With Monero firmware loaded on a Trezor, how does one create private spend keys from the BIP 39 seed words supplied during a Trezor's configuration?

Question

I’ve experimented with Monero’s V0313 experimental firmware that is installed on a traditionally hierarchical deterministic Trezor hardware device, which is also immune to key loggers and the CSRF vulnerability.

For future proof contingency planning purposes, if I could reconstitute traditional *.keys files outside the Trezor, I could sleep a little better. (When a Trezor device is not used, *.keys files exist for each Monero wallet. When a Trezor device is used, private spend keys are vaulted inside Trezor, and thus there is no need for *.keys files.) I’ve already successfully tested recovering a Trezor from BIP 39 seed words using this procedure. But with experimental firmware, that is not enough assurance to satisfy me.

If I knew how V0313 Monero firmware creates a private spend key inside a Trezor device from the 24 BIP 39 seed words provided to a end user during the configuration of a Trezor, I will be able to reconstitute a Monero wallet using traditional Monero key recovery mechanism that uses Electrum seed words, i.e. --restore-determinstic-wallet.

It is also unclear what branch/tag configuration was used to compile the V0313 Monero firmware, evidence from mytrezor is pointing towards a fork of trezor-mcu v1.3.4.

From experimentation, I’m 100% certain that the integer argument supplied to a forked V0313 simple wallet code via the --hardware-wallet argument changes the private spend key. Similarly, providing an arbitrary password beyond a numerical PIN to establish a Trezor session also changes the effective spend key. Hence, the 24 BIP 39 seed words, the --hardware-wallet integer, and the unlocking wallet password all impact the binary representation of a private Monero spend key supported by V0313 Trezor firmware.

The question posed in the title up top is also very important for multi-cryptocurrency wallet developers to know how to develop wallets supporting BIP 39 seed word portability across different implementations. Also, requiring end users to record Electrum seed words for Cryptonote currencies, and a separate BIP 39 word for other altcoins is very undesirable. If multi-currency wallets only have end users record BIP 39 words, it simplifies life for those end users.

There needs to be a Monero Improvement Proposal (MIP) documenting the degree of private key interoperability Monero has with BIP 32/39/44 technologies. Granted, from a HD m/44/128/0 private key, the means to establish a corresponding Monero M/44/128/0 public address key is quite a different beast and BIP 32 technology that can't be applied to derive M/44/128/0. Additionally, associated view keys that can be made deterministic.

Can anyone knowledgeable answer the question posed in the title up top? It is a first step towards developing a MIP and extending BIP 44 to calculate private spend keys.

The answer to this question will require a Monero subject matter expert. If someone tells me that Monero Trezor functionality does not use BIP 39 words, I will puke all over their ignorance!

Harmonization of Electrum seed words and BIP 39 seed words is possible with the application of socialized best practices if one opens their mind a bit... No changes are required on the behalf of how Monero uses Electrum words and no changes are required Bitcoin, and numerous other altcoins.

Answer 1

The initial answer below, doing things the Monero way, originated from How does one convert the Trezor seed to a simplewallet seed and vice versa. I followed this URL's recommendations using the associated V0313 binaries, but was unable to recreate the same Monero address that my Trezor is using for a given prompted "password" and an integer "index" passed via the --hardware-wallet argument index:addr_version that is supplied to the forked V0313 simplewallet.

Here is an example of results for using the V0313 trezorctl with mnemonics_recover assuming a Trezor during its configuration (using the V0313 firmware) resulted in these 24 BIP 39 seed words: honey naive mouse rubber runway fetch rifle enhance unfair undo hood sister dog armed exhibit interest public rib tourist camera mistake claim flat wing. The index passed to simplwallet was 0 and the password promted by simplewallet is Bad_PASSword.

% ./trezorctl recover_mnemonic 0 Bad_PASSword English honey naive mouse rubber runway fetch rifle enhance unfair undo hood sister dog armed exhibit interest public rib tourist camera mistake claim flat wing

Private key: 7e22a1f766b70f10e88364ac833d8622cebee457eba9f1f4b9826bfe728d1e05
Wallet address: 48iYq4jBs6BZEzGXJZcWC8C85aA3pHSYhF7JE2Dg3iD6Hdd56NVTcfygghHqw66DvAKohATR4DMQsPBtgeQxU3Lp59pwkt8
Mnemonic: agnostic ignore heels update syndrome ultimate vaults tufts mugged picked rudely trash lukewarm enlist observant later suddenly shuffled gleeful stellar soya tudor habitat hire lukewarm

It is worth noting the Private key, Wallet address, and Mnemonic computed above all correlate with results from https://xmr.llcoins.net/ Javascript, which can be confirmed offline. Those using the Monero firmware, might want to independently validate the v0313 trezorctl recover_mnemonic is working properly for them.

