Quote from: jonald_fyookball on August 27, 2014, 06:58:11 PM

sorry to double post my question...but why exactly is electrum safe with only 128 bits of entropy? (besides the extra 16 bits of key stretching which I'm aware of)... Huh

Is it because it is hashed in the first place? Once you hash a passphrase, it retains all the entropy? You can't reverse the hashing... Is that it?

A hashed value does retain the lesser of the hash length and the original entropy due to the avalanche effect of function. The issue with using a truncated key isn't that the key has some reduced entropy but rather that the distribution isn't random (i.e. if you pad 160 bits with t the possibility than 96 bits of leading zeroes then the scope of all possible keys has been reduced). The keys produced from a deterministic function using hashes from a 128 bit seed can never have more than 128 bits of entropy however the possible values are randomly distributed over the key space.

Electrum wallets "could" be attacked by brute forcing the seed instead of the keys. They are secure because brute forcing the seed is no faster (and actually is significantly slower due to key stretching) than brute forcing the private key from a known public key.

The OP talks about using a reduced length key but if you hashed that value then it would in essence be a seed with <256 bits making it very similar to a deterministic wallet except in this case it is a deterministic wallet of one. Taking a hash of the value to produce the key is fine [SHA-256(seed)=key ] but if you are going to do that then I would use a memory information dense format than hex such as using random mnemonic words. It would be shorter and easier to memorize than even a reduced length key.

Using diceware (http://world.std.com/~reinhold/diceware.html) each word has 12.9 bits of entropy. For 128 bit strength we need 10 words. I rolled the following words.

Code:

hi dewar arise belly urn brush gain scam gawky liven

SHA-256("hi dewar arise belly urn brush gain scam gawky liven") = 76df74f69be8d08324ded37f180010747811eac1a8104e19eed4e7a0c1b44b7a

Code:

private key (hex): 76df74f69be8d08324ded37f180010747811eac1a8104e19eed4e7a0c1b44b7a
private key (WIF): L1CnSP3scSGqqBSy3ci8XoAyUkSzENbKHDDaKXcVihGc84AhG1Uf
public key: 02b4410f9ff2d8798351ce0fe3ba7396d7d0dbd5aa1df192a3e46e6d08ad3de01a
address: 175mxfk6K6DD1Fz9ZmFitZaeHUzxDzBULS

Please nobody use this address it is just for illustration.

Personally I find it easier to memorize:

Quote

hi dewar arise belly urn brush gain scam gawky liven

then:

Quote

76df74f69be8d08324ded37f180010747811eac1a8104e19eed4e7a0c1b44b7a

or even:

Quote

180010747811eac1a8104e19eed4e7a0c1b44b7a (24 padded zeros assumed)