5

For a Ledger Nano S recovery contingency plan, how can one compute an associated vector of 25 Electrum wallet recovery words for each primary address using BIP 44 technology that is seeded from BIP 39 using 12, 18 or 24 seed words (not to be confused with Electrum seed words), and an associated BIP 39 passphrase (not to be confused with a Monero wallet password)?

It is unclear if or how m/44'/128'/0' or m/44'/128'/0'/0/0 or some other HD wallet path(s) is/are used to synthesize a primary Monero private key and associated address.

It should be possible to calculate associated Electrum seed words for a given set of BIP 39 seed words and a specified HD wallet path. Those Electrum words could then be used by monero-wallet-cli to recover funds using --restore-deterministic-wallet, or other wallets (e.g., Monerujo, Cakewallet, X Wallet).

With a Plan B Recovery Plan, it should be possible to engender more trust in a Ledger Nano S beta Monero capabilities. The Trezor had such a Plan B recovery capability 18 months ago before the Monero Ring CT fork activated.

3
  • Please clarify what you mean by "Plan B Recovery Plan".
    – jtgrassie
    Jul 19, 2018 at 20:43
  • Updated content above.
    – skaht
    Jul 30, 2018 at 21:27
  • Looks like something is happening, see reddit.com/r/Monero/comments/95kx37/…. Would like to see the theory before having an implementation.
    – skaht
    Aug 10, 2018 at 22:53

1 Answer 1

4

The original answer is found at https://github.com/LedgerHQ/ledger-app-monero/tree/master/tools/python.

For OSX hosts, to complement the ledger-app-monero documentation, the Homebrew package manager's brew command is used instead of the apt command to install two dependent packages. The ledger-app-monero application has a dependency upon the libusb and libusb-compat packages that can be installed using:

% brew install libusb libusb-compat

The Advanced Package Tool package manager's apt command is frequently used for Ubuntu and Debian hosts. Those hosts need the libusb-dev and libudev-dev packages to be installed, per ledger-app-monero documentation.

After cloning the ledger-app-monero package and satisfying documented pip3 python package dependencies, change into your local the ledger-app-monero/tools/python/src directory and execute the following:

% python3 -m ledger.monero.seedconv offline

Unfortunately, the results for the README.md 12 word test vector did not match. Here are my results that are also embedded in code here.

BIP 39 Test Vector with no passphrase: abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about

Test Vector Monero Electrum words:
tavern judge beyond bifocals deepest mural onward dummy eagle diode gained vacation rally cause firm idled jerseys moat vigilant upload bobsled jobs cunning doing jobs

Independently validated the Monero seed words synthesized using ledger/monero/seedconv.py (that was supplied with the same 24 BIP 39 seed words and a BIP 39 passphrase used to configure a Ledger Nano S) were successfully loaded into Monerujo and CakeWallet mobile wallets and the same addresses appeared in both software wallets and a Nano S.

For the same test vector above, the m/44'/128'/0'/0/0 technique shown below using bitcoin-explorer is documented further here.

% echo "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about" | bx mnemonic-to-seed -p "" | bx hd-new | bx hd-private -d -i 44 | bx hd-private -d -i 128 | bx hd-private -d -i 0 | bx hd-private -i 0 | bx hd-private -i 0 | bx hd-to-ec | ./kec256 | ./xmr

Seed                 : 907cf0eb0e0bbd761a7ed9bc8777fa5530e8262792a3e718533a1a357a1e4199
Private Spend Key    : 3b094ca7218f175e91fa2402b4ae239a2fe8262792a3e718533a1a357a1e4109
Private View Key     : 0f3fe25d0c6d4c94dde0c0bcc214b233e9c72927f813728b0f01f28f9d5e1201
Public Spend Key     : dae41d6b13568fdd71ec3d20c2f614c65fe819f36ca5da8d24df3bd89b2bad9d
Public View Key      : 865cbfab852a1d1ccdfc7328e4dac90f78fc2154257d07522e9b79e637326dfa
Monero Address       : 49vDbkSo7eve3J41sBdjvjaBUyz8qHohsQcGtRf63qEUTMBvmA45fpp5pSacMdSg7A3b71RejLzB8EkGbfjp5PELVF2N4Zn
Electrum Seed Words  : tavern judge beyond bifocals deepest mural onward dummy eagle diode gained vacation rally cause firm idled jerseys moat vigilant upload bobsled jobs cunning doing jobs

Here is an update concerning Trezor Model T Monero capabilities:

When contrasted to the Ledger Nano S and Nano X, the Trezor Model T uses a different HD path and replaces the secp256k1 elliptic curve with the ed25519 elliptic curve when computing a seed for the m/44'/128'/a' HD wallet path, see https://github.com/trezor/trezor-core/tree/master/docs/coins#list-of-used-derivation-paths.

