Post
Topic
Board Development & Technical Discussion
Re: Masking seed phrases for an extra layer of security (experimental)
by
Forsyth Jones
on 04/06/2025, 21:57:46 UTC
It’s not about encryption itself; it’s about using the encrypted seed phrase as a decoy.
If that's the only objective then the solution already exists and there is no reason to re-invent the wheel. It is called the extra word or the passphrase. It is any phrase that you can add to your existing seed phrase to derive an entirely different set of keys. The seed is still the same and is the decoy itself. The only way to access the funds is to know that passphrase.
That passphrase can be the same password you used to encrypt in your algorithm (birthday, passport number, etc...).
Many might argue that a BIP39 passphrase eliminates any need for encryption and/or steganography techniques of an original BIP39 mnemonic, you may be right, there is no right or wrong, simply each person adopts a cryptographic solution that meets their threat model.

There are several methods to generate a decoy seed like the OP's method, Seed-OTP, BIP-85 can also be used, although its original proposal isn't for that, anyway, it's just another extra layer of security that makes backups more resilient, but the risk of forgetting or confusion increases.... that is why it's important to document everything and review the backups from time to time.

I haven't tested the code yet, I hope to test it today or in a few days.

~Remembering that the passphrase is very secure and should work for 99% of users, in addition to being a standardized method, known and supported by most wallets.