Quote from: Klestin on June 13, 2015, 02:58:39 AM

Quote from: blossbloss on June 13, 2015, 01:21:56 AM

Serious comment: brainwallet for long term storag, Trezor for mid term, and Mycelium app for pocket change.
Comments?

Brainwallet is fine if done correctly. Sadly, virtually all brainwallets are not done correctly. The crib notes version for correctly generating a brainwallet:

- Pick 12+ random (really, actually, truly) random words from a large list. Diceware will work fine. (Google it if unfamiliar)
- Commit the words to memory, and periodically test yourself
- Generate your wallet/key from an offline copy of a page, that you either trust or have personally verified the code. Or use Electrum, if you trust it and have ensured it is untampered with.

Trezor and Mycelium I use myself.

If the words are random, then it will be much more difficult to memorize, and the chances will be greater that you will lose access to your funds.

IMO a safer bet would be to do the following:
#create a brain wallet with a relatively easy to remember phrase
#sign a message with a second, but different easy to remember phrase
#the resulting signature will be your passphrase

For example:
#I create a brain wallet with the phrase "quickseller is cool" (without quotes)
#The corresponding address is using brainwallet.github.io (uncompressed) is 13qAJGPqcyK2Dd69b19n4S9Bvfwxn7SS5Q
#The private key to 13qAJGPqcyK2Dd69b19n4S9Bvfwxn7SS5Q is 5KcNGK5y76KHYMNLnzX8exekj5Y3ygDMNUhudeoc3Eurk9hWkEN
#If I sign the message "today is friday" (without quotes) with the above private key (multibit) then I would receive the following signature: G7PbabLubAJeeEUf0UGvEvD4YeTRw/M3ft/k4daoiocef4fqHY7QX7wJjvSss9TX0E3wMuFA+4zt2/44PkYimYM=
#I would then use G7PbabLubAJeeEUf0UGvEvD4YeTRw/M3ft/k4daoiocef4fqHY7QX7wJjvSss9TX0E3wMuFA+4zt2/44PkYimYM=
as my passphrase for my brain wallet which would result in the address 1A9Xp5DgASmApmnRpgzriW663oJdv2Uxic

The above steps would make it much more difficult for a brainwallet farmer to try to crack my brainwallet because of the exponentially greater number of potential passphrases if you use two sentences found in literature or are otherwise easily crackable.

If you were to assume there are 1,000,000 words in the english dictionary, and you were to use a 'random' three words as your 'first' passphrase' and a 'random' three words as the message that you sign with the above resulting key then:

There are 1,000,000³, or ~1 * 10¹⁸ possibilities as to what your first (signing) address will be. If you can calculate a trillion 'three word' passphrase combinations per second then it would take you 1,000,000 seconds or ~99 weeks to find all of the possible 'three word' passphrase combinations - they have probably already been found a long time ago.

If you were to take a random of the above addresses and sign a random three word message with the resulting private key then there would be a total of 1 * 10³⁶ possible signing address - resulting signature combinations. If you can calculate a trillion of these combinations per second then it would take you 1 * 10²⁴ seconds to calculate all of these combinations, this works out to be roughly 1.335 * 10¹⁹ years to calculate all of the possible combinations.

The current Bitcoin network hash rate is something less then 400,000 trillion hashes per second, so if the entire current network were to be repurposed to calculate all of the possible above combinations (assuming ASICs could be repurposed to do this) then it would take roughly 3.3375 * 10¹² years to calculate all of the possible combinations. This is roughly 3.3 trillion years.

It should be noted that a three word combination would be very easy to remember, and it would not be difficult to increase either, or both of the lengths, and if this were to happen then the number of possible private key combinations would be exponentially larger.

It should also be noted that I am not going to personally endorse this strategy of creating a brain wallet, and as a result I am not going to take responsibility if anyone were to have their funds stolen as a result of employing this kind of strategy.

if someone can find any non-trival errors in my math then please feel free to point them out