Topic: How to I get rid of electrum? (Read 363 times)

pooya has already answered, but you can see the relevant code here: https://github.com/spesmilo/electrum/blob/master/electrum/mnemonic.py#L190

My point wasn't about the order of generation, though - it was with OP's apparent distrust of seed phrases. If he incorrectly believes seed phrases are somehow insecure, or does not trust how Electrum generates them, then simply choosing not to back his up doesn't solve those issues. If he wants to avoid seed phrases altogether then he would need to generate individual private keys directly from an entropy source, such as flipping a coin.

Having said all that, even if he does that, then there would still be multiple possible seed phrases which would lead to that private key at some derivation path.

yes, it is the same but with an additional step before converting the seed to mnemonic. here are the steps:
1. generate a random entropy/seed (which is random 132 bits to get 12 words)
2. convert the entropy to a mnemonic
3. compute HMACSHA512 of 2 using the key = "Seed version"
4. check if the initial 8-bit or 12-bits match the seed version you are trying to create. for example if you want a SegWit wallet it has to be 0x100 or 0b00010000_0000
5. if 4 failed then increment the entropy by 1 and restart at step 2 otherwise return the result

so basically each time you create an Electrum mnemonic you are using brute force to find one that gives you a certain initial "string", similar to what Vanity generators do!

Does Electrum not work like BIP39 in the sense that you start with a random seed (ie. very large random number)... and then convert that seed to the mnemonic phrase? As opposed to generating a mnemonic phrase and then going from that to the seed?

It's been such a long time since I looked at the inner workings of the Electrum code

Further to pooya87's reply above, when we are considering BIP39 phrases (and not Electrum phrases) the last word is not wholly a checksum. It contains the checksum, but it also contains some of your entropy as well. The exact proportions of each are dependent on how long your phrase is.

In BIP39 seed phrases, there is 1 bit of checksum for every 32 bits of entropy, and each word encodes 11 bits of data. So for a 12 word phrase, which contains 12*11 = 132 bits of data, 128 bits are entropy and 4 bits are checksum. This means the final word encodes 7 bits of entropy and the 4 bits of checksum. For a 24 word phrase, the final word encodes 3 bits of entropy and 8 bits of checksum.

Because of this, it's not accurate to calculate the security of BIP39 phrases by calculating 2048 raised to the number of words. Instead you have to calculate 2 raised to the bits of entropy - 2¹²⁸ in the case of 12 word seed phrases, or 2²⁵⁶ in the case of 24 words.

this is wrong.
you are thinking of BIP39 mnemonics not Electrum since the later do not use checksum at all. there is an initial version byte that must be satisfied and could act as a checksum but it isn't exactly a checksum specially since it is too small (8-bits or 12-bits depending on the type).
as for the dictionary, Electrum is not limited to the default dictionaries and can have any custom ones that contain any number of words.

that does not give you any kind of meaningful security.

Seed and private keys are very different things

A seed is a master key which is able to generate all of your private keys, which are mathematically related. Saving a bunch of private keys without their mathematical relationship in a piece of paper is very uncomfortable, dangerous, tiresome and inefficient.

From mastering bitcoin:


Saving a seed results in:


You are doing this:

Electrum-style seed phrases select a word from a dictionary of 2048 words, so take the exponent of that by eleven (the last word is a checksum as o_e_l_e_o said) and you get 2.658456e+36, while the number of valid private keys is many times larger, 2**256 minus a relatively smaller, but still extremely large, number, to give 1.1579209e+77 combinations.

Still, it's easier to disguise a seed phrase when you write it down than a private key. You could put several dummy words in the phrase and arrange them in a pattern that only you know, and that's possible because they are just a bunch of words. You can even write them in a different language if you want to obscure them. Whereas a private key has a fixed format that anybody with technical knowledge can recognize.

My bad - deleted the wrong line from the reply. Fixed.

@o_e_l_e_o: you are 100% correct, but you messed up the quote in your previous post...

