6

Apparently, ECC 256 bit keys have a bit strength of 128 bits. See https://crypto.stackexchange.com/questions/26791/how-many-bits-of-entropy-does-an-elliptic-curve-key-of-length-n-provide

And apparently, no one needs more than 128 bits of entropy https://security.stackexchange.com/questions/102157/do-you-need-more-then-128bit-entropy

So if I'm correct in saying that it's pointless for the private spend key to be derived from a seed with more than 128 bits of entropy, and given that it is currently the case that the private view key is derived from a hash of the private spend key, why does Monero use a 256 bit seed?

Perhaps the 'multi-target attack' mentioned here is relevant? https://crypto.stackexchange.com/questions/39991/can-i-use-128-bits-of-entropy-and-a-kdf-to-make-a-256-bit-ecc-key

Update: Multi-target attacks do not appear to be an issue. See https://crypto.stackexchange.com/questions/56541/is-it-safe-to-generate-two-256-bit-ecc-keys-from-128-bits-of-entropy

Update 2: It looks like BIP32 actually recommends that 256 bits of entropy are used to generate a Bitcoin wallet. See https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Master_key_generation

This means that the 13 word, 128 bit seeds used in many Bitcoin wallets actually go against the recommendation in BIP32.

Therefore Monero is actually following the recommendations of BIP32 by using 256 bits of entropy via a 25 word seed.

Perhaps the real question should therefore be: Why do Bitcoin HD wallets use only 128 bit seeds, and ignore the BIP32 recommendation? I've asked that question here: https://bitcoin.stackexchange.com/questions/72612/bip32-recommends-a-256-bit-seed-why-do-most-bitcoin-wallets-only-use-a-128-bit

  • 1
    Well, there's the 128-bit mymonero version, too :) – JollyMort Mar 16 '18 at 16:53
  • 1
    I've posted here too: crypto.stackexchange.com/questions/56541/… – knaccc Mar 16 '18 at 17:11
  • 1
    In Monero the private spend key is the seed. To give the private spend key (aka seed) 128 bits of entropy, wouldn't this require it to be of 256 bits of length? Further more, you technically can have a random private view key. The derivation from private spend key to private view key is only to make a wallet deterministic AFAIK. – Maxithi Mar 16 '18 at 18:18
  • 2
    @Maxithi Yes, but if the seed could be 128 bits and then the private spend key derived from those 128 bits without any downside, this would mean the wallet mnemonic could be much shorter. – knaccc Mar 16 '18 at 18:52
1

BIP32 recommends that 256 bits of entropy are used to generate a Bitcoin wallet. See https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Master_key_generation

This means that the 13 word, 128 bit seeds used in many Bitcoin wallets actually go against the recommendation in BIP32.

Monero is following the recommendations of BIP32 by using 256 bits of entropy via a 25 word seed.

I asked the author of BIP32, Pieter Wuille, why 256 bits were recommended instead of 128. He responded in the comments here: https://bitcoin.stackexchange.com/questions/72612/bip32-recommends-a-256-bit-seed-why-do-most-bitcoin-wallets-only-use-a-128-bit

He said:

Well, being able to break an EC key with just 2^128 steps is somewhat theoretical. In practice, these algorithms have significant memory/cpu tradeoffs, and in practice would still be much slower than a straight 2^128 exhaustive search on keys with just 128 bits of entropy. I guess the answer is defense in depth: less than 128 bits of entropy definitely hurts security. Less than 256 bits may hurt.

We therefore have an answer. 256 bits gives us defense in depth, in case the theoretical 2^128 step attack is not as practical as expected.

0

If you can create a bidirectional lossless transformation between a 128 bit number and a 256 bit secret key, then this could be used to create a mnemonic seed. I am aware of no such bidirectional lossless transformation. That lack of knowledge of a solution explains why Monero does not have one.

  • 1
    You make an interesting point about bidirectionality. However, I'm not sure how useful it would be to be able to recover the seed from the user's private spend key. After all, bidirectionality did not seem to be an important factor when designing BIP 32 github.com/bitcoin/bips/blob/master/… especially when taking into consideration the inconvenience of having a 25 word seed over a 13 word seed. – knaccc Mar 17 '18 at 10:47
  • 1
    Bidirectionality is needed with the seeds. You could however design a new seed type where you generate the seed, then the secret key, rather than the current system where the seed IS the secret key. – user36303 Mar 18 '18 at 0:06
  • 1
    I appreciate your answer submission, but I'm not sure it answers the question of why Monero would use a 256 bit mnemonic directly as the private spend key, when it could have used 128 bits like BIP32 does. – knaccc Mar 18 '18 at 12:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.