(!) Armory Brain Wallet | Bitcointalksearch.org

TimS

sr. member

Activity: 250

Merit: 253

Quote from: timz on July 10, 2015, 01:01:25 PM

The main reason - Armory's master key generated by Armory's algorithm. If the algorithm will be compromised, or will be picked up initial conditions for key generating, then your coins will be at stake. In addition, I think it is not easy to find out (and remember) a phrase for existing key.
I just like idea that you may use your favorite phrase to restore wallet anywhere anytime. Just select strong passphrase. In addition you may create paper fragmented backup if you like.

1. You're underestimating the security of Armory's random number generator. The non-technical version is that computers and algorithms are actually pretty great at generating a limited number of securely random bits. For more details, read this comment in the source code (it captures a lot of info about your mouse clicks, key presses, system files, and a screenshot of your desktop for extra entropy).
2. You can generate a phrase for any given key/number following grammatical structure pretty easily, even if it might not make perfect semantic sense (but that's okay, it doesn't need to be sensical, just memorable).
3. You're overestimating the security of a person thinking up a "strong passphrase". This is what everyone in this thread has been trying to tell you. Bottom line: If your brain came up with it, it's bad! (not 100% of the time, but often enough that that's the advice I'll give you)

If you want to memorize your Armory key, what I'd recommend is making an algorithm that can convert between the easy base 16 format and a passphrase format. There should be a one-to-one-to-one correspondence between valid 128-bit keys, valid 128-bit base 16 encodings, and valid 128-bit passphrases.

timz

member

Activity: 120

Merit: 10

Quote from: Searinox on July 10, 2015, 11:15:06 AM

If you absolutely MUST use a brain wallet, why not make something that takes Armory's master key and provides multiple methods of representing it as easily memorizable words or phrases? You at least keep Armory's crypto-securely-generated master key. You don't make it any less of a risk to forget it, but it's a step up at least.

The main reason - Armory's master key generated by Armory's algorithm. If the algorithm will be compromised, or will be picked up initial conditions for key generating, then your coins will be at stake. In addition, I think it is not easy to find out (and remember) a phrase for existing key.
I just like idea that you may use your favorite phrase to restore wallet anywhere anytime. Just select strong passphrase. In addition you may create paper fragmented backup if you like.

Searinox

full member

Activity: 147

Merit: 100

Do you like fire? I'm full of it.

If you absolutely MUST use a brain wallet, why not make something that takes Armory's master key and provides multiple methods of representing it as easily memorizable words or phrases? You at least keep Armory's crypto-securely-generated master key. You don't make it any less of a risk to forget it, but it's a step up at least.

CircusPeanut

full member

Activity: 123

Merit: 100

Here's another great article on why Brain Wallets are insecure:

http://www.wired.com/2015/07/brainflayer-password-cracker-steals-bitcoins-brain/

All you really need to know is that every hacker that is attacking a bitcoin brain wallet, is attacking your bitcoin brain wallet...if you have one, so don't have one.

etotheipi

legendary

Activity: 1428

Merit: 1093

Core Armory Developer

By the way, it's fairly established that the english language has 0.8 to 1.2 bits per letter. Rather, grammatically correct, properly spelled english has appoximately one-eighth the amount of entropy as its length. So for the phrase you picked as an example has 68 letters, so between 54 and 81 bits of entropy. This is somewhat strong, but on the low-end, still brute-forceable.

Root keys should never be generated with less than 128 bits of entropy. That is both a reasonable, forever-secure value, and also the approximate protection level of a 256-bit ECDSA private key (ECDSA private keys have about half the seucirty of their length).

Even if you're holding $100, 54 bits of entropy is really quite terrible considering that an attacker can brute-force all brainwallets in the world with the same brute-force search. You can improve it with some solid passphrase stretching, but for any significant amounts of money no one should even be taking this risk.

Newar

legendary

Activity: 1358

Merit: 1001

https://gliph.me/hUF

Quote from: btchris on October 11, 2014, 11:44:40 AM

[...]
Good points. I hope you're not suggesting that you should type your brainwallet into google to check its password strength.... Wink

Lol, no.

