Paper wallet without printing (Writing it down by hand)

[frank754]

I know it's not too secure, but I just use the "my wallet" extension on Firefox which stores the wallet on Blockchain. The I have the Identifier (in text) backed up to my saved emails as well as the hard drive and a cloud storage site, as well as the wallet file in both places. Still have to remember not to forget the password, but it's quite long and should be un-guessable. 

[nmersulypnem]

One last step....  Destroy the computer.  Do not reconnect it to the internet - ever.

[deepceleron]

As discussed in many places, a brain wallet does *not* need to be long and complicated to have massive entropy. Eight to twelve random dictionary words is all that is needed.

I cannot confirm that this is true.

"Massive" entropy to me would equal the same strength as a randomly-generated private key. We must therefore first derive a random full-strength key and then discover a method of encoding that into "brain wallet words".

In my search for a libre standard-word dictionary, I found GNU Collaborative International Dictionary of English. From it, I extracted 131559 words, just a bit more than 2^17. At least half are not suitable, as they are multiple words or very obscure:

<p><ent>Drymoglossum</ent><br/
<p><ent>Drynaria</ent><br/
<p><ent>Dryness</ent><br/
<p><ent>Dry nurse</ent><br/
<p><ent>dry-nurse</ent><br/
<ent>Drynurse</ent><br/
<p><ent>Dryobalanops</ent><br/
<p><ent>drypis</ent><br/
<p><ent>Dry-rub</ent><br/

If we eliminate all but single words, the dictionary is ~2^16. If we give users the option of changing individual unmemorable words to at least three other words with the same identity, we are down to 2^14; 14 bits.

A Bitcoin private key is 256 bits in size. Therefore encoding 256 bits in 14 bit words = 19 words.

ECC key strength is commonly quoted as equivalent to half-length symmetric key algorithms. So, for example, a 256-bit ECC key would have roughly the same strength as a 128-bit symmetric key. However, the conjectured strength of secp256k1 may be as low as 50 bits in certain attacks. http://perso.univ-rennes1.fr/reynald.lercier/file/FLRV08.pdf. Therefore it is important that the first requirement of EC, full-strength random numbers for both key generation and signing, actually be used.

The reason Electrum words seeds appear shorter is they are half the length of a Bitcoin private key.

 "constant forest adore false green weave stop guy fur freeze giggle clock" = 431a62f1c86555d3c45e5c4d9e10c8c7 = 128 bits

All Electrum addresses are deterministically based on something 340,282,366,920,938,463,463,374,607,431,768,211,456 times smaller than a Bitcoin address. Other Brainwallet schemes are even worse.

In conclusion, I'll just leave this here: https://bitcointalk.org/index.php?topic=361092.0