4

I remember reading somewhere, I think it was fluffypony mentioning one could use for example words from a letter to a loved one seed for a Monero wallet. But from playing with https://xmr.llcoins.net/addresstests.html I realized that it is not possible to enter just any text in the mnemonic seed; it just doesn't accept improperly formed mnemonics, apparently. And even if I had 24 words chosen from the official word list, I would still not know what checksum word to add at the end... (I haven't tried generating a brain wallet in monero-wallet-cli yet, but if there is a way, please let me know.) Is there a way to create one's own mnemonic?

On the other hand, I am assuming that the hexadecimal field does accept anything, since it is the private spend key. So maybe the way to go would be to choose one's own preferred passphrase, take SHA256 of the passphrase and enter it in field 2. Is that how it should be done?

Obviously, one should be very careful choosing such a passphrase, but I am thinking that brain wallets in Monero shouldn't be as dangerous as in Bitcoin simply due to the inherent time consuming operation of scanning the blockchain and trying to decode every single output for the corresponding stealth address. I am guessing that a decent computer should take at least a few seconds for each brain wallet, so that compiling a huge list of brain wallets and monitoring them is unfeasible. Is this understanding correct?

Improve this question
10
  • 1
    If they know your address, they can check the brain wallet quite quickly. Most setups don't think about address security, since it's meant to be public.
    – PyRulez
    Oct 3, 2016 at 1:12
  • Also see monero.stackexchange.com/q/1519/255
    – PyRulez
    Oct 3, 2016 at 1:13
  • 1
    @PyRulez: I think I finally got your point: if you already know the target address, then indeed it is easy to check if your guess is the correct private key.// But other than that, the main problem with brain wallets, in Bitcoin at least, was the possibility of populating a huge hash table with a lot of addresses corresponding to relatively simple brain wallets, and just checking it for every new transaction. I think that that kind of attack is over with Monero.
    – user141
    Oct 3, 2016 at 14:24
  • 1
    llcoins.net and pages there.
    – Luigi
    Oct 3, 2016 at 18:56
  • 1
    I made a command-line utility, written in php that understands monero mnemonics in multiple languages. These language wordsets are pluggable, so it would be simple to create your own wordset and then generate a mnemonic from it. Of course, you would need to use the same wordset when later decoding the mnemonic to retrieve your wallet seed. I do not encourage actually doing this, but it is possible...
    – danda
    Nov 1, 2019 at 23:13

2 Answers 2

Reset to default
5

A brain wallet should always be created offline, preferably on a computer that will never touch the Internet once you decide to use it for a key generator. Make sure any JavaScripts you are using can be initiated offline.

Agree that there is a huge computing penalty for having to scan a blockchain for a given viewkey to identify associated stealth transaction deposits. A full refresh for a new wallet takes on the order of minutes on my computer with the current Monero Blockchain size.

Here is a quick example of using text commands to create a brain wallet:

% echo "Brain farts really hurt this miser" | bx base16-encode | bx sha256 e812ff8072348464b3fe59f0324076bc9b1be3afb233d52303b04f19120389e3

% ./sc_reduce32 e812ff8072348464b3fe59f0324076bc9b1be3afb233d52303b04f19120389e3 f27b8d6b01c98293fa6acf06069644989a1be3afb233d52303b04f1912038903

% ./bytes_to_words f27b8d6b01c98293fa6acf06069644989a1be3afb233d52303b04f1912038903 etched segments dash puck rural furnished mice sapling sifting dime jigsaw alpine malady pebbles germs fleet puddle swagger azure react sovereign much worry zebra pebbles

With either the normalized private spend key (after the sc_reduce32 completes) or the Electrum words you have the information to synthesize the following Monero address:

44yo6exuJXtfmGzabRub8w6JkEcY6BjVEUkBmgheV5fEChMb5BD7HUWUPjuKVJ4C2Y11tf9y6DCJo2uAHts6E4EzJZX23fa

FYSA - The sc_reduce32 command was created from a Monero function called sc_reduce32(). Similarly, the bytes_to_words command was created from a function called bytes_to_words().

