Delivery-date: Fri, 24 May 2024 03:59:25 -0700
Received-SPF: pass (google.com: domain of ganrama@proton.me designates 185.70.40.137 as permitted sender) client-ip=185.70.40.137;
Date: Fri, 24 May 2024 10:39:57 +0000
To: Andrew Poelstra <apoelstra@wpsoftware.net>
From: "'Rama Gan' via Bitcoin Development Mailing List" <bitcoindev@googlegroups.com>
Cc: "bitcoindev@googlegroups.com" <bitcoindev@googlegroups.com>
Subject: Re: [bitcoindev] Penlock, a paper-computer for secret-splitting BIP39
 seed phrases
Message-ID: <EfekwtxUZKN_4z53hjqo7lXhcMDaRHlIC-EOWNjcpL_cJgeYPa1-_1g0b6PxLZPEL0oj7YAXEWK7yg7WiEHH2FkIk7WHIFGwjMB1zoxYb6M=@proton.me>
In-Reply-To: <ZkZBSriGn96GDLg-@camus>
References: <9bt6npqSdpuYOcaDySZDvBOwXVq_v70FBnIseMT6AXNZ4V9HylyubEaGU0S8K5TMckXTcUqQIv-FN-QLIZjj8hJbzfB9ja9S8gxKTaQ2FfM=@proton.me> <ZkIYXs7PgbjazVFk@camus> <GqYxqTBUgHl6yq1UAaOc2O9Ea4-5yKnM-jGZzGaKC19c-k3KcUN_Bo2e7XPYUrNaX3NMJC0tCMudgSl0_l1BCRUz4DIYBR1ecL2ifopzs98=@proton.me> <ZkNqVZFNBNTq7mAL@camus> <e1V4sbaLiJ4XGzEEEnr7lg2O1h3OxQabGcSoeTmDeo8bLVgIGhz9HHo3qtGQIVi-5aoU4xc2Kdj_qcC8Rt_xtFvQDahhXcIg4V0raMJxh2Y=@proton.me> <ZkYJ21cloqyvT93G@camus> <ZkZBSriGn96GDLg-@camus>
Feedback-ID: 79991369:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Reply-To: Rama Gan <ganrama@proton.me>
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com

> Ah, I am incorrect. You can put the recovery windows on a slide wheel
> but it needs to use a different ordering than the one used for addition.
> So you would need a second wheel and possibly some relabelling of
> recovery windows.
> 
> I don't see why this is ... it seems that the recovery windows, being
> differences of characters, should follow exactly the same pattern as
> addition (possibly in the opposite direction). So worth investigating.

No, no, you were right, it can be done.

If you want to find the difference between A[2] and D[5], you can place the
pointer on A, find D on the outer ring and the corresponding inner-ring
character will be B[3]. Then, it is possible to write the numerical values under
the first 14 characters as you suggested before. (We only care about the
_shortest_ distance.)

I chose to use a window because it's less "verbose". I didn't want to clutter
the wheel with information that you'd use only once per recovery. (Using the
window is in fact more compact.)

About a header, the problem is that the fast 2-of-M algorithm won't preserve
constant values across shares as Codex32 does. In Penlock, the header
information is simply printed/written on the share instead of being encoded. The
best I can do is to tweak both algorithm so that you can derive the secret and
share's index correctly, by using "-[28]" as the secret's index. (But the secret
is not a point on the line, and the share at X=28 would have a different value,
so that might be more confusing than anything)

-- Rama Gan

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcoindev/EfekwtxUZKN_4z53hjqo7lXhcMDaRHlIC-EOWNjcpL_cJgeYPa1-_1g0b6PxLZPEL0oj7YAXEWK7yg7WiEHH2FkIk7WHIFGwjMB1zoxYb6M%3D%40proton.me.