Topic: encrypting seed phrase with a password (Read 657 times)

I read the article, but it's still a lot to process:

1st, this type of attack is only possible if my hardware device has compromised firmware.

2nd, the "Dark Skippy" attack can exfiltrate the private key, wallet descriptor, seed bytes, and/or extended private key in just two or more signatures (depending on the seed entropy, even one), hiding information inside the transaction signatures.

3rd, the exfiltration is done inside the signature itself. Security depends on the integrity of the signing device itself.

4th, the attack occurs at the moment you sign a transaction. This means that, even without knowing it, when signing a transaction, the compromised device may be extracting sensitive information and sending it to the attacker. Therefore, the critical moment of vulnerability is during the signing of the transaction?

5th Even if I'm using an extremely strong and random passphrase, does this just require more signatures than normal, as if the code were to crack the combination needed bit by bit to even exfiltrate the amount needed to build the necessary raw seed bytes of the master private key?

CDN as in Content Delivery Network? If that's the case, just use OpenSSL which installed directly on your computer, rather than on browser.


I think it's hard to know which one is more secure. LibreSSL remove many unused code and support for older stuff, which means potentially less security issue. But it's less popular than OpenSSL, which means less people pay attention to it's code and security. It reminds of discussion which compare Linux and BSD security,

It is turned out that  a strong passphrase added to SEED phrase makes harder to perform Dark Skippy attack which needs substantially increased signatures to be successful. Thus the strong  passphrase along SEED can't hurt OP.

 Feel free to reap the benefits from reading the  content of this  topic on Dark Skippy attack

I think that the backup method using mnemonic words, which is BIP39, is just a form of backup, that is, your seed doesn't necessarily need to be secure, but your passphrase must compensate for its lack of security, although it's unlikely that a user will generate an insecure seed, since most wallets use a secure entropy generator and there are no reports of thefts due to lack of entropy.

Going back to what you mentioned, I still haven't found the best way to protect the passphrase (or extended seed word, as you prefer), but as you mentioned, this can be a good strategy.

At the very least, it's essential to keep the passphrase geographically separated from the recovery seed.

This is like you have a precious item, you pack it in a box and put a lock on it, then you put that box in another box and lock it with another key. Then again you put that big box in another box and lock it with another key. Now losing the key will get you in a lot of trouble 

My suggestion will be to generate an offline seed phrases and extend it with least four words. Now save them on a piece of paper and store it somewhere safe. That's it and you are good to go.
Another precaution can be to secure the extended four word phrase at some other place (paper). This way, even if someone gets your seed phrases paper, that is useless because extended seed phrases are stored in another place.

Interesting. Recently I had a conversation with a guy who made a software for offline text encryption, and he said that openssl is less secure if it utilizes cdn libraries. And also some people say that libessl is more secure that openssl.

Correct me if I am wrong, but MetaMask allows you to import individual private keys as well, doesn't it. If you can't enter a seed + passphrase, you should be able to import the private key of your ethereum account into MetaMask. MetaMask is a hot wallet. I assume it's the same with the other ethereum wallets, so whether you import a seed or private key doesn't really matter. But it does defeat the purpose of generating a seed offline only to use it later with a hot wallet.

Keep your bitcoin separate from your other cryptocurrencies. That's my tip.

Think about it a few seconds longer than you probably did. Many metal backups only stamp (or assemble) the first four characters of the recovery words because it's enough as every recovery word is unambigously identified with that.

Encrypted data or text doesn't give you this reduction for free: probably every single character of your encrypted text is important and shouldn't get lost otherwise decryption is likely to fail miserably.

If on the other hand the encrypted text isn't noticeably longer than the unencrypted source, well then you just need to be careful to avoid any errors. But the problem remains that you have to have a reliable backup of your encryption "key" which needs to be stored well separated from your encrypted text/data.

I have a feeling this is all a bit too fragile. There's no one recipe for all. Make a careful risk assessment and deploy remedies for your main attack vectors/risk you deem important.

@OP Only your first 2 steps make sense. The rest is some dull thinking to do more of the same stuff repetitively and you risk adding complexity. Human memory is very fallible. If you encrypt the seed, you can leave it around anywhere. In fact, I often wonder why the metal plate makers don't allow for saving encrypted strings than literally exposing the entire seed to anyone who finds it.

Krux does this, and it makes it easy.

Step 1: Load a seed into Krux.  Or use Krux to generate a new seed.

Step 2: Save the seed to a micro SD card, or save it as a SeedQR code.