I never claimed that:
Private key 1 = Hash(seed +"1")
Private key 2 = Hash (seed + "2")

I was quoting BlackHatCoiner when he assumed this fact, but the quote has been messed up so it looks like i was the one who made this assumption

It's actually:

Seed phrase and passphrase (if used) are fed in to 2048 rounds of PBKDF2 using HMAC-SHA512 to derive a 512 bit seed number.
512 bit seed number undergoes HMAC-SHA512 to generate master private key and master chain code.
Master public key is calculated from master private key using elliptic curve multiplication.
Master public key, master chain code, and index number are fed in to HMAC-SHA512, and the left 256 bits added to the master private key to generate a child private key. The right 256 bits become the child chain code.
Repeat the last step multiple times to work down the derivation path to reach your desired private key - for a legacy address on Electrum this will be m/44'/0'/0'/0/0.

Backing up a seed phrase is better than backing up an individual private key for multiple reasons. It is easier to do (since you should be writing it down by hand on paper and not storing it electronically), it is less prone to errors, it provides access to all your addresses instead of just one, it doesn't encourage address reuse, it solves problems with change outputs, and the list goes on.

Although you are obviously correct regarding a seed phrase being secure, it actually doesn't matter if BlackHatCoiner thinks it is more secure or not. He used Electrum to generate a private key, which means that private key must have come from a seed phrase. Whether or not he backs up the seed phrase or not makes no difference to the fact that his address is only as secure as the seed phrase which generated it.

Ah don't tell me that stuff... I think I've been a big paranoid enough. I don't think anyone will stole my funds, like ever...

I think that you are doing it wrong. If the computer had any "surprise" on it you'll find out very late, when the funds from your safe wallet get vanished.
I'd consider using a live OS (maybe on a stick) which you use only for this purpose (with no internet, obviously). And then you'll format the stick and you are pretty much OK. If you use Tails with default settings you'll have Electrum on it and it will never save the wallet, so you are sure the data is lost at reboot.

Also writing down the private key is easy to mistake, be careful.



Actually writing down seed is easier. But beware, Electrum seed works only with Electrum (if you use it with a different wallet you'll get different addresses).

Many interesting discussions have been devoted to this topic... For example: bitcointalk.org/index.php?topic=1716725.0

Bottom line is pretty simple: no, it's not easy to brute force a seed...

A seed might look like just 12 words out of a fixed wordlist... So a normal person would assume it's as safe as a 12 character password... But it's not... It's as safe as a 12 character password using random characters out of a 2048 character set (well, the last word is a checksum)... And to top it off, one iteration while brute-forcing a seed is very resouce intensive (seed => master private key => derivation of private key 1 => public key 1 => address 1 => checking for balance... derive the next private key, check all derivation paths,...).

So far, i haven''t heared about any key collisions that weren't caused by some bug in the rng...

It's just one of those things that are hard to grasp, a seed looks really easy to brute-force since it's just a string of 12 words you actually know... But if you'd try to write a small script to scan the complete keyspace, you'd very soon learn that it's basically "allmost impossible" (defenately with the hardware we currently have)

Yes but isn't easier for someone to brute force a seed? Sorry, but I don't get how the seed works. You say that by having it you have access to all of your keys. Does it work like that?

Private key 1 = Hash(seed +"1")
Private key 2 = Hash (seed + "2")

And so on.

As BitCryptex said, uninstalling Electrum only removes software, while wallet files, configuration settings, blockchain headers, etc. are not deleted and stored in the Electrum datadir. You can find it at the following location:

Is this a response to their posts or another question?
Because seed phrase should be saved in a "physical form", written in a piece of paper or other alternatives.
That key dump in csv format is too troublesome/long to write.

And obviously, they won't consume the same amount of space.
Seed phrase is only 12-words (+extension), a key dump will consume one or more notebook pages.

Since you can save your seed why don't you just export your keys in csv. You will consume the same space.

All you need to keep is the seed and you can access it anytime and in any device, names can be changed so you will be able to change it also without a problem, as long as you can access the wallet with the seed, all transaction history will be seen intact.

Most people don't want to use the same address over and over again, mostly for privacy reasons. A seed offers much more leverage and convenience over backing up the many addresses generated when you spend your funds.

Thanks.


In my opinion? It's the same thing.