This brings back the memories of instawallet and the way bitcoin addresses were leaked to the Google search index via Chrome. It made these addresses real easy to find.

https://bitcointalksearch.org/topic/m.1719541

btchris

hero member

Activity: 672

Merit: 504

a.k.a. gurnec on GitHub

Quote from: Newar on October 11, 2014, 09:50:58 AM

The developer of the tool writes a bit about entropy estimation in this blog post, which may be of interest to you: https://tech.dropbox.com/2012/04/zxcvbn-realistic-password-strength-estimation/ (scroll down about a third of the page)

That's a great article, thanks.

Quote from: Newar on October 11, 2014, 09:50:58 AM

Of course, anything you can find on google (using quotation marks around the search term), you don't need to bother putting it in that tool. Contrary to other "password check" tools, zxcvbn at least makes mention of that by showing "pattern: dictionary".

Good points. I hope you're not suggesting that you should type your brainwallet into google to check its password strength.... Wink

Newar

legendary

Activity: 1358

Merit: 1001

https://gliph.me/hUF

Quote from: btchris on October 10, 2014, 12:07:51 PM

I do believe that in suggesting that (or any) entropy estimation tool, you just contradicted yourself...

Entropy estimation tools such as the one mentioned can provide, at best, an upper bounds estimate, and therefore provide a false sense of security. They assume password crackers only use particular predetermined techniques when generating password guesses, however crackers are forever improving their techniques (furthermore these techniques are not necessarily public knowledge).

The developer of the tool writes a bit about entropy estimation in this blog post, which may be of interest to you: https://tech.dropbox.com/2012/04/zxcvbn-realistic-password-strength-estimation/ (scroll down about a third of the page)

Quote from: btchris on October 10, 2014, 12:07:51 PM

The (nice, thanks for that) article you pointed to exactly demonstrates this. I took the first "difficult" password mentioned in the article (which has been successfully cracked using the described techniques), and plugged it into the estimation tool, and got this:

Code:

password: Am i ever gonna see your face again?
entropy: 100.857
crack time (seconds): 1.1482519836189682e+26
crack time (display): centuries
score from 0 to 4: 4
calculation time (ms): 7

It seems awfully unlikely that the article's authors were able to crack a password with 101 bits of entropy, hence the estimate is a bad one. So, just to reiterate: estimating entropy is really hard...

Of course, anything you can find on google (using quotation marks around the search term), you don't need to bother putting it in that tool. Contrary to other "password check" tools, zxcvbn at least makes mention of that by showing "pattern: dictionary".

CircusPeanut

full member

Activity: 123

Merit: 100

Quote from: btchris on October 10, 2014, 02:13:57 PM

Quote from: CircusPeanut on October 10, 2014, 01:43:55 PM

...Then I use my brain wallet pass phrase to protect my offline armory wallet....

That sounds pretty good to me. Since it's no longer a brain wallet, there's no reason to call it a "brain wallet pass phrase", right?

I meant that instead of using my brain wallet pass phrase to generate the wallet, I would use the pass phrase as the password for protecting the wallet file. So, yeah, I guess at that point it's just a pass phrase.

btchris

hero member

Activity: 672

Merit: 504

a.k.a. gurnec on GitHub

Quote from: CircusPeanut on October 10, 2014, 01:43:55 PM

Hypothetically speaking (I am absolutely not suggesting that anyone is doing this now) if I was a hacker it seems like a good way to steal bitcoins would be to write a little program, probably like the javascript above, but something faster, that for each pass phrase in those lists, generate an Armory wallet, check the first 20 or so addresses for any bitcoins.

People already do it for other brain wallets, so I don't see why it would be any different for Armory brain wallets.

Quote from: CircusPeanut on October 10, 2014, 01:43:55 PM

I use a shuffled deck of cards myself. Peel off the first 40 cards to generate my root key. Then 3 of 6 fragmented backup, test them out a few times on my offline device, and store them in separate places. Then I use my brain wallet pass phrase to protect my offline armory wallet. Good to go.

