For a more fleshed out version that is still fairly easy to follow:

https://github.com/ciyam/ciyam/blob/master/src/crypto_keys.cpp#L761

(it includes support for an optional OP_RETURN *message*)

Personally I would hope not - I was involved in a hugely funded project to build a stack based VM system before Java existed in the early 90's and as a programmer (who worked on that project) I can say that I am no fan of such stack based languages (they are far less elegant than using a more traditional CPU style approach).

I very much doubt that Bitcoin's script could be of any use as it is not Turing complete and although actual Bitcoin transactions are handled by it things like re-orgs cannot be handled by it at all (nor could it handle any of the p2p stuff).

How is your stats math gong fu?

Are you up to providing accurate math for the probabilities of consensus with a different algo to PoW or PoS?

I am also keen to understand the VM suggestion and why @gmaxwelll thinks that would be better than just creating a C/C++ lib with wrappers for other languages to use.

Are we talking about a new VM that is just for Bitcoin?

The CIYAM Safe (https://susestudio.com/a/kp8B3G/ciyam-safe) is another offline transaction signing solution (100% air-gapped by usage of QR codes and cams).

It uses AES256 with the number of rounds I believe being dependent upon your hardware (therefore that number would be stored in the wallet itself).

There is also a salt string used (which is presumably from a random source).

You are really *reaching with this* - so you think that someone has worked out my private key and not taken the funds.

Then I'd ask that person to sign a message showing that they have the private key otherwise your post is rather ridiculous.

Well - if no-one can empty my address then how would you explain that?

(luck?)

Sure - let's just get back to the address I mentioned and the funds - not some imaginary situation.

No one is assuming anything other than that.

This is about entropy - if my passphrase entropy is not good enough then the funds will be stolen.

@Danny - there are people running software 24x7 to hack weak passwords - you know this.

So why pretend that you don't?

Again there is still 1 BTC there.

Steal it (oh yes - I forgot - you can't).

So you are over 50 years old now?

(seriously that is not a good argument)

If my key could have been found easily it would have already been found.

A big part of the reason I created this topic was to measure the thinking that others have about brainwallets.

It is correct that most people are not capable of creating good brainwallets but to suggest that no-one can do this is IMO just wrong. If I lose the 1 BTC I've exposed then maybe I'll have to change my thinking - but until then I am saying brainwallets are a great way to store funds for those that have the capability to do so.

And btw - anyone trying to find my key by following the suggestions that I made in this topic won't have a chance to get my 1 BTC. 

The human brain is far more capable than most people seem to give it credit for - so I give this 1 BTC wallet as an example of that (if I lose that 1 BTC it is not as though it won't be noticed now).

Again I am not against using random methods to help but after seeing the failures of PRNG's before I'd rather trust myself than an OS that might have a buggy PRNG (of course the dice suggestion is a good one).

True - if you use a bad passphrase for your brainwallet you'll lose your funds almost instantly.

But the purpose of this topic is not to debate about that but whether or not you can actually protect BTC with a good brainwallet (as nearly every topic I have read on this forum about brainwallets suggests that my 1 BTC should have already been stolen).

So why is my 1 BTC not stolen?

The actual length I used for my brainwallet is longer but not much longer (again I will state that this address was created over 2 years ago and has not been hacked).

Am sure there are some now trying to crack my address but that's okay - this is the experiment I am doing.

And we have seen broken PRNGs lead to the loss of many Bitcoins already.

I personally trust my own brain more than than a PRNG - if you wish to trust a PRNG that is of course your choice.

As stated - I checked the address by remembering my passphrase before I created the topic (so I have managed to remember it now for over 2 years).

@itod - if my brainwallet doesn't have enough entropy then why does it still have 1 BTC?

I am not against hardening one's brainwallet but my point is rather a simple one - if no-one can possibly come up with a secure brainwallet then why do I still have 1 BTC (I should have zero) and this brainwallet has existed for over 2 years (presumably since I've now made this address public the funds should be gone very soon).

So let's see how quickly I lose the 1 BTC (I have published this address as an experiment).