1

I am looking at Luigi's code here. When it comes to encrypting the seed, field 9 on xmr.llcoins.net, there is a comment about various ways that have been implemented for doing this. It mentions the use of Keccak at some point, and then 'CN XOR' and 'CN add'. Which one is the method currently being used in the reference wallet?

Also, contrary to the functions used to deriving the seed and checksum, the code for the slow-hash and slow-hash-worker are quite undecipherable to me (assuming I am looking at the right code).

Could someone help me to understand what is going on and to translate that into python code?

Improve this question
5
  • 1
    github.com/monero-ecosystem/monero-python/blob/master/monero/… monero-python.readthedocs.io/en/latest/seed.html
    – knaccc
    Feb 20, 2022 at 11:43
  • @knaccc It doesn't seem like the links you provided go into encrypting and decrypting a seed with an offset, that is what I am looking for. If that has not been done in python yet, could you help me navigate the reference client c++ code to find and translate those methods?
    – user141
    Feb 21, 2022 at 3:21
  • 1
    @user141 that shows you how to encode/decode from seed words. Encryption/decryption with a seed offset passphrase is done per my answer below. To do this in python you need at least an implementation (or binding) of cn_slow_hash. There's a pure python version at github.com/monero-ecosystem/slow-hash but you're probably safer using one of the many bindings instead. You also need scalar addition/subtractiion from a ed25515 library/module.
    – jtgrassie ♦
    Feb 21, 2022 at 18:58
  • @jtgrassie Thanks, that is very helpful. It says in the python implementation docstring that the python version computes approximately 2 hashes per minute. For comparison, what is the rate of the c++ implementation?
    – user141
    Feb 21, 2022 at 23:06
  • @user141 the c++ (compiled) version is significantly faster. That's not the only reason to use the c++ version, another is correctness (I have no idea if the linked pure python version is accurate).
    – jtgrassie ♦
    Feb 21, 2022 at 23:15

1 Answer 1

Reset to default
1

Which one is the method currently being used in the reference wallet?

The current reference is as follows (and what is commented as the "CN Add" method).

Once you have the seed bytes from the seed words, encryption (encrypt_key) is done by simply adding (scalar addition, sc_add) the hash of the offest passphrase, to the unencrypted seed bytes.

The hash function used is the original CryptoNight slow-hash function (variant 0, height 0).

Decryption (decrypt_key) is simply the reverse, i.e. subtraction (sc_sub) of the hash of the offset passprase from the encrypted seed bytes.

Improve this answer
4
  • For the sake of completion: I guess, for the older versions, one would XOR instead of add. And before that the Keccac hash as described in: github.com/monero-project/monero/blob/… was used (please correct me if I am linking to the wrong code). Do we have any insight about the reasons for those choices of methods?
    – user141
    Feb 21, 2022 at 23:20
  • "Do we have any insight about the reasons for those choices of methods?", yes, read the comments on the page.
    – jtgrassie ♦
    Feb 22, 2022 at 0:59
  • I have. But I wonder why choose those hash functions as opposed to, say sha256, or even nowadays randomX? Also, Luigi comments that there were some issues with using the XOR method producing malformed keys, and I would like to know how that could happen. Perhaps this should be the topic for another question.
    – user141
    Feb 24, 2022 at 3:27
  • Well the first version used keccak (which is already in the codebase, sha256 is not), so that's an easy one. Next, CN XOR, better KDF characteristics (as noted). The "not well formed" point is that the CN XOR result is not always a well formed private key. CN ADD is always a well formed key as it uses sc_add instead of xor (sc_add is scalar addition mod l). This means both the unencrypted and ecrypted keys are actual well formed keys. Why not RandomX? because it didn't exist at the time and no need to change to it now anyway.
    – jtgrassie ♦
    Feb 24, 2022 at 4:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.