Use of countries to grab more entropy for brain wallets

[jim618]

I was playing around today with the easiest way to remember 128 bits for a private key.

The nicest way I have seen so far is from etotheipi (IIRC) which was:

Choose 8 words from a vocab list of 2^16 (= 65536) words.

This gives 8 * 16 = 128 bits of entropy.


I looked at various sets of things and how easy they were to remember and think countries is quite useful.
It is a little nebulous the definition of a country but let's use the US State department's list of 195 countries. This gives 7.6 bits per country choice.

To get 128 bits of entropy you can then use:

6 choices of a country plus a word from a vocab list of around 13700.

You can have a simpler vocab list, which could concentrate more on concrete things.
To remember the full 128 bits for a private key you might have to memorise a list:

cat from Benin
umbrella from Guatemala
pomegranate from Canada
brick from Malaysia
sausage from Australia
roof from Mongolia

To make best use that our memories are associative, you would first remember:

cat
umbrella
pomegranate
brick
sausage
roof

These have to be remembered in order. I suggest these are just remembered by rote or by a little 'nonsense story'. (The cat walked past the umbrella and saw a pomegranate sat on a brick. Then some sausages fell off the roof).

And then you would need to remember:
What country was the cat/ umbrella/ pomegranate/ brick/ sausage/ roof from?
You could do this be imagining, say,  a shocked Canadian mounty holding a pomegranate, the Sydney harbour bridge made out of sausages or whatever.

Do people think this is an easier way to remember 128 bits?

[ElectricMucus]

Nice idea, but I think it's better to use words in a more meaningful context even if that in theory might mean loosing entropy.
For example, get 10 words from a wordlist until you can make a sentence out of it and drop one or two if necessary.

[casascius]

Tripped on a pomegranate from Botswana and broke my ulna and lost reticulocytes while harpooning in the desert.

[ElectricMucus]

Tripped on a pomegranate from Botswana and broke my ulna and lost reticulocytes while harpooning in the desert.

 

[phatsphere]

if it is easy to remember, by any standards, it's poor. that's basically a by-product of the kolmogorov complexity.

nobody knows how good word-based attacks will work in 10 years, hence better don't rely on such simplifications.

[jim618]

It still has the full 128 bits of entropy.

The 6 'concrete words' list is shorter and hence easier to remember.

Then each 'concrete word' you visualise in a country specific setting which is the sort of thing humans are good at.

Try it yourself - it is a lot easier than trying to remember:

1101101101010011101110111011100010100101010101110001011001110101011011011010100 111011101110101000101001000101011100010110111101010

(that should be 128 bits!)

[ribuck]

Country names are not a good choice because they become obsolete. No-one talks anymore about Ceylon, Bechuanaland, Rhodesia, Siam etc anymore - yet these country names were all in use when I was at school.

[jim618]

Good point. And they do not even rename 1-to-1. e.g. Sudan -> North Sudan + South Sudan.

[2112]

Do people think this is an easier way to remember 128 bits?

Jim, are you, by chance, a monolingual person? Are you capable of reading any other script than Latin?

Just lay off this problem. It tends to become a paranoidal obsession, similar to the one exhibited in other thread where very intelligent people assume that Internet is operational but all sources of time are compromised.

As far as your software: just make sure that Unicode and various Input Method Editors are operational.

Really just lay it off for a while: it isn't a technical issue and really a behavioral health issue.

[jim618]

Good advice there 2112!

:-)

I am not really monolingual no. Whilst my mother tongue is English I speak reasonable Spanish and have lived in Germany and China.

[casascius]

Country names are not a good choice because they become obsolete. No-one talks anymore about Ceylon, Bechuanaland, Rhodesia, Siam etc anymore - yet these country names were all in use when I was at school.

I guess names of food items aren't a good choice either because food spoils?

[2112]

Good advice there 2112!

:-)

I am not really monolingual no. Whilst my mother tongue is English I speak reasonable Spanish and have lived in Germany and China.

Thank you very much for not getting offended. I wrote my post above with trepidation that somebody will start another deletion campaign against my posts.

If anyone is worried about the entropy of your password/passphrase/passpoem: just make friends with people speaking other languages or at the minimum research the roots of your family. Who knows, you may really be 1/16 Navajo?

[jim618]

@2112 - my brother has taken our family tree back a couple of centuries and we are completely UK+Irish. :-)

On your point on IMEs - from Java's point of view this is mainly in the OS and Java *should* pick up any unicode text that is put into any text field. (Java understands unicode natively)

From your post - are you saying this is NOT the case ? I.e can you not use the IME you normally use for Chinese/ Korean/ whatever ? If so, I need to look into that.

[justusranvier]

The biggest concern I have with using a brain wallet is chance of forgetting the passphrase.

In order to get high entropy you needs a unique phrase that does not appear anywhere in media, literature or popular culture. How easy is that to remember for long periods of time, especially if you don't compromise security by writing it down? Surely no one would use a brain wallet for addresses which they frequently withdraw from, so how would one remember a random set of words accurately across a period of years?

[FreeMoney]

Imagine if you had "Siam" in your password and then one day it was gone!

[2112]

@2112 - my brother has taken our family tree back a couple of centuries and we are completely UK+Irish. :-)

On your point on IMEs - from Java's point of view this is mainly in the OS and Java *should* pick up any unicode text that is put into any text field. (Java understands unicode natively)

From your post - are you saying this is NOT the case ? I.e can you not use the IME you normally use for Chinese/ Korean/ whatever ? If so, I need to look into that.

I haven't tried your software in a long while. But I do have plentitude of general experience with Java (and other languages supposed to use Unicode natively). One of the most common errors are related to incorrectly supporting the "supplementary characters", the ones beyond the "base plane" of 64kilo-characters.

As to your Irish heritage: one of the best scenes in the movie "The Guard" is where Irish people cooperate with the police by speaking Gaelic. Talk about sufficient entropy...

[jim618]

@2112 - yes - will have to look at IMEs a bit more closely.

RE: Irish heritage - our family found out recently that we are all eligible for Irish passports (in addition to UK ones) so are all applying!


@FreeMoney - yes I think the variability of countries over time means this idea is a non-starter.

[d'aniel]

Just lay off this problem. It tends to become a paranoidal obsession, similar to the one exhibited in other thread where very intelligent people assume that Internet is operational but all sources of time are compromised.

Haha, good advice.  I learned it the hard way.

I figured I'd do something similar: build a directed graph with adjectives and nouns as the nodes, and increment the weight of a directed edge from an adjective to a noun whenever the adjective was found preceding the noun in a sentence while scanning through a huge pile of text, e.g. Project Gutenberg.  Then I ranked the adjectives by their weighted degree and pruned all but the top A adjectives from the graph.  Then I ranked the nouns by weighted degree and pruned all but the top N = 2^(128/6) / A nouns.  Then any 6 randomly chosen pairs would give 128 bits of entropy.

Turned out to be a lot of work, and didn't seem to be yielding anything that was much better than ThomasV's solution.

[phatsphere]

It still has the full 128 bits of entropy.

shannon != kolmogorov. e.g. "the first 128 digits of pi" has a high entropy but isn't very complex. you really don't know what the next 10-20 years will bring.

[Gavin Andresen]

See http://dl.acm.org/citation.cfm?id=2335366 for recent research on passphrase usability; results do not look good. http://scholar.google.com/scholar?q=passphrase to see what other researchers have tried.