to support scrypt?=C2=A0 Use=
 a million iterations and just wait 10 minutes after entering you passphras=
e?=C2=A0 Or compute the secret key on your online computer instead?</span><=
br></div><div><br></div><div><div>Also, how many iterations are secure?=C2=
=A0 A million?=C2=A0 Then just add two random lower-case letters to the end=
 of your passphrase and you have a better protection with 2048 iterations.=
=C2=A0<span style=3D"line-height:1.5">If you want to be able to use your pa=
ssphrase with cheap hardware and be protected against a high-end computer w=
ith multiple GPUs that is almost a mllion times faster, then you have to ch=
oose a good passphrase.=C2=A0 Or just make sure nobody steals your seed; it=
 is not a brainwallet that is only protected by the passphrase after all.</=
span></div></div><div><br></div><div>Regards,</div><div>=C2=A0 Jochen</div>=
<div><br></div></div></div>

--047d7ba97076ce52c405389ba272--