Step 2.5: While saving the seed, choose to encrypt it.  Enter some text to use as a decryption key.  Done!

Better still: Improve the setup by using Krux to create a QR code for the text you're using as a decryption key.

Now, you can load your seed from the micro SD card, where it's encrypted, or by scanning the encrypted seed QR.

I love encrypted seed QR codes.

Scan the encrypted QR.  Scan the decryption key QR.  Done.

...but what if somebody finds your encrypted seed QR?  Nothing happens.  They can't decrypt it without the decryption key.

Here's an encrypted seed QR I made as an example.  I kept the decryption key simple for this example.  It's just a few words, all lowercase with a space between each.

You don't even need Krux to decrypt the QR.  They wrote code to decrypt them & posted the code on their github.

I think people are intelligent enough to understand for what reason such stuff is cloned. Besides, it is explicitly highlighted over there that those copies are backups. I don't  think that any extra words are needed than those ones already said in my topic. All stuff is straightforward for those who read it carefully.

Ok, that's great but I think you should warn people against this risk in your tutorial and recommending them to make several copies as you've done yourself because unfortunately digital safeguards are way more fragile than physical ones, even simple sheets of paper (you can throw a sheet of paper 10 times against a wall it won't be broken). Some people are using cloud services for storing their critical encrypted datas in order to avoid the danger of physical damage(including the electromagnetic one) of their devices  but a cloud service can also be easily shutdown, or datas can be erased from there without notice.

lexar or so is still consumer-grade. i never seen industrial-grade sd card.

I assume you reading of topic I have referred to was inattentive. That is why you have questioned me.

At the moment I have the set of  three cloned pgp dongles. Should one of them get damage it will be easily replaced by the means  of cloning from remaining ones.

Regarding hard disk. I don't use such stuff.  I use flash drives and industrial grade SD cards to hold Tails with all encrypted  stuff. They are  also clones and can be further cloned if needed. Some of these clones are geographically distant and kept by my relatives.  

Are you really sure that you need that much security and are you also sure that you'll be able to handle the responsibility? Keep in mind that the more secure you make it, the higher the responsibility will be on your shoulders.
By the way, Bitcoin seeds already guarantee a very high security and in practice, Bitcoin wallets are uncrackable. If you put a password on your seed phrase, you have to keep in mind that your password must be as strong as your seed phrases because what's the point of setting a weak password if cracking of it will reveal your seed phrases? Also, again, what's the point of setting a strong password (equal to 12 words) on them (i.e. having two 12 words seed phrase)? Just have a one, 12 words seed phrase or 24 if you wish, save it well, keep it securely and live your life. It's meaningless to make things complicated when there is not a necessity of it.

It won't be effective

You should use something like shred command in Linux


You should use GPG or openssl

.

I'm not sure if this scheme is actually great. It looks overly convoluted to me and frankly I don't know why it's that much layered, to be honest. @satscraper could you explain what kind of attack vectors you try to remedy or your reasoning with such a multi-layered approach?

Then indeed more points of potential failure are introduced, at first glance. The hardware keys would need copies otherwise you're pretty much screwed if you've only one and this sole one gets damaged, stolen or lost. (OK, after actually reading SEED storage on digital media., you use three hardware keys from Yubico, so it seems there's redundancy.)

I hope you've a hell of a good instruction manual for those who are supposed to inherit your stuff should something bad happen to you. And don't forget, you know your scheme well enough now, you constructed it. Years later and without much use, this could change as human memory is a fragile and changing thing. For those not involved in your scheme, instructions would need to be much more elaborate.

Don't get me wrong, I'm not per se against digital storage but I'd like to understand why such paths are walked and to what problems it's aimed to be a valid solution. People need to understand why handling such precious data like mnemonic recovery words and/or mnemonic passphrase on digital devices is potentially dangerous and how to do it safely.

And don't do fancy and complicated procedures just for the sake of it and because you can. There should to be a clear purpose and need for every layer of protection!

That's great but what will happen if your hardware dongle is broken or if you lose it? In addition encryption doesn't protect against damage. If your hard disk is damaged(physically or digitally) what will you do? Your private pgp key won't be enough to recover it unfortunately, the strongest the encryption is. Devices will never be as strong as your encryption can be, they can be destroyed or critically damaged at least, quite easily actually.

