How secure is the seed? Some noobish questions...

[anon99999]

In Read the Docs it says "The seed phrase created by Electrum has 132 bits of entropy. This means that it provides the same level of security as a Bitcoin private key (of length 256 bits). Indeed, an elliptic curve key of length n provides n/2 bits of security."

Q1: This is not much information about how the seed is derived. Is examining the source code the only way to understand more about this? I haven't done that yet.

Q2: In light of the latest AI models, and the ones sure to follow, how long will this be enough to keep coins secure? I think I read recently that future models will be able to break ECDSA. Interested to hear any thoughts on this.

Q3: When I create a new wallet, Electrum instantly produces a 12 word seed. Since the Coldcard exploit I've read that entropy should be added with a passphrase, dice rollls, mouse movements etc, yet with Electrum there is no option for any of this. Why would these other wallets need all that if Electrum doesn't, and how can we verify the 12 word seeds generated by Electrum are sufficient?

Thanks in advance!

[zabzob]

Since your question is specifically about Electrum seeds, it would make sense to post this thread in the Electrum subforum of the wallet software forum

[anon99999]

Sorry wasn't aware. Will do.

[BitMaxz]

Q3: When I create a new wallet, Electrum instantly produces a 12 word seed. Since the Coldcard exploit I've read that entropy should be added with a passphrase, dice rollls, mouse movements etc, yet with Electrum there is no option for any of this. Why would these other wallets need all that if Electrum doesn't, and how can we verify the 12 word seeds generated by Electrum are sufficient?

Well, Electrum is not perfect to give you a 100% secured wallet; it still depends on your environment. The seed generation from Electrum is unique and not compatible to any other wallet when importing.

I'm using Electrum for me; their wallet seed generation is sufficient to me since I haven't experienced any issue yet from my wallet. I generated my seed in an offline device; it was never connected to the internet. I only use a separate device only for signing an offline transaction I use the camera or SD card to transfer the raw unsigned transaction to the offline device to sign the transaction and scan it via QR code to broadcast the transaction into the online device.

I know it does not have some feature where the mouse movements are included to generate a unique seed, but the quality of the Electrum seed depends on your device environment.
The only reason why most users are being hacked and lose their BTC is due to malware like installing a fake Electrum and also being attacked online if you can make a cold storage wallet with Electrum you are far from any online attacks.

About adding a passphrase, this feature actually exists in Electrum as extended custom words. It makes your seed phrase more secure if you enable it during wallet creation.

[Yamane_Keto]

1. It is the make_seed function in mnemonic.py that generates 132 bits of entropy by default.

https://github.com/spesmilo/electrum/blob/master/electrum/mnemonic.py

2. The real danger is not the seed itself, but in the Bitcoin public keys generated by your wallet; if you succeed in keeping them hidden and avoid address reuse, you will theoretically be safe.

3. Electrum wallet supports adding a passphrase; the seed is secure without one, the passphrase is mentioned in the context of Coldcard because it relates to the firmware update.

[Cricktor]

Q1: This is not much information about how the seed is derived. Is examining the source code the only way to understand more about this? I haven't done that yet.

You either trust that multiple eyes have reviewed and audited the code or you look and verify yourself. Electrum is well designed and a long time on the market. Well, that doesn't prove anything if everybody kept their eyes shut.

Q2: ... I think I read recently that future models will be able to break ECDSA.

This is quite some bullshit, don't believe every nonsense you read anywhere.

Q3: When I create a new wallet, Electrum instantly produces a 12 word seed. Since the Coldcard exploit I've read that entropy should be added with a passphrase, dice rollls, mouse movements etc, yet with Electrum there is no option for any of this. Why would these other wallets need all that if Electrum doesn't, and how can we verify the 12 word seeds generated by Electrum are sufficient?

You can tell Electrum via the console tab to produce 24 recovery words, if that makes you feel safer.

