Seed Generation in Hardware Wallets

[Romeo1290]

Read through the whole thread - really great to see people discussing actual security criteria, not just brand names.
  Also - has anyone here tried the ERA? It looks solid on paper, but I’d love to hear real user feedback from someone who actually held it in hand, not just read the site.

[dkbit98]

In light of recent debacle of c0ldcard crap devices, it is good idea to check entropy strength for most popular hardware wallets.
You can see comparison list and difference in entropy when 12 and 24 words are sued.
Using 24 words is obviously producing much better entropy, and is harder to break it.

[PX-Z]

Using 24 words is obviously producing much better entropy, and is harder to break it.
..

Plus, using extended bip39 passphrase can add another layer of security and make the resulting wallet much harder to attack through seed generation weaknesses.

[satscraper]

I would not rely on that SEED security table.

Any flaw that touches on randomness will undermine those estimates, so wallet owners must assume the worst-case scenario, i.e.  such flaws exist even if they have still not been revealed for their wallets. The only step users can take to mitigate this risk is to use the multisig setup.
 

[Cricktor]

From 40-->72 bits, 32 bits difference being ~4.3 billion times harder, totally understandable, math checks out right.

From 72-->128 bits, 56 bits difference being only ~72 million times harder? New math?? What could possibly weaken a much larger bit difference to make it much easier to break? I don't understand this. ~72 quadrillion or ~72 million billion times harder, I'd be fine with this.

[dkbit98]

Plus, using extended bip39 passphrase can add another layer of security and make the resulting wallet much harder to attack through seed generation weaknesses.

This doesn't really matter if you are using seed phrase generated with weak entropy.
One developer proved this with example of recent c0oldcard crap addresses, he added multiple passphrases with different complexities, and all addresses got emptied withing minutes.
You can't depend on strongest passphrase when weak base will crumble everything.

I would not rely on that SEED security table.

You don't have to really on anything, this is not holly scripture, just math.

[PX-Z]

Plus, using extended bip39 passphrase can add another layer of security and make the resulting wallet much harder to attack through seed generation weaknesses.

This doesn't really matter if you are using seed phrase generated with weak entropy.
One developer proved this with example of recent c0oldcard crap addresses, he added multiple passphrases with different complexities, and all addresses got emptied withing minutes.
You can't depend on strongest passphrase when weak base will crumble everything.

Can you link to the source for this?
I searched for information regarding weak entropy generation combined with a strong bip39 passphrase, and from what i can find, a sufficiently strong and independently generated passphrase should make the resulting wallet significantly harder to compromise, since the attacker would need to recover both the weakly generated seed and the passphrase.

That said, if the experiment/research demonstrates that the passphrase does not provide the expected protection in this particular scenario, that's obviously concerning.

[Cricktor]

Plus, using extended bip39 passphrase can add another layer of security and make the resulting wallet much harder to attack through seed generation weaknesses.

This doesn't really matter if you are using seed phrase generated with weak entropy.
One developer proved this with example of recent c0oldcard crap addresses, he added multiple passphrases with different complexities, and all addresses got emptied withing minutes.
You can't depend on strongest passphrase when weak base will crumble everything.

I would like to see the source of this claim, too.

From my understanding of the BIP39 derivation process^{see chart below} and at what point the mnemonic passphrase (the additional part) is introduced, a complex and basically not feasibly brute-forceable mnemonic passphrase should yield a wallet with not-attackable private keys.

The mnemonic passphrase is introduced before the PBKDF2 2048 hashing rounds with HMAC-SHA512. Depending on how much entropy the mnemonic passphrase introduces or carries, being at best basically not-brute-forceable, you can't reasonably crack such a wallet's derived private keys IF the mnemonic passphrase IS strong enough (no dictionary attack possible e.g.). It shouldn't then matter how "weak" the mnemonic recovery words' entropy is.

So, I very much doubt the claim of that one developer. And we've seen how badly developers can screw up in the example of Coinkite...

From Entropy to Address

The source once was (unfortunately now not working anymore as the Github repo seems to have been deleted): https://raw.githubusercontent.com/EAWF/BTC-Toolbox/3938785f186c76598989cc0aa017ad351483d3b1/Images/KeyDerivationTechnicalOverview.png
It was added to the repository with this commit: https://github.com/EAWF/BTC-Toolbox/commit/3938785f186c76598989cc0aa017ad351483d3b1 -- But it was removed by the uploader for a slightly insignificant reason, some surviving image copies in Reddit show that it's uploaded by the same user. Link to the commit that deleted it: https://github.com/EAWF/BTC-Toolbox/commit/f75e2b352ec9facc8d2da52b5ec303fb280c3298

[rdluffy]

This doesn't really matter if you are using seed phrase generated with weak entropy.
One developer proved this with example of recent c0oldcard crap addresses, he added multiple passphrases with different complexities, and all addresses got emptied withing minutes.
You can't depend on strongest passphrase when weak base will crumble everything.

Did they manage to extract even the passphrase that wasn't on the BIP39 list?
As far as I remember, that person had also generated one of those passphrases

In any case, there's already talk on Reddit that this might be an inside job, which would explain how they were able to access even those wallets with passphrases.

[satscraper]

Plus, using extended bip39 passphrase can add another layer of security and make the resulting wallet much harder to attack through seed generation weaknesses.

One developer proved this with example of recent c0oldcard crap addresses, he added multiple passphrases with different complexities, and all addresses got emptied withing minutes.

Then I would advise that "developer" to use passphrases with good entropy, the more the better.

According to BIP39 spec, the binary SEED results from the function PBKDF2(HMAC-SHA512, mnemonic, "mnemonic"+passphrase, 2048, 64), in which two of the arguments ^{namely, the mnemonic and "mnemonic"+passphrase} are independent variables. Being independent, their entropies add roughly additively to joint entropy which accordingly increases the search space for the bruteforce attack.

So, for example, adding 88-bit-entropy passphrase to a wallet with 40-bit mnemonic entropy would result in a wallet with 128 bits of combined entropy, which is currently computationally infeasible to bruteforcing.

Plus, using extended bip39 passphrase can add another layer of security and make the resulting wallet much harder to attack through seed generation weaknesses.

This doesn't really matter if you are using seed phrase generated with weak entropy.

Pls, don't mislead users.