question about brain wallet keys generated from passphrases

[kellrobinson]

I want to generate several addresses and store bitcoin.
I will create a passphrase by using a string of numbers from random.org to choose words from a dictionary or wordlist.
I want to generate several addresses from only one string of words, so here´s the question:
I can generate each address by appending a different number to the passphrase, so for example
(yes, I know this is the worst possible passphrase, but I am just using it as an example)
correcthorsebatterystaple1
correcthorsebatterystaple2
correcthorsebatterystaple3
would generate three different addresses with associated keys.
However, I am concerned there might be a possibility of somehow cross-comparing the addresses to somehow crack the underlying phrase.
A series of almost identical passphrases like my example generates addresses that LOOK completely different, but that´s not to say those phrases don´t have some commonality that would make them weak if a hacker somehow suspected they were related.
Does the hashing algorithm render such a crack unworkable?  In other words, would keys generated from similar passphrases be just as secure as keys generated from completely unrelated passphrases?
This is a newbie question that someone with a more intimate knowledge of cryptography might not have to ask.
My intuition is that a cracker, even knowing that the keys were generated from highly similar passphrases, would not be able to work backwards from that knowledge to crack them.
However, the stakes are high.  I rather not rely on intuition alone.
As secure as the underlying phrase by itself, or does repetition of closely related passphrases create a weakness?
Answer based on solid cryptographic knowledge, please.

[Pente]

Does the hashing algorithm render such a crack unworkable?  In other words, would keys generated from similar passphrases be just as secure as keys generated from completely unrelated passphrases?

Yes, they are just as secure.

SomeRandomWords(1) = 1P6WHE5KhHAyVRMCL51EqSUC5KN7BriwR7
SomeRandomWords(2) = 1nZ13beWGXKV5f6fPmP5rA1Aa1bxAQNrF
SomeRandomWords(3) = 1JgBvA258ZhZPpr2cLxGWrDVc6uu76Y2nT
SomeRandomWords(4) = 12Biw33Kfj6vQ3sTYWHSUiThMWjwRYwMzz
SomeRandomWords(5) = 1CAgiBZKQynkTwzqJTUMnpxA9jWQaPxuEA

Knowing that all five of those addresses are derived from a similar brainwallet phrase will not help anyone in figuring out the phrase.
Even knowing the associated key with an address won't help in deciphering the other ones.

Of course, if anyone manages to guess one brainwallet phrase, the rest will be obvious to them.

[Dabs]

Don't use random.org. Someone might be sniffing your internet connection. The diceware method using actual dice is better.

[Pente]

Don't use random.org. Someone might be sniffing your internet connection. The diceware method using actual dice is better.

We are talking about brainwallets http://brainwallet.org, not randomly generated public/private key combinations.

Certain precautions apply:

1) Open the URL in safe mode
2) Disconnect from the internet
3) Make sure your random words include a few numbers/upper caps/random special characters
4) Should use at least 21 symbols, words only count as 3 (even if the word is longer than 3 letters).
5) Never use a phrase that can be found on the internet
6) Close browser before re-connecting computer to internet
 
I would feel safe with something like:

GotchaKeepingMilkPP*5!=100+20*

The 3 words count as 9 characters, then add 13 more for a total of 22.
My brainwallet is actually longer and more convulated.
I would also suggest a paper cheat sheet for yourself just in case you forget it, something like: GKM PP ** 5!=+

Now to modify for a set of brainwallets do this:
GotchaKeepingMilkPP*5!=100+20*(1)
GotchaKeepingMilkPP*5!=100+20*(2)
GotchaKeepingMilkPP*5!=100+20*(3)
GotchaKeepingMilkPP*5!=100+20*(4)

or use call signs  http://en.wikipedia.org/wiki/NATO_phonetic_alphabet for extra salt:

GotchaKeepingMilkPP*5!=100+20*(Alpha)
GotchaKeepingMilkPP*5!=100+20*(Bravo)
GotchaKeepingMilkPP*5!=100+20*(Charlie)
GotchaKeepingMilkPP*5!=100+20*(Delta)
GotchaKeepingMilkPP*5!=100+20*(Echo)

[Dabs]

Advice still valid. I know he is talking about brainwallets. But he is talking about brainwallets generated from words in a list or dictionary, and using random.org to pick the words.

Don't do that. Use dice. Or just use nobrainr, which makes phrases composed of 7 words. Offline of course.

[Mondy]

Just dont use a brain wallet. Create an address in blockchain, write your private key down, done.

[franky1]

bitaddress.org is over 1400 lines of code because it has functions to do other stuff all mixed into the same script.

is there anywhere that just has the smallest amount of code nessessary to turn gibberish into something that is a private key. and then converts that into the public key

EG adding a 5 at the start of some gibberish. then adding the checksum. to make a working private key. and then works out the public key

that way people can play about with their own passphrase encoding and different ways to convert something memorable into something that passes the checksum of a private key.

preferably something wrote in VB.net or another lannguage that is not found on bitaddress.org

[RoxxR]

bitaddress.org is over 1400 lines of code because it has functions to do other stuff all mixed into the same script.

is there anywhere that just has the smallest amount of code nessessary to turn gibberish into something that is a private key. and then converts that into the public key

EG adding a 5 at the start of some gibberish. then adding the checksum. to make a working private key. and then works out the public key

that way people can play about with their own passphrase encoding and different ways to convert something memorable into something that passes the checksum of a private key.

preferably something wrote in VB.net or another lannguage that is not found on bitaddress.org

Look up "urandom2wif", it's a tiny, bare-bones script that does just that (if I understand your post properly).

[kellrobinson]

if anyone manages to guess one brainwallet phrase, the rest will be obvious to them.

Yes, there's the real problem.  If a hacker could somehow associate the set of addresses as belonging to one owner, then breaking all of them is only trivially harder than breaking one of them.
How would a hacker make such an association among a set of blockchain addresses?  He would have to trace where they came from somehow.  Or more likely he would have to be sniffing the packets sent from my computer at the time I send the funds out, and notice that a bunch of addresses were funded at the same time.  So I should not fund all the addresses at the same time or from the same IP.  How do you disguise a computer so it looks like several different IP addresses?  And "computer" includes mobile devices, because I use an android tablet more often than a conventional computer (dual boot ubuntu/xp, in my case).

[Dabs]

Fund your addresses from different sources. Exchanges. Gambling sites. Other shared wallets.