Now that BitAddress supports BIP38 encrypted wallets, would you consider adding support for this in the cold storage spend feature?
I implemented BIP38 support a few weeks back, including unit tests, but it is not in the wallet. I am not that fond of BIP38.The scrypt parameters of BIP38 are not final. From the spec: "n=16384, r=8, p=8, length=64 (n, r, p are provisional and subject to consensus)"
As far as I remember (from the forum, the wiki or where ever) the parameters were chosen so that the key stretching can be done on a computer in one or two seconds. This is IMO not a good practice when choosing parameters. I would rather base it on password strength and real-life brute-force attempt measurements, which I happened to find in this presentation from the author of scrypt.
The important thing is that you have to take the strength of your password into consideration when choosing parameters. I would much rather see a standard where the parameters are not set in stone (part of the output), OR even better a standard where the password has a guaranteed amount of entropy: password generated by the computer rather than a human. <-- this is important, humans are notoriously bad at creating secure passwords.
Running BIP38 with the suggested parameters on my android phone takes 388 seconds, or 6 minutes and 28 seconds, which is impractical. Instead I would like an implementation to provide guaranteed password entropy, and then stretch it with parameters that are practical to run within reasonable time while still making it take astronomical time to brute force. This is what I did, and it is part of the upcoming release of the Mycelium wallet. Whenever you make a backup a PDF is generated which for each private key has a QR code that contains an encrypted private key, where the password is 15 characters and generated by /dev/urandom (70 bits).
Here is a sample generated for testnet: https://www.dropbox.com/s/lme32phibry6kx9/mycelium-backup-10-24-13-4.16-PM.pdf
From our FAQ (not published yet):
Quote
Scrypt allows you to use a technique called key stretching to make a brute force attacker spend astronomical resources on CPU, memory, and time to launch a successful attack. The over all principle is that you can make passphrases equally secure by reducing the entropy while increasing the effort of the attacker for each attempt at brute forcing it.
In this paper the author of SCrypt estimates the cost of a successful attack based on SCrypt parameters r=8, p=1, N=16384 to be $43B if the password is 10 characters using 95 printable characters, when spending one year on the attack. We believe that these parameters have a reasonable safety margin for fairly large amounts of bitcoins. Because we don't use 95 different characters but 26 we have chosen the length of the passphrase to be 15 rather than 10. This makes sure that we have more entropy than what the calculations in the paper are based upon (26^15 > 95^10). An important point is that the passphrase is not chosen by the user, but generated by the device based on /dev/urandom. This allows us to reason about the strength of the passphrase.
Our own calculations indicate that you can make one SCrypt guess every 140 milliseconds on a standard PC using one 2.6 GHz CPU core. Since there are 26^15 possible passwords it will take a botnet of 1.000.000 computers with 4 cores each more than one million years to brute force a password. (26^15*140/1000/60/60/24/365/1000000/4)
In this paper the author of SCrypt estimates the cost of a successful attack based on SCrypt parameters r=8, p=1, N=16384 to be $43B if the password is 10 characters using 95 printable characters, when spending one year on the attack. We believe that these parameters have a reasonable safety margin for fairly large amounts of bitcoins. Because we don't use 95 different characters but 26 we have chosen the length of the passphrase to be 15 rather than 10. This makes sure that we have more entropy than what the calculations in the paper are based upon (26^15 > 95^10). An important point is that the passphrase is not chosen by the user, but generated by the device based on /dev/urandom. This allows us to reason about the strength of the passphrase.
Our own calculations indicate that you can make one SCrypt guess every 140 milliseconds on a standard PC using one 2.6 GHz CPU core. Since there are 26^15 possible passwords it will take a botnet of 1.000.000 computers with 4 cores each more than one million years to brute force a password. (26^15*140/1000/60/60/24/365/1000000/4)
