Encrypting the hardware wallet seeds

[Don Pedro Dinero]

I have a hardware wallet and I have the seeds written on a sheet of paper. Two copies saved in two different locations. Some time ago, I came up with an idea to transform the seeds and I have been happy with the result.

The result is a sheet of paper, but instead of being a list with all 24 seeds, it looks more like a letter or a writing. The words of the seeds are changed. The way it is, I think it's almost impossible for anyone to get the seeds out of that paper. It didn't come out the first time, I had to modify it a couple of times but once I created the final version I think it was a very good idea.

Once I had it, I saved it for a week and what I did was to take the paper with the encrypted seeds and try to get the real seeds out. I only failed in two words but because I put in synonymous words. I left it as it is, I tried it today, it will have been a month, and I only failed in one, again because I put a synonym word. I’m going to destroy the real seeds I have where I am and keep the encrypted ones. I’ll still have one copy of the real ones somewhere else that I consider somehow safer.

I don't know if you have heard or tried any of this and what your opinion is about it.

[1714192212]

1714192212

[1714192212]

1714192212

[1714192212]

1714192212

[1714192212]

1714192212

[Charles-Tim]

There are different ways of encrypting seed phrase, the explanation of yours is not explained, but there has been one called shamir's secret sharing, it is one of the most recommended ways of encrypting seed phrase or private key in which there will be numbers of shares of secrets that will be used to recover back the original words. This can be the most recommended instead of your idea, your idea may be good to you but while encrypting such sensitive information, people must be careful because there are people that have lost their seed phrase because of encrypting it.

[bitmover]

Do you use a passphrase?
That is the correct way to "encrypt" your seed, afaik.

It is a 25th word that can be anything. No fixed words from a list. It  is necessary to recover your funds, the seed is not enough (if you set a passphrase)

Here is how to do it in ledger nano
https://www.ledger.com/academy/passphrase-an-advanced-security-feature

[NotATether]

The result is a sheet of paper, but instead of being a list with all 24 seeds, it looks more like a letter or a writing. The words of the seeds are changed. The way it is, I think it's almost impossible for anyone to get the seeds out of that paper. It didn't come out the first time, I had to modify it a couple of times but once I created the final version I think it was a very good idea.

What you can also do is pull 2048 randomly picked words from a dictionary, and create a mapping between each BIP39 word and a dictionary word. Then your seed phrase will have words that are only picked from the dictionary and this will confuse most people who find your seed phrase, since restoring it without mapping the words back will fail.

Most programming languages let you run something like this by itself:

Code:

array['key'] = 'value'

This is how you'd map the word 'key' to 'value'. After you do this 2048 times for each BIP39 word, you would then put each of your 12 words through the array to get the new words. And to get the old words back, you'd use a new array that looks like this:

Code:

array2['value'] = 'key'

and put your scrambled words through the second array.


It's not the best way to encrypt a seed (see @bitmover's post for the recommended way using a passphrase) but it's human-readable and reasonably obscures it.

[Evilish]

My main worry would be about not remembering whatever obfuscation or encryption method I used say a few years down the line if all I am going by is memory.

I came across this post recently which I found very interesting. OP takes a very neat approach to "encrypt" the seed using date of birth:
https://bitcointalk.org/index.php?topic=3416202.0

If you reference the above linked thread, use it only for educational purposes. I cannot vouch for the source code as I haven't gone through it yet.

I personally use a passphrase in addition to the seed. If someone were to get access to my seed all they would find is an empty wallet. And the only thing I have to worry about is remembering my passphrase.

[ranochigo]

You can encrypt BIP39 with a passphrase. It's defined in the standards as written in the BIP[1].

Obfuscating the seeds to hide it isn't always the best method.

[1] https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#From_mnemonic_to_seed

[pooya87]

Do you use a passphrase?
That is the correct way to "encrypt" your seed, afaik.

You can encrypt BIP39 with a passphrase.

Even though the term "passphrase" is used here, it is not actually encrypting the mnemonic. It is more like extending it. The algorithm that is used is definitely not secure enough to be considered for encryption since a very weak key derivation function with an extremely low iteration count is used to derive the BIP32 seed meaning brute forcing it is going to be extra fast. In comparison an actual encryption method such as AES would need a much longer time.