You're wrong when you say "there is no option for any of this". When you create a standard Electrum wallet new, on the screen where the Electrum recovery words are shown, there's an "Options" button, click on it, ans "Seed Options" opens where you can tick the box "Extend this seed with custom words". Here you can specify the additional mnemonic passphrase. It can be anything, not necessarily only some custom words. Beware! The smallest error in the additional mnemonic passphrase and you don't get your wallet you expect but just another empty wallet.

If you extend the seed words (the mnemonic recovery words, by standard 12, but you can instruct Electrum to generate more; I will have to look up the command for it) with an additional mnemonic passphrase, it's very important to properly document and backup both, but not together!

Code:

make_seed(264)

Enter this in the Console tab to generate 24 recovery words for an Electrum Segwit wallet (standard). If you don't see the Console tab (not enabled by default), enable it from the "View" menu.

[hosemary]

Q1: This is not much information about how the seed is derived. Is examining the source code the only way to understand more about this? I haven't done that yet.

Electrum first generates a random entropy through Python's os.urandom function which uses the operating system random number generator, and then converts it into a seed phrase using a wordlist. By default, Electrum uses BIP39 wordlist.
After that, Electrum hashes the seed phrase through HMAC-SHA512 function with using "Seed version" as key, and accepts the seed phrase only if the resulting hash starts with the correct version number. The version number is 0x01 for legacy wallets, 0x100 for segwit wallets, and 0x101 for 2FA wallets.
If the resulting hash doesn't start with the correct version number, it increments the entropy, generates a new seed phrase, and repeats the process until it finds a valid seed phrase.

Q2: In light of the latest AI models, and the ones sure to follow, how long will this be enough to keep coins secure? I think I read recently that future models will be able to break ECDSA. Interested to hear any thoughts on this.

I have never heard such a thing.
Maybe, you are confusing it with quantum computer threats.

Q3: When I create a new wallet, Electrum instantly produces a 12 word seed. Since the Coldcard exploit I've read that entropy should be added with a passphrase, dice rollls, mouse movements etc, yet with Electrum there is no option for any of this. Why would these other wallets need all that if Electrum doesn't, and how can we verify the 12 word seeds generated by Electrum are sufficient?

Electrum allows you to add a passphrase to your seed phrase.

[Stalker22]

Q1: This is not much information about how the seed is derived. Is examining the source code the only way to understand more about this? I haven't done that yet.

Electrum gets its random entropy from your operating system's cryptographically secure pseudorandom number generator (CSPRNG) via Python underlying system calls (such as os.urandom or secrets.token_bytes).  Modern operating system CSPRNGs are highly secure because they use true physical entropy (chaotic noise) from your computer hardware.  The problem with the Coldcard was a critical firmware bug that caused certain devices to generate weak, predictable seed phrases.  Instead of calling the secure hardware TRNG, the device silently defaulted to a weak, predictable software-based PRNG fallback.

[anon99999]

Thanks a lot everyone, for taking the time to answer my questions.

I noticed the option to extend the seed with custom words, and wondered if that was a way to add entropy.

I didn't know there was a way to generate a 24 word seed.

Really appreciate the translation of the code behind the mnemonic!

Perhaps it was the idea that an AI model (say some of years from now) could brute force wallets much faster than 100,000 years or whatever it has been previously calculated...

[nc50lc]

Q2: In light of the latest AI models, and the ones sure to follow, how long will this be enough to keep coins secure? I think I read recently that future models will be able to break ECDSA. Interested to hear any thoughts on this.

Disregarding the "AI breaking ECDSA FUD" that you've read, Electrum should now be strong against AI-assisted "hacking".
One reason is; the latest 2 release versions were extensively audited by famous people/group that utilizes AI (while not entirely relying on it).
Not just one, but a few of them, refer to Electrum's release notes for the list.

So, if even there'll be an obvious but missed vulnerability in the entropy generation like Coldcard firmware had or even a sneaky one,
It should've been caught months ago.

But since a bug is something that's unintended, we'll never know for certain.
But assuming AI is already used to audit the code, there's only a slim chance that a basement dweller hacker can find something that they've missed with another AI.

