Would a brain wallet based on a password hashing algorithm be secure?

[odolvlobo]

The typical brain wallet is constructed by hashing a memorable phrase using SHA-256, and using the result as the private key. It is well-established that the typical brain wallet is not secure. This thread demonstrates that very clearly:

Collection of 18.509 found and used Brainwallets

Here is a good example from that thread showing that even a seemingly good brain wallet phrase can be cracked:

... "To the moon!!! ┗(°0°)┛ ..○" -> https://www.blockchain.com/btc/address/18vqVNQi9fobKZcJWCjZNoDzBxronENfZr

The basic attack against brain wallets involves generating a huge list of potential phrases, and then checking the blockchain for the addresses derived from the hashes of those phrases. The defenses against this attack are to increase the range of potential phrases and to make it slower and more expensive to check them.

The cracked brain wallet above demonstrates to me that the benefit of increasing the potential range is limited. That is basically because a human's ability to create meaningful and memorable phrases is limited. For this reason, we have to accept that although a carefully chosen phrase is important, it is not sufficient, and it is also necessary to make it slower and more expensive to check the hashes of potential phrases.

The issue with SHA-256 is that it is very fast, and it is easy for the attacker to generate the private keys for a large number of potential brain wallets. A typical PC can generate up to a billion SHA-256 hashes every second. SHA-256 is not appropriate for hashing brain wallet phrases (or any kind of passwords).

Now, there are certain hashing algorithms specifically designed to resist attacks on hashed passwords: bcrypt, scrypt, and argon2id, for example. They have these advantages:

• They are much slower than SHA-256. For example, Litecoin's configuration of scrypt is about 1000 times slower than SHA-256.
• They require much more memory, which limits the parallelization.
• They also generally include a "salt" parameter that limits the ability to use pre-generated hash tables.

My question for the experts: would switching to an appropriate hash algorithm such as the ones listed above be enough to make a brain wallet secure?

[jackg]

If you use a slow hashing algorithm and an appropriately sized salt then you should be good. A lot of sites will still use sha256 and 512 for password hashing. The salt would have to be pretty huge based on the size of asics though...

It might be better to just memorise a seed instead? I know quite a few of mine from memory from having to restore wallets. Just read it every couple of hours (potentially while doing something else) and your wallet will be more secure.

[odolvlobo]

If you use a slow hashing algorithm and an appropriately sized salt then you should be good. A lot of sites will still use sha256 and 512 for password hashing. The salt would have to be pretty huge based on the size of asics though...

I was thinking that something like a PIN could be used as the salt. I would have no problem remembering a brain wallet phrase and an 8 digit PIN.

It might be better to just memorise a seed instead? I know quite a few of mine from memory from having to restore wallets. Just read it every couple of hours (potentially while doing something else) and your wallet will be more secure.

I don't think that memorizing a random 12+ word seed is feasible for most people.

[hatshepsut93]

I was thinking that something like a PIN could be used as the salt. I would have no problem remembering a brain wallet phrase and an 8 digit PIN.

Memorizing numbers, especially long numbers, is harder than memorizing a few words. You can get a word or a phrase from your memory even after some time, but with numbers you have to repeat them regularly to not forget them.

And even if you can come up with a phrase that is strong today, it may become weak in the close future, so you'll have a liability of checking if your password is still strong from time to time.

I don't think that memorizing a random 12+ word seed is feasible for most people.

I second jackg, memorizing seeds is not as hard as it might look, they are called mnemonic for a reason.
It's just a bad idea to use your memory as the only way of storing your seed, but it's viable as a third or fourth method. This can have some interesting uses, for example, when you pass a border, the border control will have absolutely zero way of finding your coins, unlike with USB sticks or hiding it inside a book.

[jackg]

Yeah learning a nmonic phrase seems like it'll be a hard thing to learn but it actually isn't that difficult. I remmebe thinking it was hard but I kept restoring my wallet and started to learn it from memory.


Best things to do:
every so often, maybe once a day for 2 weeks, boot up electrum (potentially on something like true key os that's fully disconnected from the Internet) and type up your key there (maybe do it twice or three times a day).
If youre trying to learn it, focus on words that are similar and words that are different for example I have a seed with an oxymoron which produces a bit of a weird concept.

Try to visualise stuff (but don't force it). If it says there's a wasp, a puddle and a log next to each other, the wasp can be resting on the log which is floating on the water. If you try learning it the first way alone, sometimes the order can be messed up when you recite it which is easy to fix but avoidable.

