5

Monero seed phrases use 25 words, while Trezor Model T seed phrases have only 12 words. If you generate a Monero wallet using the Trezor, does that mean you're not getting a sufficiently strong private key?

(Monero draws its wordlist from 1626 possibilities instead of Trezor's 2048, but Monero's seed still has 10^40 times the number of combinations as Trezor's).

Improve this question
2
  • See Plan B if you really want to understand the nutz and boltz for for what Trezor and Ledger devices are really doing. BIP 39 seed words are not interoperable between both device vendors.
    – skaht
    May 24, 2020 at 4:40
  • Note how 12 BIP 39 seed words map to 25 Electrum Seed words used by Monero in the examples at the bottom.
    – skaht
    May 24, 2020 at 4:53

2 Answers 2

Reset to default
4

A Monero private key is any 256 bit number mod l and the seed phrase is deterministically derived from this private key. 24 words (the 25th is a checksum), from the dictionary in Monero, gives enough bits (257) to encode/decode from the 253 bit random private key.

As noted, the Trezor Model T uses a 12 word phrase with a dictionary which is only good enough for 128 bits (plus a checksum). This essentially limits the possible range of private keys.

Longer bit ranges are of course more desirable.

It's worth pointing out that both Trezor devices can be initialized with longer phrases [source]:

Note For advanced users: It is possible to generate 12, 18 or 24-word seeds on both Trezor devices. If you want to generate recovery seed with different length than default (e.g., 24 words on Trezor Model T), please see initialize device with trezorctl command.

Generating 24 words will give enough range to cover all possible Monero private keys.

Improve this answer
7
  • However, 12 words chosen from a 2048 wordlist -- the default for Trezor Model T -- cannot uniquely encode a 256-bit number. 2^256 is vastly bigger than 2048^12 (and it's actually more like 2048^11 because of the checksum). So your statement that the 256-bit private key is generated first and then the mnemonic seed is simply an encoding of the private key cannot possibly be true.
    – puzzler
    Sep 5, 2019 at 21:50
  • 1
    The explanation I've always read is that 12 words is sufficient because in bitcoin, a 256-bit key actually only has 128 bits of security due to the complexity of breaking the discrete log problem. So you really only need a seed sufficiently long to generate 2^128 options, and then compute a private key off of that, and you're getting approximately the same level of security as bitcoin. But it's not clear to me whether the same argument holds for monero, since the designers of monero clearly decided to opt for a seed that could encode 256 bits worth of information.
    – puzzler
    Sep 5, 2019 at 21:53
  • Please do the math: 2^256 is approx 10^77, while 2048^12 is under 10^40. It's simply not possible to encode 256 bits as 12 words from a list of 2048 possibilities.
    – puzzler
    Sep 5, 2019 at 22:30
  • That may be how monero works; monero may be a direct encoding of a 256-bit private key. But that's not how bitcoin's BIP 39 spec works, which is what Trezor uses: github.com/bitcoin/bips/blob/master/bip-0039.mediawiki BIP 39 starts by generating a mnemonic with 128 bits of entropy and then computing private key from that. And that's my whole point.
    – puzzler
    Sep 5, 2019 at 22:33
  • "A bitcoin private key is 256 bits, not 128." <- Yes, but it takes approx 2^128 operations to compute a bitcoin private key from its public key since there is an O(sqrt(N)) alg for solving discrete log problem. So bitcoin community decided a private key with 128-bits of entropy is sufficient, because trying mnemonics at random and computing the private keys from that would take about the same amount of time as computing the private key from the public key.
    – puzzler
    Sep 5, 2019 at 22:40
0

Trezor's 12 seed word is still insanely secure. With 5,444,517,870,735,015,415,413,993,718,908,291,383,296 possible combinations, nobody is ever going to try and bruteforce a private key.

(Even if they wanted to, they'd have to sync it to the blockchain. Yuck!)

Improve this answer
1
  • 3 BIP 39 seed words provides % echo "2^32" | bc 4,294,967,296 combinations for a root seed. 12 BIP 39 seed words provides % echo "4294967296^4" | bc 340,282,366,920,938,463,463,374,607,431,768,211,456 combinations for a root seed or 39 base10 digits of significance. 24 BIP 39 seed words provides % echo "4294967296^8" | bc 115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,936 for a root seed or 78 base 10 digits of significance.
    – skaht
    May 24, 2020 at 4:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.