2

Monero seed phrases use 25 words, while Trezor Model T seed phrases have only 12 words. If you generate a Monero wallet using the Trezor, does that mean you're not getting a sufficiently strong private key?

(Monero draws its wordlist from 1626 possibilities instead of Trezor's 2048, but Monero's seed still has 10^40 times the number of combinations as Trezor's).

4

A Monero private key is any 256 bit number mod l and the seed phrase is deterministically derived from this private key. 24 words (the 25th is a checksum), from the dictionary in Monero, gives enough bits (257) to encode/decode from the 253 bit random private key.

As noted, the Trezor Model T uses a 12 word phrase with a dictionary which is only good enough for 128 bits (plus a checksum). This essentially limits the possible range of private keys.

Longer bit ranges are of course more desirable.

It's worth pointing out that both Trezor devices can be initialized with longer phrases [source]:

Note For advanced users: It is possible to generate 12, 18 or 24-word seeds on both Trezor devices. If you want to generate recovery seed with different length than default (e.g., 24 words on Trezor Model T), please see initialize device with trezorctl command.

Generating 24 words will give enough range to cover all possible Monero private keys.

  • However, 12 words chosen from a 2048 wordlist -- the default for Trezor Model T -- cannot uniquely encode a 256-bit number. 2^256 is vastly bigger than 2048^12 (and it's actually more like 2048^11 because of the checksum). So your statement that the 256-bit private key is generated first and then the mnemonic seed is simply an encoding of the private key cannot possibly be true. – puzzler Sep 5 at 21:50
  • The explanation I've always read is that 12 words is sufficient because in bitcoin, a 256-bit key actually only has 128 bits of security due to the complexity of breaking the discrete log problem. So you really only need a seed sufficiently long to generate 2^128 options, and then compute a private key off of that, and you're getting approximately the same level of security as bitcoin. But it's not clear to me whether the same argument holds for monero, since the designers of monero clearly decided to opt for a seed that could encode 256 bits worth of information. – puzzler Sep 5 at 21:53
  • Please do the math: 2^256 is approx 10^77, while 2048^12 is under 10^40. It's simply not possible to encode 256 bits as 12 words from a list of 2048 possibilities. – puzzler Sep 5 at 22:30
  • That may be how monero works; monero may be a direct encoding of a 256-bit private key. But that's not how bitcoin's BIP 39 spec works, which is what Trezor uses: github.com/bitcoin/bips/blob/master/bip-0039.mediawiki BIP 39 starts by generating a mnemonic with 128 bits of entropy and then computing private key from that. And that's my whole point. – puzzler Sep 5 at 22:33
  • "A bitcoin private key is 256 bits, not 128." <- Yes, but it takes approx 2^128 operations to compute a bitcoin private key from its public key since there is an O(sqrt(N)) alg for solving discrete log problem. So bitcoin community decided a private key with 128-bits of entropy is sufficient, because trying mnemonics at random and computing the private keys from that would take about the same amount of time as computing the private key from the public key. – puzzler Sep 5 at 22:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.