Date: Fri, 12 Jan 2018 04:50:58 -0500
From: Peter Todd <pete@petertodd.org>
To: Perry Gibson <perry@gibsonic.org>
Message-ID: <20180112095058.GA9175@savin.petertodd.org>
References: <CAAS2fgR-or=zksQ929Muvgr=sgzNSugGp669ZWYC6YkvEG=H5w@mail.gmail.com>
	<ae570ccf-3a2c-a11c-57fa-6dad78cfb1a5@satoshilabs.com>
	<CAAS2fgRQvpa8VXE8YAYSfugDvCu=1+5ANsGk1V_OXtHPGD=Ltw@mail.gmail.com>
	<vJsDz9YdeNQQ_PZRf5HP1W0FmcWyKHIuwN9QeNgN-WXCdQcRmXLtkQ3wfTO7YUCgG6AFgOkKeU6fdsGTKkGcnk-_OOY_jyNlfWkFQ31d2ZU=@protonmail.com>
	<20180109011335.GA22039@savin.petertodd.org>
	<274aad5c-4573-2fdd-f8b0-c6c2d662ab7c@gibsonic.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="y0ulUmNC+osPPQO6"
Content-Disposition: inline
In-Reply-To: <274aad5c-4573-2fdd-f8b0-c6c2d662ab7c@gibsonic.org>
User-Agent: Mutt/1.5.23 (2014-03-12)
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Satoshilabs secret shared private key scheme
Precedence: list


--y0ulUmNC+osPPQO6
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Jan 09, 2018 at 12:43:48PM +0000, Perry Gibson wrote:
> >Trezor's "plausible deniability" scheme could very well result in you go=
ing to
> >jail for lying to border security, because it's so easy for them to simp=
ly
> >brute force alternate passwords based on your seeds. With that, they hav=
e proof
> >that you lied to customs, a serious offense.
> The passphrase scheme as I understand it allows a maximum of 50 characters
> to be used.=C2=A0 Surely even with the HD seed, that search space is too =
large to
> brute force.=C2=A0 Or is there a weakness in the scheme I haven't clocked?

While passphrases *can* be long, most user's aren't going to understand the
risk. For example, Trezors blog(1) doesn't make it clear that the passphras=
es
could be bruteforced and used as evidence against you, and even suggests the
contrary:

    Since the passphrase is never saved on the device, this means that ther=
e is no
    wrong passphrase. The device does not know which one you have chosen, a=
nd
    therefore all of them are correct! Given the same seed, for each and ev=
ery
    letter combination used as a passphrase, a different wallet will be gen=
erated.

and:

    Since there is no way to prove that there is any wallet beyond the ones
    that you have admitted to, the =E2=80=9Cattacker=E2=80=9D will have to =
be satisfied with
    the revealed ones.


Also note how this blog doesn't mention anti-forensics: the wallet software
itself may leave traces of the other wallets on the computer. Have they rea=
lly
audited it sufficiently to be sure this isn't the case?

1) https://blog.trezor.io/hide-your-trezor-wallets-with-multiple-passphrase=
s-f2e0834026eb

--=20
https://petertodd.org 'peter'[:-1]@petertodd.org

--y0ulUmNC+osPPQO6
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----

iQEcBAEBCAAGBQJaWIT/AAoJECSBQD2l8JH7KnsH/2+UTkEG7AahZoKToyvWWnOj
W1QzjP5nINYy86qTaqB51llkqr8eR0W6/SWiwU0aE8cHSc2t7k0N4H4gJd1JaTQ0
0KqgEJO4dtujeW8ITpOMVYTBu/UO6KSDAMcWFwRB+7Gl9HpM0uDkhTKlzsqn2chm
qb/IK3cBc14qM8F7MYhiSjpByrqgkqVtjOrZ4KgfmYgWqWsCuk5Ke85N5A525GKb
vtCEuMtg3R9hnPzgCLRfuQr0XB1YzJ2VQPPh4sTqxiLaXhQ6RZBtDJ9FHU3sQfce
67CvU44w6NyZk47iMZVFVD4oZutf3bDOnHdMAFpcjEblVfMfLQPNZBIfizNPRPM=
=bJV/
-----END PGP SIGNATURE-----

--y0ulUmNC+osPPQO6--