Quote from: almightyruler on November 19, 2018, 11:11:42 AM

Quote from: ETFbitcoin on November 19, 2018, 07:03:53 AM

Quote from: almightyruler on November 19, 2018, 05:51:09 AM

An earlier post states that 17 of the 24 words were revealed, so only 6 words need to be brute forced.

If the positions of the revealed words are known then you could recover up to 187 bits of the 256 bit key, and instead you would brute force the unknown bits.

Should've read the thread carefully, but there are 6 7 words need to be brute-forced.

Even if the position of 7 unknown words is known, it's still impossible as there's 1.25^44 possible combination if my calculation is right. (2048^7) * (17^17).
Jameson Lopp trying to make people understand why brute-force is impossible.

Oops, it is 7 unknown, not 6.

I agree that even when knowing the majority of the words, the chance of brute forcing the remaining bits to recover the complete key is infinitesimal.

Assuming 11 bits per word (2^11=2048), 17 known words means you have 187 bits of a 256 bit key already. That leaves 69 bits (2^69) to brute force.

If you were able to test 2^32 keys per second (an incredibly optimistic rate which assumes massive scale) it would still take 2^37 seconds to cover the entire search space... which is about 4358 years.

Things would be more complicated if you didn't know the positions of the words, as you would have to try the known 17 binary sequences in various locations, as well as brute forcing the remaining bits.

And if there's any key stretching involved the time taken to test each key, and therefore search the whole space, goes up by a significant amount.

Kind of cool that even if you know nearly 75% of a 256 bit private key, the chances of cracking it are still virtually zero.

From the https://github.com/bitcoin/bips/blob/71586487532d832ae4a3b0deae797d86ddebe3fc/bip-0039.mediawikiBIP39 github

Quote

This checksum is appended to the end of the initial entropy. Next, these concatenated bits are split into groups of 11 bits, each encoding a number from 0-2047, serving as an index into a wordlist. Finally, we convert these numbers into words and use the joined words as a mnemonic sentence.

It is indeed 6 words not 7. Also, if any other information can be recovered on the additional 6 words, 1 letter, approximate length, etc. the 2048 list becomes much much smaller very quickly. For example, if we know a word is 3 letters it goes to 100 options. If we know it is 4-5 letters it turns into 1000 options. If we know it has a "w" it turns into 166. Therefore, the partial information should also be accounted for when calculating the difficulty.