More importantly, one can positively confirm they recorded the proper BIP 39 seed words displayed by their Trezor device if they use libbitcoin's bitcoin-explorer (bx) command, which has an extremely good track record for recreating Trezor device results with a relatively simple command line interface. Of course one must use the 24 words that is applicable to their Trezor and not the ones demonstrated below and their appropriate password. Other than that the arguments to the piped processes below remain the same.

% echo "honey naive mouse rubber runway fetch rifle enhance unfair undo hood sister dog armed exhibit interest public rib tourist camera mistake claim flat wing" | bx mnemonic-to-seed -p Bad_PASSword | bx hd-new | bx hd-private -d -i 44 | bx hd-private -d -i 0 | bx hd-public -d -i 0

xpub6C9uhLie5mr2TJ8z27sARKZQf5AL8EA5U5S5NjtjC9sYx1fW6hXC8FZxLRqoBZtk35mC5GCyffx3BKAiv9GwP9utEEtfN5VTw31fYyFfrBD

If the extended public key produced immediately above matches the one available when one digs through https://wallet.mytrezor.com/#/ with their Trezor, then one most definitely recorded the BIP 39 seed words properly. With the computed Monero address not matching, and the application of bx to properly compute the extended account public key convinced me the trezorctl recover_mnemonics capability is not functioning properly for V0313.

Suggested behavioral improvements for "trezorctl mnemonics_recover" capability:

Below is a candidate test vector recommendation that also uses libbitcoin. Applying bx to the trezorctl command example above, here is how a future release could work and be consistent with BIPs 32, and 39, and BIP 44 coin registrations to the maximum extent possible for synthesizing the private spend key. The 44 integer below indicates BIP 44 is to be used. The 128 indicates Monero is to be used, see the BIP 44 coin registration table.

% echo "honey naive mouse rubber runway fetch rifle enhance unfair undo hood sister dog armed exhibit interest public rib tourist camera mistake claim flat wing" | bx mnemonic-to-seed -p Bad_PASSword | bx hd-new | bx hd-private -d -i 44 | bx hd-private -d -i 128 | bx hd-private -d -i 0 | bx hd-to-ec

4a06027938fbe584f0c7fad131cdae14c737e53f6f3e9bdec2b382698b384fac

The following produces the Monero private spend key:

% ./sc_reduce32 4a06027938fbe584f0c7fad131cdae14c737e53f6f3e9bdec2b382698b384fac

08bf67d7301c2e1491a74e747f0af943c637e53f6f3e9bdec2b382698b384f0c

The following produces the Electrum seed words used for wallet/(private spend key) recovery:

% ./bytes_to_words 08bf67d7301c2e1491a74e747f0af943c637e53f6f3e9bdec2b382698b384f0c

ascend wedge sorry fiat gone isolated rowboat skydive educated regular amaze fossil heels tagged awakened gables upload sipped lynx anvil kickoff basin does enigma educated

Then using https://xmr.llcoins.net/addresstests.html, the following Monero address results:

4Ak341HR2HnYPgocscZYAaMByPa7rHCj1EhbyCQjLvyWQkcNTG2zbbB1h8iB5sbcDYjUNobgGJn4fjgqMfeYQfEaS6w8HHL

This test vector approach succintly demonstrates how Monero harmonization with BIPs 32/39/44 is possible and desired. This mindset also leaves open the concept of applying BIP 38 to Monero's deterministic private spend keys.

Update: Created an executable called ./xmr that takes a private secp256k1 key. Results below match results above.

% echo "honey naive mouse rubber runway fetch rifle enhance unfair undo hood sister dog armed exhibit interest public rib tourist camera mistake claim flat wing" | bx mnemonic-to-seed -p Bad_PASSword | bx hd-new | bx hd-private -d -i 44 | bx hd-private -d -i 128 | bx hd-private -d -i 0 | bx hd-to-ec | ./xmr

   Private Spend Key    : 08bf67d7301c2e1491a74e747f0af943c637e53f6f3e9bdec2b382698b384f0c
   Private View Key     : ec69371cc4f7176b3eddb69a1eca4a775909d73b68021aaf5f173eac9d8fd706
   Public Spend Key     : f0a59fa7ee5e71bbace5a9f6a4bdb778b404d54406ffa051e841710e9642f98e
   Public View Key      : 00d7d42cee66de04230aa498f3efb3fdec69c69beceea0ff352775998ad293de
   Monero Address       : 4Ak341HR2HnYPgocscZYAaMByPa7rHCj1EhbyCQjLvyWQkcNTG2zbbB1h8iB5sbcDYjUNobgGJn4fjgqMfeYQfEaS6w8HHL
   Electrum Seed Words  : ascend wedge sorry fiat gone isolated rowboat skydive educated regular amaze fossil heels tagged awakened gables upload sipped lynx anvil kickoff basin does enigma educated

Cheers...