My SEED phrase is pgp-encrypted. The relevant private key is secured by hardware dongle. Encrypted SEED is inside protected  data base of  KeePassXC  which is placed in  encrypted partition (persistent storage area) of Tails. In fact I use the  four-layered encryption system. Think, nothing would be better. Interested? Then look here.

just using 7.1a right now. portable install.  windows 10.
if it's a problem to find binaries idk. use russian vpn and google for it
About other things you said  : authors make request like this only in one case. Think for yourself it's called  

But isn't veracrypt a fork of truecrypt and truecrypt discontinued?

I was unable to use truecrypt on Windows, I made a post about it on my local board.

truecrypt is better. reputation approved by news like "fbi cracked truecrypt smth". Authors even made a request to waybackmachine to exclude their site from where binaries can be found.

You must be sure to be able to find and use the same software with the same version, even in several years when you will need to decipher your seed phrase otherwise you won't be able to access it. That's why it's better to use a very standardized algorithm to encrypt your seed phrase. And to try several different softwares using it to decipher your secret, to be sure there is no bug into the encryption program.  

Yeah, I know about Unciphered's team  endeavor, that story was  overgrown with moss, but if you read it carefully you would noticed that they had a physical access to the "   giblets" of the  old  model of IronKey. Modern Ironkey products, such as IronKey Keypad 200 Series USB flash is complaint to   FIPS 140-3 Level 3 security which means  any physical access to its "entrails" is impossible. So, you always have the option to  advance yourself to more sophisticated  IronKey  product if necessary.

It didn't take long to find this Wired article where Unciphered's team found a way to be able to infinitely brute-force the Ironkey's encryption passphrase bypassing the data erase after 10 wrong entries. So, don't think an Ironkey is a no-matter-what secure vault.
(Not much detail there and I didn't try to dig up other IronKey hacking sources. Don't rely on every marketing BS from companies like Kingston who picture an unbreakable product. Hacker's are very creative...)

Who knows what's possible to break into such devices when you have the skills and tech to perform sophisticated fault injection attacks. It's all a matter of how much value is at stake and skilled hacking teams with enough and proper ressources.

And devices with built-in keypad can even be worse if not implemented properly. I've seen and read about some funny failures in the past (sorry, no sources for those as I'm only marginally interested in such devices and it's been a while that I've seen articles about it which caught my security interests).

Sure a common pen drive plus veracrypt software is a cost effective solution but advantage of IronKey is in the build-in protection against both BadUSB and bruteforce attacks. Besides it's waterproofed (up to 1.2 m) and I suspect that the quality of the memory cells used in IronKey is much better than in common pen drives as   Kingston includes  5 years long warranty for their product.

It seems very attractive, as an alternative, I can have a common pen drive and use veracrypt on it or other well-known and equally secure encryption tools.

You should always add a salt to the data and then hash it before you encrypt the data in order to avoid Rainbow Table attacks which are very fast.

OWASP says Argon2id is the strongest available hash available. Failing that, you can use scrypt, or PBKDF2 with 600,000 iterations.

It doesn't really matter whether you are trying to encrypt a seed phrase or an entire wallet, the rule still applies for security purposes.


Yeah, generally you do not need to encrypt the seed phrase itself, just the wallet file, and then if you want you can extend the seed phrase with a passphrase.

You can also think about Kingston IronKey Vault Privacy flash USB to store your encrypted SEED phrase. It has the build-in AES 256 encryption for all custom data, thus ,by using it, you will have at least two layers of protection for your SEED. One of them is provided by IronKey while the other - by scheme of encryption chosen by you.

OK thanks. I'll look more into GPG and OpenSSL AES.

Thanks for the reply. By the way, I've found this site, but it doesn't work offline. I've saved the whole web page on my hard drive, but when I try to use it offline nothing happens.
https://www.gillmeister-software.com/online-tools/text/encrypt-decrypt-text.aspx


I'll try to find more tools for offline encryption.

After I started using the BIP39 passphrase extension, I no longer see the use of using encryption tools such as AES, GPG, but you can use it responsibly, regarding this tool on github, I'd be careful, as in addition to not being very well known, who guarantees that it will be available to you in the future? Remember that the backup process is long term.

If you insist on encrypting your seed, better learn to use GPG, you can encrypt symmetrically (just a password). Another alternative is OPENSSL AES 256 CBC which is available natively on Linux.

Maybe it's worth taking a look at seed-otp where another seed (decoy) is generated, this decoy seed is literally your encrypted seed.

The sparrow wallet allows you to export encrypted backups, I covered this in my topic.

