7

Monero wallet and Mymonero use different seed.

Mymonero 13 words seed and Monero wallet 25 words seed.

Does this mean Mymonero seeds are less secure?

What is the size of words set? (Is it the same for both?)

Why Monero dev did choose to use the same seed protocol than Bitcoin? (It's seems to me that monero use a different words set)

1 Answer 1

9

Yes, it's less secure because it's 128bits of entropy in the 13-word seed vs 256bits of entropy in the 25-word seed. However, it's considered safe enough as it would again take an impossible* amount of time to generate a collision.

The process for mymonero is: mnemonic -> seed -> private spend & private view keys

The process for simplewallet is: mnemonic -> seed -> private spend key -> private view key

Technical details on the implementation can be found here, at the bottom of the page.

Note that the mnemonics are not part of the protocol. They're just a way to conveniently generate the actual cryptographic keys used at the protocol level (private spend and private view key).

Considering that you can always restore a wallet from the actual keys, you are never locked into any system in particular.

And yes, it is the same wordset.

*A note regarding collisions, quoting Luigi

Note that generating random collisions of 128 bit values is well within the realm of "possible" nowadays. The key is that you're still mostly fine, as generating a collision (birthday paradox) isn't very useful for finding actual accounts with value (unless there are a "lot" of existing accounts--even then, it's very unlikely someone finds yours, just more likely they find someone's.

As far as the history of decision is concerned, here's a quote from fluffypony:

When we first decided to create a mnemonic system the spec we came up with was: take the seed from the mnemonic, hash it for the spend key, hash it twice for the view key. Somewhere during the simplewallet implementation we forgot about that, and just used the mnemonic seed as the spendkey directly.

This proved to be a blessing in disguise, though, as we'd not realized that people might want to retrieve their seed. Using our original design this wouldn't have been possible, as we didn't store the seed in the wallet file.

Much later on when we were creating MyMonero (a different group of developers, I'm the only common link between the two) we decided that a 13 word seed would be much easier for people to remember, but because we wanted it to match simplewallet's implementation we made sure that we followed the spec as it was originally.

At some point in the future we'll add support in the command-line wallet for four types of derivation and let advanced users choose derivations with a command-line switch:

short mnemonic, spendkey is seed

short mnemonic, spendkey is hashed seed (MyMonero)

long mnemonic, spendkey is seed (current simplewallet)

long mnemonic, spendkey is hashed seed

4
  • 1
    Note that generating random collisions of 128 bit values is well within the realm of "possible" nowadays. The key is that you're still mostly fine, as generating a collision (birthday paradox) isn't very useful for finding actual accounts with value (unless there are a "lot" of existing accounts--even then, it's very unlikely someone finds yours, just more likely they find someone's.
    – Luigi
    Commented Sep 30, 2016 at 22:12
  • thanx, implemented above. Maybe you could explain one thing which is bugging me - one of the options fluffy presented for wallet derivation: "short mnemonic, spendkey is seed" at the end. How could we have a short mnemonic and spendkey=seed if the short mnemonic encodes to a seed of 128bits, while the spendkey is 256bits?
    – JollyMort
    Commented Oct 1, 2016 at 2:55
  • Ah I told him that wouldn't work, at least not well. Ignore that option.
    – Luigi
    Commented Oct 3, 2016 at 17:02
  • Looking back on this, I suppose it could work if we pad the 128 bits with 0's to 256 bits. Whether that's a good idea or not, I don't know.
    – JollyMort
    Commented Dec 4, 2016 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.