Topic: Crack seed phrases with brute force? (Read 670 times)

What currently "reassures" me somewhat about this topic is the fact that we would have completely different problems if encryptions such as SHA256 could be broken.

[...]
Forking to a quantum resistant algorithm now, when the actual threat is probably still decades away, would be a mistake. Whichever algorithm we picked today would at best be very outdated, slow, and inefficient by the time it was necessary, and at worst be insecure.

What makes me a bit perplexed is that you hardly hear anything around the forks towards quantum computing resistance.

Especially since people like Sundar Pichai (Alphabet CEO) assume that quantum computers will break current encryption "within the next 3 years".

Is the danger of quantum computers overestimated or is the developer community aware of the danger and already working on it without scaring the community too much?

[...]
Even if you generate and store your personal public keys on an airgapped device and 100% private, your coins won't be worth anything if a quantum computer can steal the 10 million or more bitcoin with exposed public keys. Public keys are meant to be public. The security of bitcoin against quantum computers will come from forking to a quantum resistant algorithm.

What's your opinion about this? Is it really that easy?

However, the article also points out that the solution to this is also quite simple ... avoid address reuse so that the Public Key doesn't get exposed at all:

Further to hosseinimr93's corrections above, if someone did have a quantum computer of sufficient size and stability (which is a very distant threat), the most effective way to use that would be to attack the ECDLP of coins with known public keys, and not to attempt to brute force seed phrases from scratch.

Anyone with a sufficiently large quantum computer could theoretically derive the private key from a known public key and thus, falsify any digital signature. This scenario seems to be the most realistic and vulnerable one. It basically boils down to the unveiling of public keys (a quantum computer could then theoretically “calculate” the private keys), which can occur in different scenarios

Source

It is only exposed when the owner initiates a transaction. The majority of coins have been held in this form of address. This means that the public key is unknown, and a quantum computer cannot calculate the private key if funds have never been moved from a P2PKH address. Today, most Bitcoin wallets are programmed to avoid address re-use as much as possible. Always using fresh addresses is already the suggested best practice in Bitcoin, but this is not always followed.

Any address that has Bitcoin and for which the public key has been revealed is potentially insecure in the presence of a quantum computer

as long as it's not a quantum computer running on cubits

Even more, the longer your seed phrase is, the harder it would be to crack it since there's like thousands if not hundreds of thousands of words in the english lexicon, with trillions of combinations depending on how many words you can generate.

Everyone knows that the words that are used for seed phrases are not random. The BIP39 wordlist (2048 words) is used for creating seedphrases, and they hold a specific meaning. The last seed word generates a checksum, which validates the data. Also, the wordlist isn't infinite, meaning we have a certain parameter.

My question is, Is it possible to crack a seedphrase with brute force? Suppose you have a lot of computing power. Like having a super or quantum computer.

I am not talking about recovering a lost wallet or missing seed words. I know there are many Python based tools, like btcrecover, that can perform this task. If one had the original seed (wrong order) or a part of the seed, like 10 out of 12 words or 21 out of 24 words, one might be able to successfully recover the wallet.

What I am referring to is taking completely random words from BIP39, run some tools and algorithms, and try to make a valid existing seed (Having balance or no balance isn't important).

I know this might be a stupid question, and a lot of you might be wondering why I wanted to know this. The thing is, I saw a bunch of videos on YouTube and Facebook where some tools were trying to bruteforce seeds. They were using thousands of combinations of seeds (I forgot to save the video link). I understand, it might be fake. But is there any technical explanation for my question?

Another small question, why does BIP39 has only 2048 words? What's the reason? Is it related to any maths or equations?

I am not a hacker, cracker, or anything like that, but a curious person who wants to learn new things. If this topic already exists, please give me the reference link. I want to know more.

I don't think you need to check the checksum while you are are brute-forcing a seed. Because the checksum is deterministic and will always hash to the same value given a particular input.

That's going to save a lot of time and let you search faster, since computing a checksum is particularly expensive and can only be optimized so much.

It's BIP38, not BIP39. I know, because I've made the same mistake in the past....
[...]

It's not guaranteeing you anything. A wallet being emptied does not tell you what's wrong, which software is responsible, when the malware was installed etc. A smart thief wouldn't trade their unknown access with $10, and I strongly recommend you to not expect hackers to be dumb. They may wait until you deposit a decent amount of money, or perhaps valuable files.

Prevention over cure. You should just be aware of your computer's security, and friendly suggestion; don't rely on security through obscurity.

The only thing a 100 char long password used for BIP38 does for you is to make your work entering it in the future for decryption a nightmare, more so when it is random!

It does not provide you with the security you think it does because in BIP38 algorithm the password is fed into scrypt KDF to derive a 32 byte key which means when you use a bigger than 32 byte password to derive a 32 byte key, your security still depends on the 32 byte size not the much bigger password (eg. 100 byte).

Theoretically to brute force your password, one would just skip the first step (ie to derive a key using scrypt that needs to iterate 100 bytes) and just brute forces the 32 byte derived key.
Realistically since 32 bytes is 256 bit and impossible to brute force, this is impossible to pull off.

It's BIP38, not BIP39. I know, because I've made the same mistake in the past....

Given that $1000 was not enough to crack just 6 characters in 2 years (even after giving hints), this doesn't really prove anything. It's probably easier to "guess" the private key itself than guessing your 100 characters.

The password is over a 100 symbols long...i just punched on the keyboard randomly.   

the BIP39 encrypted key have been exposed online for almost 7 years now...

The password is over a 100 symbols long...

Although its not guaranteeing you a clean computer, its a nice alarm so to speak when swept.

Yes.

For a simple explanation of how seed phrases and passphrases are combined in your wallet, take a look at the following links:
https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch05.asciidoc#from-mnemonic-to-seed
https://learnmeabitcoin.com/technical/mnemonic#mnemonic-to-seed

If you want a more complex explanation of how PBKDF2 works and the role of the salt in the calculation, then see here:
https://datatracker.ietf.org/doc/html/rfc2898#section-5.2

~snip~

This is where your assumption takes the wrong path. It doesn't matter that the words are not random, the words are only used as a human readable interpretation of a very large random number. So, the number is random, and you use common words to avoid mistakes writing it down.