2

For a Ledger Nano S recovery contingency plan, how can one compute an associated vector of 25 Electrum wallet recovery words for each primary address using BIP 44 technology that is seeded from BIP 39 using 12, 18 or 24 seed words (not to be confused with Electrum seed words), and an associated BIP 39 passphrase (not to be confused with a Monero wallet password)?

It is unclear if or how m/44'/128'/0' or m/44'/128'/0'/0/0 or some other HD wallet path(s) is/are used to synthesize a primary Monero private key and associated address.

It should be possible to calculate associated Electrum seed words for a given set of BIP 39 seed words and a specified HD wallet path. Those Electrum words could then be used by monero-wallet-cli to recover funds using --restore-deterministic-wallet, or other wallets (e.g., Monerujo, Cakewallet, X Wallet).

With a Plan B Recovery Plan, it should be possible to engender more trust in a Ledger Nano S beta Monero capabilities. The Trezor had such a Plan B recovery capability 18 months ago before the Monero Ring CT fork activated.

  • Please clarify what you mean by "Plan B Recovery Plan". – jtgrassie Jul 19 '18 at 20:43
  • Updated content above. – skaht Jul 30 '18 at 21:27
  • Looks like something is happening, see reddit.com/r/Monero/comments/95kx37/…. Would like to see the theory before having an implementation. – skaht Aug 10 '18 at 22:53
1

The original answer is found at https://github.com/LedgerHQ/ledger-app-monero/tree/master/tools/python.

For OSX hosts, to complement the ledger-app-monero documentation, the Homebrew package manager's brew command is used instead of the apt command to install two dependent packages. The ledger-app-monero application has a dependency upon the libusb and libusb-compat packages that can be installed using:

% brew install libusb libusb-compat

The Advanced Package Tool package manager's apt command is frequently used for Ubuntu and Debian hosts. Those hosts need the libusb-dev and libudev-dev packages to be installed, per ledger-app-monero documentation.

After cloning the ledger-app-monero package and satisfying documented pip3 python package dependencies, change into your local the ledger-app-monero/tools/python/src directory and execute the following:

% python3 -m ledger.monero.seedconv offline

Unfortunately, the results for the README.md 12 word test vector did not match. Here are my results that are also embedded in code here.

BIP 39 Test Vector with no passphrase: abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about

Test Vector Monero Electrum words:
tavern judge beyond bifocals deepest mural onward dummy eagle diode gained vacation rally cause firm idled jerseys moat vigilant upload bobsled jobs cunning doing jobs

Independently validated the Monero seed words synthesized using ledger/monero/seedconv.py (that was supplied with the same 24 BIP 39 seed words and a BIP 39 passphrase used to configure a Ledger Nano S) were successfully loaded into Monerujo and CakeWallet mobile wallets and the same addresses appeared in both software wallets and a Nano S.

For the same test vector above, the m/44'/128'/0'/0/0 technique shown below using bitcoin-explorer is documented further here.

% echo "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about" | bx mnemonic-to-seed -p "" | bx hd-new | bx hd-private -d -i 44 | bx hd-private -d -i 128 | bx hd-private -d -i 0 | bx hd-private -i 0 | bx hd-private -i 0 | bx hd-to-ec | ./kec256 | ./xmr

Seed                 : 907cf0eb0e0bbd761a7ed9bc8777fa5530e8262792a3e718533a1a357a1e4199
Private Spend Key    : 3b094ca7218f175e91fa2402b4ae239a2fe8262792a3e718533a1a357a1e4109
Private View Key     : 0f3fe25d0c6d4c94dde0c0bcc214b233e9c72927f813728b0f01f28f9d5e1201
Public Spend Key     : dae41d6b13568fdd71ec3d20c2f614c65fe819f36ca5da8d24df3bd89b2bad9d
Public View Key      : 865cbfab852a1d1ccdfc7328e4dac90f78fc2154257d07522e9b79e637326dfa
Monero Address       : 49vDbkSo7eve3J41sBdjvjaBUyz8qHohsQcGtRf63qEUTMBvmA45fpp5pSacMdSg7A3b71RejLzB8EkGbfjp5PELVF2N4Zn
Electrum Seed Words  : tavern judge beyond bifocals deepest mural onward dummy eagle diode gained vacation rally cause firm idled jerseys moat vigilant upload bobsled jobs cunning doing jobs