That sounds pretty good to me. Since it's no longer a brain wallet, there's no reason to call it a "brain wallet pass phrase", right?

CircusPeanut

full member

Activity: 123

Merit: 100

Quote from: Newar on October 10, 2014, 10:56:59 AM

Yeah, why bruteforce when you can wordlist? http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/

Hypothetically speaking (I am absolutely not suggesting that anyone is doing this now) if I was a hacker it seems like a good way to steal bitcoins would be to write a little program, probably like the javascript above, but something faster, that for each pass phrase in those lists, generate an Armory wallet, check the first 20 or so addresses for any bitcoins. Just let the program run in the background and then get on the forums talk up the generating a Bitcoin Armory brain wallet.

I use a shuffled deck of cards myself. Peel off the first 40 cards to generate my root key. Then 3 of 6 fragmented backup, test them out a few times on my offline device, and store them in separate places. Then I use my brain wallet pass phrase to protect my offline armory wallet. Good to go.

btchris

hero member

Activity: 672

Merit: 504

a.k.a. gurnec on GitHub

Quote from: Newar on October 10, 2014, 10:56:59 AM

Quote from: spin on October 10, 2014, 04:06:44 AM

[...]
(Of course given that it's now a sentence on a bitcoin related site, using it now would be suicide!)

Yeah, why bruteforce when you can wordlist? http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/

Quote from: picobit on October 09, 2014, 02:08:14 PM

[....]
I *think* it is barely out of reach of a brute force search, but honestly I have no clue.

https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.html gives an entropy of 194 bits.

I do believe that in suggesting that (or any) entropy estimation tool, you just contradicted yourself...

Entropy estimation tools such as the one mentioned can provide, at best, an upper bounds estimate, and therefore provide a false sense of security. They assume password crackers only use particular predetermined techniques when generating password guesses, however crackers are forever improving their techniques (furthermore these techniques are not necessarily public knowledge).

The (nice, thanks for that) article you pointed to exactly demonstrates this. I took the first "difficult" password mentioned in the article (which has been successfully cracked using the described techniques), and plugged it into the estimation tool, and got this:

Code:

password: Am i ever gonna see your face again?
entropy: 100.857
crack time (seconds): 1.1482519836189682e+26
crack time (display): centuries
score from 0 to 4: 4
calculation time (ms): 7

It seems awfully unlikely that the article's authors were able to crack a password with 101 bits of entropy, hence the estimate is a bad one. So, just to reiterate: estimating entropy is really hard...

Newar

legendary

Activity: 1358

Merit: 1001

https://gliph.me/hUF

Quote from: spin on October 10, 2014, 04:06:44 AM

[...]
(Of course given that it's now a sentence on a bitcoin related site, using it now would be suicide!)

Yeah, why bruteforce when you can wordlist? http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/

Quote from: picobit on October 09, 2014, 02:08:14 PM

[....]
I *think* it is barely out of reach of a brute force search, but honestly I have no clue.

https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.html gives an entropy of 194 bits.

spin

sr. member

Activity: 362

Merit: 262

It's

Quote from: btchris on October 09, 2014, 02:36:47 PM

Quote from: picobit on October 09, 2014, 02:08:14 PM

And since "Two beer, or bottle of wine? That is the question of my silly brain." is (almost) grammatically correct and uses sensible punctuation, it has much lower entropy than one would expect. I *think* it is barely out of reach of a brute force search, but honestly I have no clue.

I agree it seems like a nice long passphrase, but this is exactly the problem.

Exactly, this has far less entropy than the same number of random (i.e. computer chosen) words from a long words list. How much less is not clear.
(Of course given that it's now a sentence on a bitcoin related site, using it now would be suicide!)

btchris

hero member

Activity: 672

Merit: 504

a.k.a. gurnec on GitHub

Quote from: picobit on October 09, 2014, 02:08:14 PM

And since "Two beer, or bottle of wine? That is the question of my silly brain." is (almost) grammatically correct and uses sensible punctuation, it has much lower entropy than one would expect. I *think* it is barely out of reach of a brute force search, but honestly I have no clue.