[Don Pedro Dinero]

There are different ways of encrypting seed phrase, the explanation of yours is not explained, but there has been one called shamir's secret sharing, it is one of the most recommended ways of encrypting seed phrase or private key in which there will be numbers of shares of secrets that will be used to recover back the original words. This can be the most recommended instead of your idea, your idea may be good to you but while encrypting such sensitive information, people must be careful because there are people that have lost their seed phrase because of encrypting it.

Thanks, I didn't know about that but I've googled it and I've seen it's mostly for organisations, isn't it? I would need to share info with someone.

Do you use a passphrase?
That is the correct way to "encrypt" your seed, afaik.

No I don't use it. I don't think there is only one correct way of encrypting my seeds either. I knew about the passphrase but if someone found my seeds they would know that I have bitcoin. If I leave empty wallets as @Evilish says:

I personally use a passphrase in addition to the seed. If someone were to get access to my seed all they would find is an empty wallet.

they could think that I've hidden the funds under a passphrase.

Apart from that, in general there is a limit of 10,000 euros that I can take in cash across the border if I want to go to other countries. I don't know if this includes bitcoin or not. But let us suppose it does, or that it is implemented in the future. If I want to cross borders with 1 bitcoin, I would have to 1) declare it 2) not declare it and take the hardware wallet, which could be detected at customs 3) not declare it and take the seeds written on a paper, which, even if I hid them well, could also be detected at customs.

With the paper I've written, I could take it with me because it doesn't look like the seeds. Or I could even take a picture of it or send it to me by email because I'm not afraid of having my phone/email hacked. The hacker wouldn't realize that it's the seeds and, even if he realized it, he would still have to decrypt it.

What you can also do is pull 2048 randomly picked words from a dictionary, and create a mapping between each BIP39 word and a dictionary word. Then your seed phrase will have words that are only picked from the dictionary and this will confuse most people who find your seed phrase, since restoring it without mapping the words back will fail.

Well, that's kind of what I've done but would the result look like a list of words? I'm a bit confused because you talk about seed phrase and when I talk about seeds (mnemonic if you like) I talk about a list of separate words.

My main worry would be about not remembering whatever obfuscation or encryption method I used say a few years down the line if all I am going by is memory.

This is a reasonable concern. When I thought about adding a passphrase, I thought about writing a clue somewhere just in case but in this case, the way I've done it the only risk I see is that instead of the correct word I would write a synonim so I'd have to try more times.

I want to make it clear that I am not saying that I have invented a new system that I want to sell or anything like that.

I just came up with this and wanted to know if anyone had done something similar. Maybe the link that @Evilish has shared and what @NotATether says are somehow similar.

This occurred to me as the best personal way to protect my holdings. Most likely no one will ever break in looking for bitcoin, nor will I ever have to cross borders with large amounts of bitcoin hidden.

[o_e_l_e_o]

I'm generally not a fan of people coming up with their own obfuscation/encryption methods for a couple of reasons. Firstly, it is unlikely to be as secure as you think it is, and it definitely won't be as secure as a proper encryption algorithm. Secondly, we have seen countless users who have forgotten their system and cannot access their coins. If you are going to think up a unique method and then only have it in your memory and nowhere else, then really you've just added an extra step to memorizing your seed phrase, which everyone knows is a bad idea.

I like using passphrases because in addition to the extra protection it provides your funds, it also provides plausible deniability. You can hand over your seed phrase and the small amount of coins it holds, knowing that your main stash is still protected behind a passphrase (or even several passphrases).

If you want to disguise the fact that a seed phrase is even a seed phrase, then my preference would be to formally encrypt it. You can even encrypt it in a hidden volume, so you could decrypt the data container to show some decoy "sensitive" information if forced to at a border, for example.

[HCP]

I'm with o_e_l_e_o on this one... Creating your own methods of obfuscation generally leads to a post in about 1 or 2 years (or later) saying "I 'encrypted' my 24 words but I can't remember how... help?"