Here is an update concerning Trezor Model T Monero capabilities:

When contrasted to the Ledger Nano S and Nano X, the Trezor Model T uses a different HD path and replaces the secp256k1 elliptic curve with the ed25519 elliptic curve when computing keys for the m/44'/128'/a' HD wallet path, see https://github.com/trezor/trezor-core/tree/master/docs/coins#list-of-used-derivation-paths.

The default primary address a Model T uses follows a different path and complies with SLIP-10 and the application of the ed25519 curve (not the secp256k1 curve) when computing HD keys. This creates an interoperability issue between Ledger and Trezor hardware devices:

% trezorctl monero-get-address -n "m/44'/128'/0'"

44jKQv6ZKMd5ecLLmkNJGi7azgSptEq8ki7TFiat1TfLfdDQ1tQ7ZYa3cRh7X2uRwvLDjddWh97ajeyhR2seKSECQeDx1WR

Since the bx command is not currently SLIP-10 enabled to directly support the ed25519 elliptic curve (bx implicitly only supports the secp256k1 curve), the results below absolutely do not produce the same address as the trezorctl generated address above, which queries a Model T for its Monero address for account number 0:

% echo "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about" | bx mnemonic-to-seed -p "" | bx hd-new | bx hd-private -d -i 44 | bx hd-private -d -i 128 | bx hd-private -d -i 0 | bx hd-to-ec | ./kec256 | ./xmr

Seed                 : a004d1ed935397fb59f63108bd5195d3e9e601b02c0666a408047dd5e871518a
Private Spend Key    : 38652206c13a043ba70f75f0c7829d2ce9e601b02c0666a408047dd5e871510a
Private View Key     : 97e13e07df84cceab533df6ff1442a06387cfa115f1d71e1ffd48d878e5bf809
Public Spend Key     : a546e1213ff8adea9767b060f342d28471ff6ceee1bd3c4d903ce7229eb56fc3
Public View Key      : e592817f482199f2b34fe9fb866aac15da5b80c6187c1dfa22972e8dead920a0
Monero Address       : 47tNqJEWRkQgEqBT67RwRBP9tMLBRmmWTDyTpbW2hvoYZmSki9HwyoWhbVuBEs7VY74f14cWFELAYiqdC6stwmL3K7oFB5u
Electrum Seed Words  : tilt sizes space teeming glide nexus zoom torch speedy lettuce odometer sighting pruned nestle enlist adjust edgy tufts citadel twang revamp mural ailments asleep twang

It still needs to be explored if the Trezor Model T requires any extra 256 bit keccak hashing to be performed as do Ledger products. See https://github.com/monero-project/monero/issues/4704 for more details.

We will have to wait for the Monero or Libbitcoin community to create a Monero Plan B recovery plan to support the Trezor Model T.

  • Will see if I get my 300 points back for the bounty that was never answered by anybody else. – skaht Feb 26 at 3:13
  • Hey @skaht great post. Quick question does this work on Monerujo despite the fact the readme doesn’t match? Or you think it’s fundamentally broken? – Woodstock Mar 6 at 8:02
  • It is easy to validate the conversion process works for one's self. Just confirm the a software wallets's 4-address produced from the Electrum seed words matches that produced by your Ledger Nano S. I would not use xmr.llcoins.net for personal use for security reasons, but it maps to this address 49vDbkSo7eve3J41sBdjvjaBUyz8qHohsQcGtRf63qEUTMBvmA45fpp5pSacMdSg7A3b71RejLzB8EkGbfjp5PELVF2N4Zn. Spend the time yourself, and load a Nano S with the Test Vector BIP39 seed words above and see if the the address produced matches. – skaht Mar 6 at 17:39
  • thanks bro - yup just don't wanna have to reset my ledger again... – Woodstock Mar 7 at 11:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.