You'd be writing down data from your brain wallet anyway so I don't think there'd be much of a problem there.

[pooya87]

Now, there are certain hashing algorithms specifically designed to resist attacks on hashed passwords: bcrypt, scrypt, and argon2id, for example. They have these advantages:

• They are much slower than SHA-256. For example, Litecoin's configuration of scrypt is about 1000 times slower than SHA-256.
• They require much more memory, which limits the parallelization.
• They also generally include a "salt" parameter that limits the ability to use pre-generated hash tables.

these are not hash algorithms, these are key derivation functions. and your points are somewhat false.
- slower in this context means slower in a micro scale otherwise they are quite fast. you can only say a hash algorithm is slower if it takes 1 minute to compute the hash not the same micro second!
- this depends on the settings. if for example you use scrypt with a low cost factor and block size factor then it isn't really a memory expensive one.
- when the "salt" is known (which is the case with a pre-defined brainwallet algorithm) it could still be pre-generated.

My question for the experts: would switching to an appropriate hash algorithm such as the ones listed above be enough to make a brain wallet secure?

the main problem with brain wallets is that the attacker has a much smaller space to search compared to a random 256 bit entropy. you can increase the complexity of the phrase being memorized, the complexity and cost of the algorithm, add salt,... but still the main problem remains the same.

and also since it depends on user's choice of phrase and people rarely choose something truly strong, the search space is usually small.

i wouldn't recommend using a brain wallet but the only thing that i can think of which can help create a "better" (still not safest) key is using your own defined algorithm which combines multiple methods.
an easy example would be choosing a password (lets assume it is '123') then using different hashes but not letting anybody know which hashes you used.

Code:

a0b8dec49dfb6a658bb2fcb417d58b8a8550ba73c7f0936d4d628191b3562b5d

even though my password was simple the result is still "more" random. try to guess which hash algorithms i used first before reading the last line. now the attacker not only has to guess my password (brain wallet phrase) but also has to guess which hash algorithms, how many of them and in what order i used to get the final key from. but the problem still exists here too, the assumption should be that the attacker could gain more knowledge about my method which i tried keeping secret. for example he may know i used 5 hashes and figure out i am a fan of keccak,... and if the reward is big enough it justifies the extensive work it needs to break it.


Keccak256(SHA3-256(SHA3-256(RIPEMD160(SHA256("123")))))

[figmentofmyass]

I don't think that memorizing a random 12+ word seed is feasible for most people.

I second jackg, memorizing seeds is not as hard as it might look, they are called mnemonic for a reason.

mnemonic = a pattern-based device that assists in memorization. randomly generated seeds are definitely not mnemonic.

i don't know why "mnemonic phrase" ever caught on as a term. it's misleading.

i agree with odolvlobo---it's not feasible for most people. for those who can do it, let's see what you remember in 5 years.

[keychainX]

Now, there are certain hashing algorithms specifically designed to resist attacks on hashed passwords: bcrypt, scrypt, and argon2id, for example. They have these advantages:

• They are much slower than SHA-256. For example, Litecoin's configuration of scrypt is about 1000 times slower than SHA-256.
• They require much more memory, which limits the parallelization.
• They also generally include a "salt" parameter that limits the ability to use pre-generated hash tables.

My question for the experts: would switching to an appropriate hash algorithm such as the ones listed above be enough to make a brain wallet secure?

Simply NO, as long as your password is something possible to guess, a strong enough CPU crack farm can do it.

Ive broken passwords with scrypt where you need a CPU with 32GB of ram and it was really really slow. Even though the password was 12 characters it was based on known phrases from dictionaries and therefor insecure.

It does not matter if you use capital letter add number and special character, as long it follows a formula its possible to brake.

My 5 cents
/KX

[Saint-loup]

I don't think that memorizing a random 12+ word seed is feasible for most people.

I second jackg, memorizing seeds is not as hard as it might look, they are called mnemonic for a reason.

mnemonic = a pattern-based device that assists in memorization. randomly generated seeds are definitely not mnemonic.

i don't know why "mnemonic phrase" ever caught on as a term. it's misleading.

i agree with odolvlobo---it's not feasible for most people. for those who can do it, let's see what you remember in 5 years.

Precisely, bitcoin.it says "This is a bad name because the word mnemonic implies that the phrase should be memorized"... it doesn't say it couldn't be.

