Quote from: dunand on August 17, 2017, 04:08:20 AM

I was looking for a technique to store a wallet seed. Because if somebody find your seed that person can steal the bitcoins. I found a way to split the seed in two parts for cold storage.

- the technique can be use for any seed. Any number of words in the seed or dictionary. On a software or hardware wallet.
- encryption and decryption is simple and can be done with pen and paper if you want. I also made a python scrypt to encrypt (split) and decrypt (reassamble).
- Both parts contains only words and looks like an ordinary seed. No need to write a series of random characters that is error prone.
- The technique is based on the One time pad encryption.

I will show you how it's done manually. First you need a seed:
park color slice trade remove depend meadow bus clock curious where where

You create a second seed that will be use for encryption. I call that seed : "encryption seed A". It's one of the two part of the splitted seed. On electrum I use the make_seed command to generate it:
goddess clump renew require timber pitch loan bless sock hint ecology finish

To generate the second part that I call "encryption seed B". You need the dictionary file used by your wallet. Most of the time wallets are using https://raw.githubusercontent.com/bitcoin/bips/master/bip-0039/english.txt. For each words in your seed and in your "encryption seed A". You need the word number in the dictionary. The first word is number 1 and the last one is 2048.

[...]

Why are you performing modular arithmetic on wordlists, when computers think in bits? N.b. that you will break the checksum this way. BIP 39 stuffs 48 checksum bits into the last word; how many, depends on the length of the seed. I presume you will want means to check that your seed_b is recorded correctly, without access to your seed_a or your original seed (which I will call seed_0).

Also, Electrum does not generate BIP 39 seeds. You are mixing two different standards. Off the top of my head, I dont know whether Electrum uses the same English-language wordlist by default. But I do know that Electrums competing Seed Version System was designed to be fully wordlist-independent, which makes wordlist-arithmetic an even worse idea.

I suggest you XOR two seed-sized values drawn off /dev/urandom, then encode the results into BIP 39 seeds. You can do all of this except the XOR using dd(1) and easyseed(1), a secure BIP 39 seed generator which I so happen to have published yesterday (forum thread). easyseed(1) can take a file as input, or read from stdin. Producing the bitwise XOR of two equally-sized files is a trivial hello, world jobs in C, and probably in Python, too. Also, this could be done in memory without touching disk with a tiny bit of modification to easyseed(1); or, just use a memory disk and be sure to wipe it when youre done.

Well, that is if you want to do the scheme you said. As HCP pointed out, SSS is really the right tool for the job here. Your splitting scheme is secure, on condition that you never XOR the same values with anything else (see pad reuse). But it severely reduces availability. Using SSS and transforming its output to words through a secure mnemonic scheme would be much safer. I have been mental-whiteboarding a tool based on SSS, mnemonic phrases, and some other tricks for exactly these kinds of scenarios, though it may be awhile before I actually write it.

Quote from: hatshepsut93 on December 29, 2017, 11:38:50 AM

I've too recently came up with an idea for seeds and I hope some experienced cryptographers here will tell me if it's good or not.

First, we generate seed A which is our secret seed and used to create main wallet.

Then we generate seed B, which will act as a decoy.

Then we calculate a key such as (key + seed B) mod 2048 = seed A

Seed B is used to store small portion of BTC savings, so in case someone will get access to your private storage (thieves, kidnappers or police), they will get only a small portion of your coins, while you will be able to later restore your main wallet with a backup copy of seed B and the key.

My question is, is this scheme viable, or are there better ways to do it, like having independent decoy while hiding the main wallet through other means?

I am not a cryptographer, experienced or otherwise. But that sounds fine to mewith the killer caveat that your key will need to have as many bits as an independent seed, so why bother?

A better scheme may be to use a secret master seed, seed_0, run it through a KDF (as will be done anyway when your BIP39 seed is turned into a BIP32 HD wallet), and use the KDF to generate two independent seeds: seed_1 for your real treasure cave, and seed_2 the decoy. BIP39 simply takes a bag of bits as input; so you can still use easyseed(1) to turn your seed_2 decoy into a string of words, write it on a yellow sticky note, and hide it somewhere that bad guys will be allowed to find it after they begin to torture you (so itll be convincing) but before they torture you too much (what is your personal tolerance for being hit with a $5 wrench?). Meanwhile, keep the words for seed_0 secretnot only that, but keep its existence secret!; and it can be used to recover both other seeds.

Quote from: lnternet on December 29, 2017, 01:12:08 PM

Instead of your technique OP you could just split the seed into two halfs:

seed: park color slice trade remove depend meadow bus clock curious where where
seed part 1: park color slice trade remove depend
seed part 2: meadow bus clock curious where where

part 1 and part 2 have the exact same security profile as your seed A and seed B, only that splitting and re-combining is faster.

WRONG WRONG WRONG WRONG WRONG. As another person already told you:

Quote from: Answer_Evaded on December 29, 2017, 08:17:19 PM

Terrible advice! Do not do this! It will vastly decrease the security of your wallet!

They do not have the same security profile. Your method reveals half the information of your seed, the OP's method does not.