Improve this answer
13
  • 1
    Curious why you bother to base16-encode before sha256 hashing?
    – binaryFate
    Oct 3, 2016 at 11:25
  • @skaht: I was just going ask why entering "Brain farts really hurt this miser" in an online SHA calculator gives a different result, but I think binaryFate might have just answered that; and now I second his question.// Other than that, this method seems to be what I suggested in the second paragraph of OP. Is that correct?
    – user141
    Oct 3, 2016 at 13:51
  • @skaht: I am sorry, but I feel more lost now: Are you saying that encoding base-16 is important, or optional? What is the advantage of appending 0a at the end of the hash? What makes it a digitally signed hash, and what key is doing the signing? Is this better for security?
    – user141
    Oct 4, 2016 at 0:05
  • @user141: Sorry for the confusion. The bitcoin explorer (bx) base16-encode command converts an ASCII string into a hexadecimal string that bx sha256 command can use. The "0a" that was tucked on after the base16 conversion was really an artifact of the echo command, not bx. This example illustration should make the point very clear % bx base16-encode "abc" result is 616263 while % echo "abc" | bx base16-encode result is 6162630a.
    – skaht
    Oct 4, 2016 at 1:14
  • @user141: If the bx sha256 command accepts a hexadecimal number and the bx base16-encode command can convert a binary file to hexadecimal, then the sha256 hash operation can operate on a binary file - not just a text file. Anyhow, I'll redo the example to get rid of the confusion within the comments.
    – skaht
    Oct 4, 2016 at 1:42
2

I remember reading somewhere, I think it was fluffypony mentioning one could use for example words from a letter to a loved one seed for a Monero wallet. But from playing with https://xmr.llcoins.net/addresstests.html I realized that it is not possible to enter just any text in the mnemonic seed;

I dont know what exactly he mentioned but I'd guess he meant hiding the mnemonic words into a poem created for the sole purpose of it, or something along those lines. Only words of the dictionary can be used, and you can see which those are if you look at the code here. There are exactly 1626 words. I wouldn't consider this approach safe because if anyone assumed you did hide some 25 words in a poem, he could compare the poem against the dictionary and isolate the words that belong to both the poem and the mnemonic dictionary. Then, he'd have a lot less guesswork to do in order to try and brute-force the correct mnemonic.

Regarding the second part of your question, I'd strongly advise against generating a seed by any other means than a good random number generator (even by rolling physical dice, for the extra paranoid - you need 100 rolls to get the 256bits of entropy). Our brain is horrible at producing true randomness, and hashing a passphrase has reduced entropy. If someone knew the scheme, he doesn't have to try and guess all possible seeds but can limit his guesses to only those that are the result of hashing a passphrase. This is exactly how many people lost bitcoins, by using weak passphrases for brain wallets.

IMO, the best way would be to just generate it randomly by using moneroaddress.org on an offline computer, and then remember the 25 words generated, or think of a good way to hide them.

While it is true that checking for balance takes a while, the point made by PyRulez is an important one. If someone knows your address, he doesn't need to scan the blockchain anymore to verify that he made a correct guess. But yes, just taking random guesses to try and find any address with a balance to loot, is way more expensive to do with monero than with bitcoin.

Edit: We could say that generating some long enough text with some personal info and then hashing it would be safe enough. Like "I bought my first yacht with Monero. It's 1983m long." where 1983 could be your birth year or something. That's 53 chars and probably not brute-forceable, but now that I've published this idea, anyone could try some number of variations of it for and see if he gets lucky.

Improve this answer
12
  • Trying to memorize 25 words is asking to lose your coins IMO. The point of a brain wallet is taking something you can remember and producing a wallet from it. IIRC, the main problem with Bitcoin's brain wallets were the dragnet kind of attacks, in which someone would compile a very comprehensive list of simple brain wallets and just wait for someone to send money to it. If your brain wallet were relatively simple, but contained just a piece or more personal information, like your email, then it would be immune to such an attack, and would require instead that you'd be specifically targeted.
    – user141
    Oct 3, 2016 at 14:10
  • @user141 what your talking about is a salt, essentially.
    – PyRulez
    Oct 3, 2016 at 14:22
  • 1
    Those are good points. Memorizing 25 words isn't easy, but with some practice and discipline it could be done. But yeah, you could write some text made up of few words which you'll easily remember, use capitalization and punctuation, add a little salt like your first phone number, e-mail or something and there you go. It's probably good enough, and for sure significantly less risky than in bitcoin. I'd still keep a physical backup somewhere safe.
    – JollyMort
    Oct 3, 2016 at 15:20
  • 2
    @TFI_Charmers The thing to keep in mind is that you might be likely to store your address somewhere. If the attacker can get that, he only needs to brute force that (then scan the chain after finding it). Brute-forcing the order of 24 words is a bit outside of current common resources, about 2^79 operations.
    – Luigi
    Oct 12, 2016 at 21:52
  • 1
    From where did you conclude that? Monero address usually have a little less than 256-bits of entropy, meaning 2^256 guesses vs. the number of permutations of 24 words (24! approx. = 2^79). I think the point made was, that if you have the unordered 24 words AND the address, you don't have to scan the blockchain. You'd just try the combinations until your resultant address matches the one you know to be the one with a balance.
    – JollyMort
    Oct 13, 2016 at 10:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.