However, this statement by the OP gives me hope that the OP has at least thought about this and has a "failsafe", by making sure they have an offsite backup of the original, unencrypted seed:

I’ll still have one copy of the real ones somewhere else that I consider somehow safer.

[Don Pedro Dinero]

... we have seen countless users who have forgotten their system and cannot access their coins....

I'm with o_e_l_e_o on this one... Creating your own methods of obfuscation generally leads to a post in about 1 or 2 years (or later) saying "I 'encrypted' my 24 words but I can't remember how... help?"

LMAO

...If you want to disguise the fact that a seed phrase is even a seed phrase, then my preference would be to formally encrypt it. You can even encrypt it in a hidden volume, so you could decrypt the data container to show some decoy "sensitive" information if forced to at a border, for example.

However, this statement by the OP gives me hope that the OP has at least thought about this and has a "failsafe", by making sure they have an offsite backup of the original, unencrypted seed:

I’ll still have one copy of the real ones somewhere else that I consider somehow safer.

Yes, I still have the real seeds. I don't want to rely only on memory, even to create a passphrase. If I did that I think I would write it down and store it somewhere, far away from the seeds.

I guess I have "encrypted" the seeds in a wordly way but it can be done more professionally by formally encrypting them.

Very interesting comments on this post. I'll leave it open but I doubt anything meaningful can be added.

[bitmover]

Do you use a passphrase?
That is the correct way to "encrypt" your seed, afaik.

You can encrypt BIP39 with a passphrase.

Even though the term "passphrase" is used here, it is not actually encrypting the mnemonic. It is more like extending it. The algorithm that is used is definitely not secure enough to be considered for encryption since a very weak key derivation function with an extremely low iteration count is used to derive the BIP32 seed meaning brute forcing it is going to be extra fast. In comparison an actual encryption method such as AES would need a much longer time.

But how much security is really needed?

A seed without a passphrase is useless. You can just save the seed elsewhere



The guy might know this paper has a seed that holds millions of dollars in btc, but he cant access it.

He can keep his passphrase elsewhere and that's done. No topics created with crazy encryption details asking for help...

I think extra security may cause more damage than protection.

[pooya87]

But how much security is really needed?

Well we are looking for meaningful security not just imagined. The BIP39 passphrase is adding some extra security but I don't think we can consider it high enough. For instance if the seed words are known and the master public key is known, brute forcing the passphrase is simply a matter of computing 2048 HMACSHA512 which is ridiculously fast because it is only computing hashes.

[o_e_l_e_o]

brute forcing the passphrase is simply a matter of computing 2048 HMACSHA512 which is ridiculously fast because it is only computing hashes.

Sure, but this can be mitigated by using a long and random passphrase. If I use 30 random characters from the full ASCII set, then my passphrase has 197 bits of entropy. Even if someone built an array which could compute a trillion trillion trillion possibilities a second (which is many orders of magnitude away from our current technology), you are still looking at something like 250,000 times the age of the universe to have even a 50% chance of brute forcing my passphrase.

With current technology, even a passphrase of around 12 random characters is almost certainly going to be enough to make brute forcing impossible.

[pooya87]

brute forcing the passphrase is simply a matter of computing 2048 HMACSHA512 which is ridiculously fast because it is only computing hashes.

Sure, but this can be mitigated by using a long and random passphrase. If I use 30 random characters from the full ASCII set, then my passphrase has 197 bits of entropy. Even if someone built an array which could compute a trillion trillion trillion possibilities a second (which is many orders of magnitude away from our current technology), you are still looking at something like 250,000 times the age of the universe to have even a 50% chance of brute forcing my passphrase.

With current technology, even a passphrase of around 12 random characters is almost certainly going to be enough to make brute forcing impossible.

Sure, you can make this setup secure too but why make it hard on yourself when there are much easier methods. Not to mention that normally people choose much shorter passphrases with much simpler choice of characters (instead of being random and strong). The setup should rely as little as possible on the user to choose a strong password.
Maybe even a simple KDF should be added to derive a bigger passphrase from the given user string (eg. derive 32 bytes using scrypt with costparam=16384).