Perhaps it was the idea that an AI model (say some of years from now) could brute force wallets much faster than 100,000 years or whatever it has been previously calculated...

AI can't speed up bruteforce,
But it can potentially speed up the development of hardware and software that can be used to bruteforce.
But then, it depends if it can invent something so efficient that doesn't require to harness the sun's entire energy to power it.

[notocactus]

Q2: In light of the latest AI models, and the ones sure to follow, how long will this be enough to keep coins secure? I think I read recently that future models will be able to break ECDSA. Interested to hear any thoughts on this.

ECDSA can not be broken (brute forced) but if a wallet is weak in seed generation like Coldcard, it can be hacked but let's emphasize that it's different thing and is not related to security of ECDSA.

Elliptic Curve Digital Signature Algorithm.
Trap-door function.
Critical vulnerability affecting COLDCARD users only.
Large-scale Coldcard compromise (1596 BTC stolen so far).

Disregarding the "AI breaking ECDSA FUD" that you've read, Electrum should now be strong against AI-assisted "hacking".
One reason is; the latest 2 release versions were extensively audited by famous people/group that utilizes AI (while not entirely relying on it).
Not just one, but a few of them, refer to Electrum's release notes for the list.

Electrum is one of oldest Bitcoin softwares and even it has this vulnerability in 2018, their team have been professional and capable of security fix and wallet development for later versions.

This latest audits show that Electrum team are seriously taking care of their wallet software in security, and they have proactively taken actions rather than passively wait for community reports on security holes but even ignored such severe security warnings like Coldcard team.

By the way, this article is important for grabbing some information and get rid of fear in The Rise of the Machines.

[pooya87]

Q2: In light of the latest AI models, and the ones sure to follow, how long will this be enough to keep coins secure? I think I read recently that future models will be able to break ECDSA. Interested to hear any thoughts on this.

The chances of that happening is basically zero.
AI is not intelligent, it cannot innovate and solve complex mathematical problems that were never solved before. What it can do is look through what already exists and pretend it has intelligence. Since nobody has ever solved ECDLP, that means AI cannot solve it either.

Another thing needed to break ECDSA is computing power and AI doesn't produce computer power, it consumes it.

[anon99999]

the latest 2 release versions were extensively audited by famous people/group that utilizes AI (while not entirely relying on it).
Not just one, but a few of them, refer to Electrum's release notes for the list.

Thanks for this! I didn't know the release notes referenced recent audits.

[
Electrum gets its random entropy from your operating system's cryptographically secure pseudorandom number generator (CSPRNG) via Python underlying system calls (such as os.urandom or secrets.token_bytes).  Modern operating system CSPRNGs are highly secure because they use true physical entropy (chaotic noise) from your computer hardware.

This is very helpful, thank you. What versions of Linux and Android (GrapheneOS) would you classify as modern?

Electrum first generates a random entropy through Python's os.urandom function which uses the operating system random number generator, and then converts it into a seed phrase using a wordlist. By default, Electrum uses BIP39 wordlist.

After that, Electrum hashes the seed phrase through HMAC-SHA512 function with using "Seed version" as key, and accepts the seed phrase only if the resulting hash starts with the correct version number. The version number is 0x01 for legacy wallets, 0x100 for segwit wallets, and 0x101 for 2FA wallets.

If the resulting hash doesn't start with the correct version number, it increments the entropy, generates a new seed phrase, and repeats the process until it finds a valid seed phrase.

This is excellent, thanks! Looking into the Electrum source, I don't know where to begin to see where this sequence begins. Would be cool to be able to follow the code thru all you have described. If you have time, I'd love if you could point me to the files that call the os.random function. I assume the mneumonic.py is the next step. The subsequent hashing is mind bending for me but perhaps someday I will be able to comprehend it on some level!

Electrum allows you to add a passphrase to your seed phrase.

By this are you referring to the ability to add extra words? Does the password feature in the Electrum application contribute to entropy in the wallets it generates?

