Dicing out the 24 word passphrase?

[ttookk]

Hello there,

As we all know, black swan events are the looming shadow over everything crypto and it wouldn't be the first time that a faulty random number generator led to the loss of funds. Using a hardware wallet is a good decision, but we have no real insight in the generation process of the passphrase needed and as far as I remember, at least Ledger has no manual inputs, like wigglin the mouse or what-have-you to increase entropy. Should they have a vulnerability in their RNG, a lot of peeps are sitting there with their pants down.

To mitigate this, I was thinking of taking the BIP32(that's the right BIP, right?) word list, a die, a pen and a piece of paper.

As a die, I would use one of those roleplaying game dice in a sensible denomination, like eight sides or something. I haven't come that far yet, because in practice, I have a big problem: The last one or two words are a checksum(dunno how many, honestly). So, I would either have to bruteforce the whole thing (four digit possibilities, "typing" on a Ledger Nano S – No, Sir.) or somehow find a way to find out the checksum with some calculations (on the cheapest solar-powered calculator possible). Typing anything of this inot a computer is a big no-no for obvious reasons.

My question is, is there something like this already out there? And if not, has anyone enough insight into the generation of the seed phrase to know how complicated/impossible for a mortal human being it would be to generate the needed checksum, i.e. is this a possible endeavor or completely bonkers BS?

I am aware of the Glacier protocol, but they are using dice only to create entropy. There is also the option to create a brainwallet-type like that, but that would include generating the pubkeys/addresses on a computer. i want something to put into a HW wallet.

[1714863208]

1714863208

[1714863208]

1714863208

[odolvlobo]

It is actually BIP-39.

Generating the SHA-256 checksum can be done by hand but that would be a bad idea. It takes a long time and it is prone to error.

Instead, check out this page: https://iancoleman.io/bip39/

Try selecting "Show entropy details".

[HCP]

It isn't the word itself that is the checksum... It's a number of "bits" (4-8 bits dependent on whether you are using 128/160/192/224/256 bit seed).

As the "words" are representing an 11bit number, the checksum is actually just a "part" of the last word.

So, the checksum is the first n-bits of the SHA256 hash of the seed... Where n is "size of seed (in bits) / 32"... For instance, 128bit seed => 128 / 32 = 4 bit checksum.

It's all explained in BIP39: https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#generating-the-mnemonic


However, what you seem to be proposing is to use dice to choose the words... And calculate the seed from that. It's not really possible as you won't be able to calculate the checksum.

You'd be better off just following BIP... Generate the required Entropy with the dice (128/160/192/224/256 bits)... Then calculate the SHA256 hash... Take the appropriate number of bits as checksum, append to your Entropy... Then slice into 11bit chunks and lookup the words from the wordlist.

You can get an idea of the difficulty of manually calculating SHA256 hashes here: http://www.righto.com/2014/09/mining-bitcoin-with-pencil-and-paper.html

[vit05]

There is a step by step on this website http://world.std.com/~reinhold/diceware.html

But I think it will need using Ian Coleman website too.

[Quickseller]

Generating the SHA-256 checksum can be done by hand but that would be a bad idea. It takes a long time and it is prone to error.

This is okay. If you make a mistake, your seed will be invaded and won’t result in lost funds.

In general however, I believe what the OP is proposing is excessive for real world use. It would be more ideal to come up with a way to generate a seed on a computer that you are confident is not using flawed RNG. Perhaps to buy individual computer parts at various stores over time, keeping the parts in a safe until you are ready to use them.

Alternatively, you should develop a way to test the RNG to ensure it is in fact random after several million (or maybe billion) generations.

[Abdussamad]

Ultimately you are going to have to use a computer to create a wallet for you so why not simply create an Electrum wallet and use dice generated entropy as custom words? Electrum lets you do that. In the step where you are displayed the seed you click on options and check 'extend this seed with custom words'. In the next step you get the option to add your custom words/characters. The Electrum seed is not BIP39 however.

The bip39 standard also supports passphrases which work like the seed extension feature of electrum so if you prefer some other wallet software check whether it has this feature.

In both bip39 and electrum the custom words/passphrase are used as salt in the key derivation function used to convert the mnemonic to the wallet seed. Different passphrase results in a different wallet.

[ttookk]

(…)

However, what you seem to be proposing is to use dice to choose the words... And calculate the seed from that. It's not really possible as you won't be able to calculate the checksum.

You'd be better off just following BIP... Generate the required Entropy with the dice (128/160/192/224/256 bits)... Then calculate the SHA256 hash... Take the appropriate number of bits as checksum, append to your Entropy... Then slice into 11bit chunks and lookup the words from the wordlist.

You can get an idea of the difficulty of manually calculating SHA256 hashes here: http://www.righto.com/2014/09/mining-bitcoin-with-pencil-and-paper.html

Hm, I was hoping that the checksum part itself would be a relatively easy calculation. Seems like I was wrong.

The general idea was to avoid using a computer, but using a hardware wallet to generate the corresponding addresses. So, all I would need is a Ledger/Trezor compatible 24 word seed.

[HCP]

Well, it depends on your idea of "easy"... To be honest, manually doing the SHA256 isn't impossible... You just have to take your time and follow all the steps. I did one round as shown by the link I posted earlier. It takes a while, but the maths isn't impossible.

I've actually manually "calculated" a seed mnemonic before too... Again, not impossible, but time consuming. What I haven't been bothered to try, was dicing up 256bits of entropy! I just cheated and used the Ian Coleman website to generate that, and then manually worked through the conversion to seed mnemonic and compared my result to what the website showed to double check my working.

You'll want a nice rainy Sunday afternoon spare if you intend on doing this without a computer!

[apexcrypto]

Here are a few links regarding rolling dice to derive wordlists. Keep in mind that even if you use the 2048 word BIP39 list, it may not work as a wallet passphrase because the checksum feature that is built into the BIP39 wordlist derivation function is not being used for "rolling your own". There is a utility on github called "force39" that will tweak a hand-rolled wordlist to be compliant with what BIP39 wallets will expect.

https://github.com/ulif/diceware
https://theintercept.com/2015/03/26/passphrases-can-memorize-attackers-cant-guess/
https://www.eff.org/dice