In fact, in another article it's explained how you can memorize a seed (with the Mnemonic Peg Method)

Memorize the phrase using http://en.wikipedia.org/wiki/Mnemonic_peg_system
[...]
To memorize a seed with this method you must invent a story which hits the words as "keynotes". Try to make it like a fairy tale story, use imagery. Make it somehow striking and emotionally resonant. When remembering you just remember the key words, not all the other words - the other can be remembered more as images and thoughts (which are hard to write down)
[...]
Repeat this story in your head several times over a short period - the first few days. It will sink in, deep, after that. You'll only have to revisit it very occasionally. After a while you can ignore it for months and it'll still come back

https://en.bitcoin.it/wiki/Brainwallet

[MrFreeDragon]

-snip-
Here is a good example from that thread showing that even a seemingly good brain wallet phrase can be cracked:

... "To the moon!!! ┗(°0°)┛ ..○" -> https://www.blockchain.com/btc/address/18vqVNQi9fobKZcJWCjZNoDzBxronENfZr

-snip-

This was not something secret. Transaction on this address were made in August 2015, but "tothemoonguy" existed before this:
twitter: https://twitter.com/ToTheMoonGuy
reddit: https://www.reddit.com/user/ToTheMoonGuy

-snip-
The basic attack against brain wallets involves generating a huge list of potential phrases, and then checking the blockchain for the addresses derived from the hashes of those phrases. The defenses against this attack are to increase the range of potential phrases and to make it slower and more expensive to check them.
-snip-

So this also was just a basic attack. The list of potential phrases could be taken from twitter accounts and twitter accounts description. "To the moon!!! ┗(°0°)┛" was exactly the twitter account description.

[tromp]

My question for the experts: would switching to an appropriate hash algorithm such as the ones listed above be enough to make a brain wallet secure?

Maybe if you go to extremes: use a key derivation function (not a hash) that requires dozens of GB of memory and hours of runtime.

[Dabs]

Have you guys seen the Warp Wallet?
https://keybase.io/warp/warp_1.0.9_SHA256_a2067491ab582bde779f4505055807c2479354633a2216b22cf1e92d1a6e4a87.html

I still would prefer to memorize an alphanumeric password longer than 12 characters for a brainwallet. Maybe up to 24 which is just 3 8 characters one put together.

Depending on what kind of security you are looking for, a paper wallet or paper backup of a seed (12-24 words) is good, fits in a small paper, can be backed up easily and hidden relatively securely. It's a matter of "smuggling" a small piece of paper with the seed or private key or a relatively long password for a brainwallet.

What is your purpose? Are you going to travel internationally? Are you going to any place where you could possibly be stripped naked and have no clothes at all? You can hide the info in or around your clothes where they are undetectable, or taped to a dog tag around your neck or stuck on the bottom of your camera or laptop (but not actually inserted, if it's a microSD card) or in a USB flash drive.

If you use something like Warp Wallet (make a backup, save the file in another location, email it to yourself), and have a 24+ or longer character password, you should be good to go.

To me, a proper brainwallet is randomly generated and then memorized, not some phrase from any book, and not anything you made up. Use dice. Use coin flips. Use a password generator.


People have been memorizing pi to a thousand digits. Go memorize your private key instead, it's much shorter. (or, a 24 to 32 character alphanumeric password / 12 to 24 word seed.)

[MrFreeDragon]

Have you guys seen the Warp Wallet?
https://keybase.io/warp/warp_1.0.9_SHA256_a2067491ab582bde779f4505055807c2479354633a2216b22cf1e92d1a6e4a87.html
-snip-

This one is interesting. Thank you for sharing.
Do you understand the whole process how this tool makes the private key from a simple phrase?

[pooya87]

Have you guys seen the Warp Wallet?
https://keybase.io/warp/warp_1.0.9_SHA256_a2067491ab582bde779f4505055807c2479354633a2216b22cf1e92d1a6e4a87.html
-snip-

This one is interesting. Thank you for sharing.
Do you understand the whole process how this tool makes the private key from a simple phrase?

it is explained on the website inside the link that was shared, is there any particular step of the process that have problem with?

it is worth adding that when you speak of brain wallet you should never only think about how strong a password YOU can create. maybe you can come up with a real strong password and never have any problem but majority of the others who use the same tool will not. and that is another big problem!

[DannyHamilton]

My question for the experts: would switching to an appropriate hash algorithm such as the ones listed above be enough to make a brain wallet secure?

Security is not a light switch.

There is no such thing as completely secure.

There is no such thing as completely insecure.

