📅 Original date posted:2014-01-24
📝 Original message:Le 24/01/2014 10:05, Peter Todd a écrit :
> On Tue, Jan 21, 2014 at 01:00:43AM +0100, Thomas Voegtlin wrote:
>> Hi slush,
>>
>> Thank you for your new proposal; it seems to be a compromise.
>>
>> @Christophe Biocca:
>> If the wordlist becomes part of the standard, then we will run into
>> problems of collisions once users ask for wordlists in every language.
>>
>> IMO the right approach is to implement checksums that do not depend
>> on the wordlist (eg the 'brute force' method, Hash(mnemonic||1) mod
>> 2^k == 0 )
>> this would also allow us to implement sipa's variable stretching proposal.
>>
>> I understand this is not possible because of the computational
>> requirements of devices such as trezor.
> Is it? Surely the trezor can bruteforce, say, 8 bits == 0. How many
> SHA256/sec can the trezor hardware do? Generating your seed is a
> one-time thing after all - that taking 10-30s doesn't seem like a big
> deal to me.
>
> Even a 1/256th "checksum" will really cut down on the number of mistakes
> made and money lost.
slush, correct me if I'm wrong, but I don't think that's the only reason:
They want to generate a seed by combining entropy from the trezor device
and from the user's computer;
In addition, they want the computer to be able to check that the seed
actually was derived from the entropy it provided, using only a master
public key (the computer does not have access to the seed)
This is why they designed bip39 that way.
I think the new bip39 proposal could be used in Electrum as an option
for trezor, but I am reluctant to make it default, because it imposes
its own dictionary.
Thomas Voegtlin [ARCHIVE] /
npub10f…7ej47
2023-06-07 15:12:24
in reply to nevent1q…cjq7
Author Public Key
npub10f96gqrsu4qpygfgvuvzce47aavjvql703egfde0l2hua8dzpszs67ej47Published at
2023-06-07 15:12:24Event JSON
{
"id": "36c53984cdf24c9bea84f693972a921f4dbc2055feb0e623d159777fb4e749c1",
"pubkey": "7a4ba40070e54012212867182c66beef592603fe7c7284b72ffaafce9da20c05",
"created_at": 1686150744,
"kind": 1,
"tags": [
[
"e",
"fc93117f98479f5d69e7743f0323a5e1a0e6bc3324ce5260981ec55279ad31dc",
"",
"root"
],
[
"e",
"5f88bbd4b085a7b8d3410ad4d0145860c87d424b6be5760f259c71027cdb5ad8",
"",
"reply"
],
[
"p",
"daa2fc676a25e3b5b45644540bcbd1e1168b111427cd0e3cf19c56194fb231aa"
]
],
"content": "📅 Original date posted:2014-01-24\n📝 Original message:Le 24/01/2014 10:05, Peter Todd a écrit :\n\u003e On Tue, Jan 21, 2014 at 01:00:43AM +0100, Thomas Voegtlin wrote:\n\u003e\u003e Hi slush,\n\u003e\u003e\n\u003e\u003e Thank you for your new proposal; it seems to be a compromise.\n\u003e\u003e\n\u003e\u003e @Christophe Biocca:\n\u003e\u003e If the wordlist becomes part of the standard, then we will run into\n\u003e\u003e problems of collisions once users ask for wordlists in every language.\n\u003e\u003e\n\u003e\u003e IMO the right approach is to implement checksums that do not depend\n\u003e\u003e on the wordlist (eg the 'brute force' method, Hash(mnemonic||1) mod\n\u003e\u003e 2^k == 0 )\n\u003e\u003e this would also allow us to implement sipa's variable stretching proposal.\n\u003e\u003e\n\u003e\u003e I understand this is not possible because of the computational\n\u003e\u003e requirements of devices such as trezor.\n\u003e Is it? Surely the trezor can bruteforce, say, 8 bits == 0. How many\n\u003e SHA256/sec can the trezor hardware do? Generating your seed is a\n\u003e one-time thing after all - that taking 10-30s doesn't seem like a big\n\u003e deal to me.\n\u003e\n\u003e Even a 1/256th \"checksum\" will really cut down on the number of mistakes\n\u003e made and money lost.\n\nslush, correct me if I'm wrong, but I don't think that's the only reason:\nThey want to generate a seed by combining entropy from the trezor device \nand from the user's computer;\nIn addition, they want the computer to be able to check that the seed \nactually was derived from the entropy it provided, using only a master \npublic key (the computer does not have access to the seed)\n\nThis is why they designed bip39 that way.\n\nI think the new bip39 proposal could be used in Electrum as an option \nfor trezor, but I am reluctant to make it default, because it imposes \nits own dictionary.",
"sig": "14dc8f41db856d97d15eeda1fdc1754017e06aac7e95872e60bc1dd072cae1ad0e7983eae9034d89a2c103171dba98239b89d70bf0ef2d2db6cbaefbb9fa1c30"
}