I figure that a portion of the random space has to be sacrificed for including an additional passphrase chosen by the user.
How much lower is the random space and does the length of the passphrase affect how much randomness is lost?
All the "seed offset password" does is modify the existing key before getting the seed words. It works as follows:
seed_words = get_words(sc_add(key, cn_slow_hash(password)))
Where sc_add is scalar addition modulo the curve order.
Therefore:
I figure that a portion of the random space has to be sacrificed for including an additional passphrase chosen by the user.
Is incorrect. Nothing is "sacrificed". The seed password does not affect the randomness of the key generation, it only modifies the key when used to get the seed words.
In effect, what this means is, you need both the password and the seed words (as obtained above), to get the actual key.
For example:
key = sc_sub(get_key(seed_words), cn_slow_hash(password))
Where sc_sub is scalar subtraction modulo the curve order.
-
Ah, so length of the initial password is also irrelevant (as far as the calculation is concerned). Thank you! – fullmetalScience Jun 10 '19 at 7:27
-
Password strength is still important wrt someone being able to brute force it of course. – jtgrassie♦ Jun 10 '19 at 12:32