There is only more secure and less secure, meaning that security only has meaning when used in a comparison.

If you are comparing your new brainwallet idea to the older brainwallet idea that you presented, then yes, I'd say that your new idea is "generally more secure" than that other option (assuming a well enough chosen mnemonic and/or salt).

If you are comparing your new brainwallet idea to the concept of a well protected completely randomly chosen private key, then I'd say that your new brainwallet idea is "generally less secure" than that other option.

However, security also must take into consideration what it is that you are protecting against.  A well protected written key is MUCH more secure against memory loss, but a brainwallet is MUCH more secure against physical discovery and confiscation of the private key.  When discussing security solutions it is important to think about everything that could go wrong, what the probabilities are of each of those things, and how well the solution protects against each of those probabilities.

[hatshepsut93]

mnemonic = a pattern-based device that assists in memorization. randomly generated seeds are definitely not mnemonic.

i don't know why "mnemonic phrase" ever caught on as a term. it's misleading.

i agree with odolvlobo---it's not feasible for most people. for those who can do it, let's see what you remember in 5 years.

Seed wordlists have some special properties, like how there's no words that sound or are spelled similarly, and most words have 1-3 syllables. They are much easier to memorize than 12 random words from a dictionary.

But, it's all highly subjective - some people can memorize long numbers or passwords with difficult patterns, others find no problems with memorizing long sequences of words. I'm not saying that memorizing seeds is a viable option for everyone, but it's worth trying, because they have strong entropy, while creating a strong password requires some extra knowledge.

And regardless of method, the key requirement with storing something in memory is repeating it regularly and often.

I think what everyone here can agree is that it is possible to have a secure brainwallet if you know what you are doing, but it is hard and has many caveats, so it shouldn't be advised to broad audience. 

[Dabs]

You can memorize anything reasonably shorter than 30 characters or 20 words with rote repetition. It's a force of habit kind of thing. You write down the words, then you recite them over and over. Then you do it again tomorrow, and the next day. Keep doing this every day for a month, you'll probably have the words and their sequence memorized completely.

I am able to memorize 8 character alphanumeric passwords rather quickly. All I do to make a longer one is string them together. Used to be able to memorize 8 of them, so that would make it a 64 character completely randomly generated alphanumeric password. Case sensitive too. Symbols might take extra time to incorporate.

I'd stick to just alphanumerics. Native Segwit Bech32 addresses are not case sensitive, for example. If you use something that looks like that and were able to memorize it, that's a very good password.

[LoyceV]

If it says there's a wasp, a puddle and a log next to each other, the wasp can be resting on the log which is floating on the water.

If you put it like this, I can visualize it as pictures on a wall in your house. I know it's not exactly from memory, but will be impossible for an online attacker to find.
Just be careful when you search for images, Google remembers everything. Ideally, you should have a very large image collection already for all seed words before creating the seed phrase.

[o_e_l_e_o]

-snip-

The issue with brain wallets isn't how easy or otherwise it is to memorize the words/phrase/characters in the first place. Almost everyone has committed to memory multiple addresses, phone numbers, usernames and passwords, PINs, etc. without any real difficulty and without a significant amount of effort.

The issue is with how easy it is to forget these things. I've spoken about this before in various thread on here, but there a million and one things that can happen to anybody without warning which can result in significant and not fully reversible memory problems. I'm not just talking about direct trauma, although traffic collisions and falls resulting in traumatic brain injuries are very common. You could have a brain aneurysm which could burst at any time. About 1 in 30 people will suffer from epilepsy or an associated seizure disorder at some point in their life, it can manifest at any age, and seizures can cause memory issues. About 1 in 6 will have a stroke, again with no warning and with potential for memory loss. Even something as seemingly benign as the flu or food poisoning can lead to sepsis and memory issues.

Much like a web wallet being hacked, a brainwallet will work fine until the day it doesn't, and when it fails you have no means of retrieving your funds. If you are going to use a brainwallet, I would suggest having a paper backup somewhere.

[jackg]

If it says there's a wasp, a puddle and a log next to each other, the wasp can be resting on the log which is floating on the water.

If you put it like this, I can visualize it as pictures on a wall in your house. I know it's not exactly from memory, but will be impossible for an online attacker to find.
Just be careful when you search for images, Google remembers everything. Ideally, you should have a very large image collection already for all seed words before creating the seed phrase.

You could always just use clip art on an offline pc. Verbs and intensifiers are much harder to remember though...

But for nouns it's normally easy to find image representations.