I agree it seems like a nice long passphrase, but this is exactly the problem.

We humans (myself included of course) are really bad at estimating how much entropy something has by just looking at it, and we're just as bad creating things with lots of entropy using only our brains. If it turns out the passphrase was in fact good enough, you'll know in 10 or 20 years because your key was never stolen. If, on the other hand, you were wrong, your bitcoin could disappear at any time between now and then.

If you're that worried about losing your paper backups, you can be nearly as paranoid as you want, e.g. print a 2-of-6 backup, and store them all in safety deposit boxes at different banks. (or how about just a standard/1-of-1 backup that you tattoo to a, uh, private area of your body? that should be hard to lose and, depending on your profession, hard to get stolen too

)

picobit

hero member

Activity: 547

Merit: 500

Decor in numeris

Quote from: timz on October 09, 2014, 01:53:07 PM

Well, I don't remember the password, but I still have my paper fragmented backup.
But if papers were lost, you may try to recall the password. It is just additional possibility to restore wallet.

That actually makes sense - at least if your passphrase is long and cryptic enough to be secure.

The demands for a brain wallet is many orders of magnitude higher than for a password, since you do not need access to anything other than the block chain to break it - and can attack all the world's brain wallets in parallel at no extra cost. A lot of people have a lot of specialized hardware for doing rapid hashes - and they no longer pay for themselves mining bitcoin. Some of these are going to try for brainwallets instead. And since "Two beer, or bottle of wine? That is the question of my silly brain." is (almost) grammatically correct and uses sensible punctuation, it has much lower entropy than one would expect. I *think* it is barely out of reach of a brute force search, but honestly I have no clue.

timz

member

Activity: 120

Merit: 10

Quote from: picobit on October 09, 2014, 12:44:36 PM

One year from from now, typing 'Two beer, or a bottle of wine? That is the question of my silly brain.' Wait??? Where are all my coins??? I am sure I remembered my password.

This is the other reason brain wallets are such a terrible idea.

Well, I don't remember the password, but I still have my paper fragmented backup.
But if papers were lost, you may try to recall the password. It is just additional possibility to restore wallet.

picobit

hero member

Activity: 547

Merit: 500

Decor in numeris

Quote from: timz on October 05, 2014, 04:28:57 AM

Use something like 'Two beer, or bottle of wine? That is the question of my silly brain.'

One year from from now, typing 'Two beer, or a bottle of wine? That is the question of my silly brain.' Wait??? Where are all my coins??? I am sure I remembered my password.

This is the other reason brain wallets are such a terrible idea.

spin

sr. member

Activity: 362

Merit: 262

Quote from: timz on October 06, 2014, 10:51:24 AM

Quote from: spin on October 06, 2014, 10:00:18 AM

entropy of sha256(sha256('3333333377777777444444443333333377777777444444443333333333333'))
is the same as the entropy of '3333333377777777444444443333333377777777444444443333333333333'

Only in case of password. And in case of low-cost brute forcing. But generally no. I mean if entropy of '3333333377777777444444443333333377777777444444443333333333333' is low, for example equal to 2^3 bytes phrase, it doesn't mean you may find the 8-bytes phrase that
hash256(8-byte-phrase)=hash256('3333333377777777444444443333333377777777444444443333333333333').

Users often chose low entropy passwords, x.
If entropy of x is low then entropy of sha256(sha256(x)) is also low...
Which means people can easily crack their wallets.

This is why everyone thinks brain wallets are a bad idea.

goatpig

legendary

Activity: 3766

Merit: 1364

Armory Developer

Address chain extension:

https://github.com/etotheipi/BitcoinArmory/blob/master/armoryengine/PyBtcWallet.py#L1047

Deriving the first key:

https://github.com/etotheipi/BitcoinArmory/blob/master/armoryengine/PyBtcWallet.py#L912

Topic: (!) Armory Brain Wallet (Read 4959 times)