The default primary address a Model T uses follows a different path and complies with SLIP-10 and the application of the ed25519 curve (not the secp256k1 curve) when computing HD keys. This creates an BIP 39 seed word wallet restoration interoperability issue between Ledger and Trezor hardware devices:

% trezorctl monero-get-address -n "m/44'/128'/0'"

44jKQv6ZKMd5ecLLmkNJGi7azgSptEq8ki7TFiat1TfLfdDQ1tQ7ZYa3cRh7X2uRwvLDjddWh97ajeyhR2seKSECQeDx1WR

The trezorctl Python command above queried a Model T, previously configured with the "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about" seed words, for its root level Monero address of account number 0.

Since libbitcoin's bx command is not currently SLIP-10 enabled to directly support the ed25519 elliptic curve (bx only implicitly supports the secp256k1 elliptic curve), custom code needed to be developed to mimic SLIP 10 ed25519 behaviors. The following independently developed code of piped command lines generates the same result as Trezor hardware wallets.

% echo "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about" | bx mnemonic-to-seed -p "" | ./slip10 --ed25519 | ./slip10 -i 44 | ./slip10 -i 128 | ./slip10 -i 0 | xmr

    Seed                 : 98f0cdd5993ce34eb46b57c1fa6399f6643516416fae089d74ecfd0c389a6bd8
    Private Spend Key    : 8f2d521d4334f4d5d174c47aacb346e7633516416fae089d74ecfd0c389a6b08
    Private View Key     : 84b0087a63854856686f80596a5a1a6090795b4d1311139173262170d7e7180f
    Public Spend Key     : 51fd81faa5e2641bca8a5c43d764ab276033c12b459fd9f5c9c23b7733af67e6
    Public View Key      : eb8855fd7d21670f9bdfc0cdcfa54172e80322c4eaee5ce30d85cb9ec90d21d1
    Monero Address       : 44jKQv6ZKMd5ecLLmkNJGi7azgSptEq8ki7TFiat1TfLfdDQ1tQ7ZYa3cRh7X2uRwvLDjddWh97ajeyhR2seKSECQeDx1WR
    Electrum Seed Words  : symptoms ugly ablaze anchor roster neon feel gemstone spud plywood extra daft alchemy apart fowls dexterity puck films liquid vigilant yesterday people awful blender plywood

The SLIP 10 path above is applied to generate a Monero seed that then must be little-endian normalized/reduced to ed25519's curve order 1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED using Monero's sc_reduce32() function to produce a private key.

% echo 98f0cdd5993ce34eb46b57c1fa6399f6643516416fae089d74ecfd0c389a6bd8 | sc_reduce32 8f2d521d4334f4d5d174c47aacb346e7633516416fae089d74ecfd0c389a6b08

Eventually there will be independent bx open source code made available to implement implement SLIP 10's ed25519 behaviors that Satoshi Labs defined openly.

5
  • Will see if I get my 300 points back for the bounty that was never answered by anybody else.
    – skaht
    Feb 26, 2019 at 3:13
  • Hey @skaht great post. Quick question does this work on Monerujo despite the fact the readme doesn’t match? Or you think it’s fundamentally broken?
    – Woodstock
    Mar 6, 2019 at 8:02
  • It is easy to validate the conversion process works for one's self. Just confirm the a software wallets's 4-address produced from the Electrum seed words matches that produced by your Ledger Nano S. I would not use xmr.llcoins.net for personal use for security reasons, but it maps to this address 49vDbkSo7eve3J41sBdjvjaBUyz8qHohsQcGtRf63qEUTMBvmA45fpp5pSacMdSg7A3b71RejLzB8EkGbfjp5PELVF2N4Zn. Spend the time yourself, and load a Nano S with the Test Vector BIP39 seed words above and see if the the address produced matches.
    – skaht
    Mar 6, 2019 at 17:39
  • thanks bro - yup just don't wanna have to reset my ledger again...
    – Woodstock
    Mar 7, 2019 at 11:20
  • % echo -n 00000000000000000000000000000000 | bx mnemonic-new abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about
    – skaht
    Feb 10, 2020 at 23:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.