Date: Mon, 8 Jan 2018 19:37:25 -0500
From: Peter Todd <pete@petertodd.org>
To: Ben Kloester <benkloester@gmail.com>
Message-ID: <20180109003725.GA21800@savin.petertodd.org>
References: <CAAS2fgR-or=zksQ929Muvgr=sgzNSugGp669ZWYC6YkvEG=H5w@mail.gmail.com>
	<ae570ccf-3a2c-a11c-57fa-6dad78cfb1a5@satoshilabs.com>
	<20180108124506.GA13858@savin.petertodd.org>
	<5c229def-760a-69eb-e646-bd3c77482b00@satoshilabs.com>
	<20180108193714.GA15359@savin.petertodd.org>
	<CANgJ=T-CNrzLCtS2PdjCXNq+6LzQ=aM9_Fxw-yF5t3vARXwcuQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="+QahgC5+KEYLbs62"
Content-Disposition: inline
In-Reply-To: <CANgJ=T-CNrzLCtS2PdjCXNq+6LzQ=aM9_Fxw-yF5t3vARXwcuQ@mail.gmail.com>
User-Agent: Mutt/1.5.23 (2014-03-12)
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Satoshilabs secret shared private key scheme
Precedence: list


--+QahgC5+KEYLbs62
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Jan 09, 2018 at 09:26:17AM +1100, Ben Kloester wrote:
> > This sounds very dangerous. As Gregory Maxwell pointed out, the key
> derivation
> > function is weak enough that passphrases could be easily brute forced
>=20
> So you are essentially imagining that a perpetrator will combine the
> crypto-nerd fantasy (brute forcing the passphrase) *with* the 5-dollar
> wrench attack, merging both panes of Randall Munroe's comic? Seems
> vanishingly unlikely to me - attackers are generally either the wrench
> type, or the crypto-nerd type.

We're talking about seeds here, not hardware wallets.

For a hardware wallet theft scenario, if you're worried about muggers you c=
an
make the hardware have secret accounts with different seeds, *without* risk=
ing
user funds getting lost - a much more likely scenario - due to mistyped
passwords.

In any case, even if you were to do this type of design, a much better idea=
 is
to use a checksum by default to reject invalid passwords, while having an
advanced-use-only option to override that checksum. The virtual file encryp=
tion
filesystem encfs does exactly this with its --anykey flag. This allows adva=
nced
users to do their thing, while protecting the majority of users for whome t=
his
feature is dangerous.

--=20
https://petertodd.org 'peter'[:-1]@petertodd.org

--+QahgC5+KEYLbs62
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----

iQEcBAEBCAAGBQJaVA7CAAoJECSBQD2l8JH7QvYH/27q6znMSZCnR7HlHrOMSLTk
cR42uFegAWISOSXtIxZdInmQ+vz/okKzkcJ9DlaVVwxUDKcxlGu5810tgTP8YSag
Q0ggzPHIv/VRP3+fXZiu1D+beUkmUXLtslnjqII4hON3Vrt0HB5LIgqK6atGjwtq
DMa2C8l4J5Z5dh3ve5gzA9PElCfIkv+AJnJUipAlCMzjRG8JEF6uKxAUk97NYp0I
xRkK/X21WNbdSttVk0ADspzR6iBp1jI2ojaSmoMYDBt0pDbeuy9sowHzkqelRjTJ
acYK5fJbXBiTL6erzhsesAQ/D10a/XibzySj95IkT54adesDNm+lm13tlQLH0GQ=
=mnaQ
-----END PGP SIGNATURE-----

--+QahgC5+KEYLbs62--