Preface

Brainwallet fans, Ill tell you what: Why dont you generate a 12-word BIP 39 mnemonic representing a piddling 128 bits off /dev/urandom, then secure it with a BIP 39 passphrase consisting of the very mostest unguessablist sentence your oh so creative mind can imagine. You will feel better; and yet despite your own desire for foot-shooting, you will be secured by 128 bits of entropy. Sound fair?

On second thought, no. Dont do what I just said. If you are so stupid as to use a brainwallet, then others deserve that money more than you do. My sincere advice is to use the brainwallet.

curiosity81, it seems (at a glance) that you are deploying a word generator generated from a decent (i.e. non-human) source of randomness. Not a syntactically valid phrase, not something the user comes up with, not something from a book you cross your fingers and hope to be really obscure. Not what most people call a brainwallet.

That raises an obvious question, which I must ask out ofcuriosity: Why dont you simply use BIP 39? It was developed by the same experts whose security acumen you trust when you use Bitcoin anyway. Its wordlists were developed with human use in mind, e.g., all words on the English wordlist are unique within the first four characters. And it will perfectly encode 128256 bits of randomness in 1224 words, without any of the pitfalls of trying to develop your own word randomization scheme.

With your wordlist, I presume not tuned to a power of 2, did you avoid the common mistake of introducing modulo bias? (I did not review your code.) Does your wordlist exclude similar, confusable words? (I am guessing not.) Etc.

In that context, this:

Quote from: curiosity81 on January 02, 2018, 02:49:04 PM

I would prefer a system which follows the KISS-principle (KISS = Keep It Simple Stupid) for long term archiving: Firstly, the code should reproducible easily. I am not sure, if the bash is perfect for this. But I like it, since most algorithms are already developed by experts and available on a standard linux system. They only have to be plugged together. Secondly, code should be easy to understand (which might be a little bit contradictory with respect to bash-syntax). (In my case, comments are still missing in some scripts in the moment. And code is not uniformly yet with respect to mathematical computations.) But it should be possible to print out the scripts and the linux version used and archive it in a bookcase or similar. Much better would it be if it can be carved in stone or glas.

...makes it irresistable for me to plug my own utility (red highlight added):

Quote from: nullius on December 29, 2017, 11:06:31 PM

I have released an initial version of the easyseed(1) utility for secure generation of BIP 39 mnemonic seed phrases. As any worthwhile software, it comes replete with a manpage, q.v. It generates mnemonic phrases in these languages and writing systems:

Chinese (Simplified) (汉语)
Chinese (Traditional) (漢語)
English [default]
French (Français)
Italian (Italiano)
Japanese (日本語)
Korean (한국어)
Spanish (Español)

My original motivation for writing this was that I needed a lightweight, reliable BIP 39 seed phrase generator with easily auditable sources and minimal dependencies for use on a stripped-down airgap machine. The source code is short, easy to read, and lovingly commented; it can be readily understood by anybody with a basic knowledge of the C programming language. Its only dependencies are cc(1), make(1), and a library SHA256 implementationavailable on most platforms via libcrypto or otherwise.

Its admittedly growing a little bit more complexwith much of the complexity being in self-testing code. However, I have a priority to keep it auditable and avoid external dependencies. I still need to add the seed output, which per BIP 39 requires normalization of phrases to Unicode NFKD; no, I will not link ICU! Im working on a solution to that.

Quick comments on a skim down the thread:

Quote from: piotr_n on January 01, 2018, 08:37:50 PM

seriously, I am not aware of any hacking tool, or even a serious theoretical paper, that would successfully address a problem of brute forcing original sentences made by a human brain. make an original sentence (one that you can't just google) of ~20 words and I am betting all my bitcoins that no man armed with the fastest computer is going to brute force it before we both die.

if I wanted to crack brain wallets, I'd rather put my effort in finding a way to calculate the EC-private key from the EC-public, rather than try to brute force a creativity (or insanity) of a human brain. the first one not only seems less complex and more straight forward to me, but (most of all) it would then crack all the wallets :)

Quote from: piotr_n on January 01, 2018, 09:07:53 PM

Quote from: Spendulus on January 01, 2018, 09:02:26 PM

C Human phrases are in fact recognized and accepted as bad idea. Time to break these phrases is the proof not opinion

Sorry. You're obviously not going to change your dogmatic rhetoric, whilst I am not interested in debating non science on this forum.

(And more posts like this.)

piotr_n, you have no idea what youre talking about. A human-made natural language phrase is a horrible, stupid idea. I dont care how creative you claim to be, or how much you bluster about how amazingly scientific you are (versus all the people who know more than you about this subject).

You are giving bad advice which will get somebody hurt; and from how youre talking, its evident that you will then turn around and say they didnt do it right, like you could. How very kind of you.

Quote from: HeRetiK on December 30, 2017, 05:06:31 PM

You'll likely have to use a combination of different hashes in varying rounds (eg., 10x Sha256 => 2x Scrypt => Bcrypt => etc) requiring an attacker to reproduce your exact hashing steps. Let's not forget that anyone who is scanning for brainwallets has a lot of time to do so and thus can account for multiple hashing rounds as well.

Quote from: HeRetiK on January 01, 2018, 06:59:06 PM

Question being, whether a simple obfuscation algorithm that can be done in your head or with a piece of paper is sufficient, as opposed to a computer-supported one. Unless you can mentally sha256 :P

Given the amount of possible simple obfuscation algorithms I guess one can achieve sufficient security without computer support, assuming you don't rely on any well known methods (rot13 anyone?). In other words, this could be a use case where rolling your own "crypto" and security by obscurity might be a good thing.

Using the word algorithm loosely, if you cant design an algorithm which remains secure when your adversary knows it, then you will certainly be unable to design an algorithm which is secure when unknown.

Note the subtle difference from what you usually hear.