Commonly retention time is around 10 years, thus it would be fine for him to rewrite data on his flash storage at least once per year. Not too much work, i think.  I'm using flash media (both pen drives and SD cards) to keep my SEED phrase , though the guarding scheme I use  is more sophisticated than that one proposed by OP, but approach  in fact is the same -  data encryption on the digital  media .

As others have stated it your protection scheme looks like overcomplicating things. You create also multiple failure points. What if your USB stick fails after some time (at least use multiple ones and don't forget that flash storage has a limited retention time if not used regularly; retention time varies with quality, temperature and used flash cell technology)?

As you use partially uncommon software, what if those disappear? Do you backup every used piece of software in your scheme?

You need to properly backup all your used passwords and document all steps of your encryption scheme or you will inevitably sooner or later forget something essential and then you're screwed. Passwords backup should be offline and analog so that malware can't reach it.

Why not use analog offline backups for your mnemonic recovery words alone? Do you need a protection layer from theft of your offline backups?

I did quick check and it seems they use SHA-256 and AES, which is generally considered secure.


But i don't know whether they use CryptoJS library securely and whether CryptoJS implement both SHA-256 and AES securely. If you insist to encrypt your seed phrase, you better use more popular and open-source encryption software which is more likely to be secure.

I don't know why you're giving yourself the stress of multi encryption which you can't store any where apart from a cloud (HOT) or a USB stick (cold) u prefer the cold storage but you have forgotten the it could get corrupted  and with multi encryption there's high probability of loosing your wallet just keep your keys safe and cold no one is coming after it so far it safe with and it remains in a cold format ...
You're the first bridge to your wallet, you determine how you keep it safe but don't make it complicated for yourself

You can start by telling us the coins you hold, have you checked if wallets like Unstoppable supports the coins that you hold, if they do, then you can switch to the wallet and extend your seed phrase with a passphrase, instead of trying a tool or software that you aren't sure if it is recommended. Unstoppable wallet is also open source and it is a recommended wallet, but mainly for altcoins.

Wallet like Unstoppable supports passphrase but it is not supporting some mainnet coins. It is a good wallet to use for the coins and tokens it is supporting. But it has some synching issues in the past which I guess they have been solved, especially bitcoin synching issue.

As for other wallets that do not have passphrase, I do not know much about that.

I agree with the above posts having multiple encryptions will make you confuse in the future when you are trying to recover your wallet that's not a good idea and another thing is you just randomly using an encryption tool from GitHub that we do not know if it would still be available in the future or not.

The added passphrase for BIP39 should be enough since in case you mess up or if you forgot a few characters in your passphrase there are some tools that can recover missing or wrong characters.
And for me, you don't need them since you already generated it from an offline device just make sure that you never connect that device or the USB drive into an online device.
Unless you want to do it because you don't want someone, family, friends or anyone living in the same house to see your backup wallet.
If I'm right and you think encrypting your text backup is the solution you know that can protect against them then I suggest try PGP encryption that is way more secure than choosing a random software from github.

One problem is that Metamask and some other wallets do not support passphrases (i.e. seed phrases with 13 or 25 words), so I am considering seed encryption as a solution for such wallets.

Wasnt the BIP39 passphrase invented for this very reason?  Look, multiple layers of encryption sound good in theory, but you are just adding complexity and failure points.  If you forget a password, mess up the encryption, or lose a USB stick, you are screwed.  BIP39 phrases are strong enough on their own if you write them down on paper, split them up securely, and keep them safe.  This feels like overthinking it and inviting trouble.

Besides, I cant think of a single advantage why it would be better to store a seed phrase on an electronic device like a USB stick rather than written on a physical medium like paper or a steel plate.

I do not know about that tool but I do not need it as long as I am dealing with bitcoin. Passphrase is enough for me to extend the wallet which is also like wallet encryption.

Another is the wallet file encryption. These two are enough for me because the more I make the security complicated, the closer I am getting closer to lose the coins.

I have an idea how to protect my seed phrases.

The first step would be to generate it it offline.

Second step would be to encrypt it (also offline) with a password.

Third step would be to pack that text file with encrypted seed phrases in a rar archive which would be protected with another password.

After that, I would copy that rar archive to protected USB sticks. And of course, I would delete the original file (but previously I would save it as an empty file).


I've found one tool on github (the link is below) for encrypting and decrypting text with password, but I am curious how secure that method of encrypting is, and are there any stronger algorithms for encrypting and decrypting text with a password?

https://github.com/blws/text-encrypt