Post
Topic
Board Development & Technical Discussion
Re: Pondering a Highly Secure Deterministic Brainwallet
by
gglon
on 30/11/2013, 17:29:48 UTC
Quote
But my approach is designed to help me generate the high entropy passphrase reliably without having to memorize things.

That is not possible. You have to remember something. Either these are words, symbols, functions, method of obfuscation - you still need to remember them. As a result you get passphrase with some entropy. But calculating this entropy is not that easy as just calculating length of the passphrase. You need to calculate entropy of obtaining that passphrase. And that entropy may depend on the information the attacker has about his target. 

Quote
c1-0520 That simple BrainSeed reliably generates this passphrase:
Nf3Be2H30-0Be3cxD4a3Nc3NB5Ne5!QxE2Rac1BG5Bxf6NC4!Nxb6!RFd1Qe3!d5!rxd5

So let's assume that attacker somehow get the information about you. Now we will estimate the enropy:
topic: chess matches - one of ~32 most likely topics - 5 bits of entropy
some popular game: one of ~128 most notable ones - 7 bits
shortcut of above 2 steps "c1" - one of ~16 most likely - 4 bits
common separator "-" - 2 bits
method of further obfuscation - one of ~64 most likely ones - 6 bits
first digit 0 or 1 - 1bit
three random digits - 10bits
bip38 - i don't know exactly but perhaps ~20 bits

So to sum up we get ~55 bits of entropy of brain wallet if the attacker know sth about you. If not, add ~5 bits and you get brainwallet with ~60bits. While it may be enough today, it is much lower than recommended standard of 128 bits. And I wouldn't recommend to choose anything below 80bits.

While above calculation may seem to overestimate the attacker capabilities, you need to remember that passwords are being broken by highly intelligent AI which is aware of all common human password choosing strategies.

You also have to take into consideration that when humans are told to follow your procedure, they would probably choose sth like: take first 20 words of bible, choose every 2nd, and add some 2 digit nr to get <40bit brainwallet entropy, which is a disaster.

That is way it is recommended just to create 12 random word (128bit) seed. Then you can bip38 it (~20) with 4 random words from seed(~40) and hide it physically (~20) to get total ~80bits (in case you forget the whole 12 initial words).