The chances of that happening is basically zero.
AI is not intelligent, it cannot innovate and solve complex mathematical problems that were never solved before. What it can do is look through what already exists and pretend it has intelligence. Since nobody has ever solved ECDLP, that means AI cannot solve it either.

Another thing needed to break ECDSA is computing power and AI doesn't produce computer power, it consumes it.

Thank you. I've been a little on edge about it all lately, seeing how far these tools have advanced just over the last 9mos or so, and wondering what the future will bring.

[hosemary]

By this are you referring to the ability to add extra words?

Yes.

Does the password feature in the Electrum application contribute to entropy in the wallets it generates?

No. Your password encrypts your wallet file locally and is completely separate from passphrase.
Anyone who has access to your seed phrase (+passphrase, if there's any) can steal your funds without any need to your password.

[nc50lc]

Not just one, but a few of them, refer to Electrum's release notes for the list.

Thanks for this! I didn't know the release notes referenced recent audits.

If you checked the release notes before, you didn't miss anything.
Because those are just added recently; previously, those were noted as "undisclosed" for some reason.

[ABCbits]

[
Electrum gets its random entropy from your operating system's cryptographically secure pseudorandom number generator (CSPRNG) via Python underlying system calls (such as os.urandom or secrets.token_bytes).  Modern operating system CSPRNGs are highly secure because they use true physical entropy (chaotic noise) from your computer hardware.

This is very helpful, thank you. What versions of Linux and Android (GrapheneOS) would you classify as modern?

Most OS in last few years could be considered enough to have modern CSPRNG. But if you're being very cautious, use linux distro or android that use kernel version 5.17 or newer.

As covered at the end of December, Linux is replacing SHA1 usage with BLAKE2s as part of its entropy extractor code. The BLAKE2s code is not only more secure than SHA1 but also faster. This BLAKE2s usage was found to improve the entropy extraction by 131%.

Note that i don't know if there's any other major changes to linux RNG since version 5.17.

[anon99999]

Most OS in last few years could be considered enough to have modern CSPRNG. But if you're being very cautious, use linux distro or android that use kernel version 5.17 or newer.

Note that i don't know if there's any other major changes to linux RNG since version 5.17.

Great to know thanks!

[Mia Chloe]

~snip

Most wallets get their entropy from random number generation and basically if you are not manually generating your seed yourself you are basically trusting that the wallet is using a good enough entropy. For add security you can just decide to add a couple custom words too.

The difference between a 24 word seed and 12 word seed generated from the same entropy is usually only big mathematically since in a practical case if you could crack a 12 word seed because of weak entropy then what you could do to a 24 word seed is pretty much no different.

[anon99999]

Thanks again to everyone for your input.

Contemplating it all, I've come back around to the Electrum FAQ which states: "The seed phrase created by Electrum has 132 bits of entropy."

Since this wallet has been around long before the latest RNG in Linux kernel version 5.17, is there really any effective difference in the entropy between seeds generated on a 10yr old Linux OS versus the latest version? Wouldn't they both have 132 bits?

Does adding extra words (even up to 24) still result in the same 132 bits as simply using the 12 words?

Did earlier versions of Electrum create seeds with less than 132 bits?

[Zaguru12]

Since this wallet has been around long before the latest RNG in Linux kernel version 5.17, is there really any effective difference in the entropy between seeds generated on a 10yr old Linux OS versus the latest version? Wouldn't they both have 132 bits?

I don’t think there will be any difference in the entropy bit generated. I strongly doubt the randomness will change.

Does adding extra words (even up to 24) still result in the same 132 bits as simply using the 12 words?

No it should actually change, because each word generates 11 bits of entropy and words gives 132 bits of entropy (11 x 12) then that of 24 words should be 264 bits of entropy (11 x 24). But this technically doesn’t mean a safer wallet because the security bits of a private key is 128 bits regardless of the number words for seed.

Did earlier versions of Electrum create seeds with less than 132 bits?

It could be because there wasn’t checksum and the earlier electrum seed were actually older than this bip39 seed compatibility. I think it should be the standard seed bits which is 128 bits and this less than current 132 bits