Topic: Suggestions about the best ways to backup seed phrase (Read 835 times)

When banks are robbed these days, it happens with small local branches and robbers only take cash. No one does those heists that you see in movies when they break into storage room, and even if it somehow happened, no one would care about personal deposit boxes, where you'd store a seed. The danger of bank is that it's a their party custodian and they can seize your coins, if the private key isn't encrypted.


This is an example of security by obscurity, which is generally regarded as a bad things. Thieves and police officers know how to quickly search a house for hidden things, so if someone know what to look for, in this case a piece of paper or a USB stick, then they will likely find it.

No method is perfect, if you store seed in plaintext, you're risking your coins getting stolen, if you encrypt it, you risk locking yourself out of your coins if you lose the password.

Correct.

Almost. For BIP39 wallets, the salt is actually the word "mnemonic" concatenated with your passphrase. If you don't use a passphrase, then the salt is just the word "mnemonic" on its own.

Not quite. Seed phrase plus passphrase is used to generate 512 bit root seed. Root seed on its own is used to generate the master private key and master chain code for your HD wallet.

There's a very good explanation of how we go from entropy all they to addresses in Mastering Bitcoin here: https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch05.asciidoc#wallet-technology-details

Because it is human readable, and far less error prone. You are far less likely to make a mistake writing down 24 words than you are writing down a sequence of 256 ones and zeros.

only 2 not several: 1 piece is the encrypted result and 1 piece is the password used for encryption.
and yes it is a little more complicated than just writing down the unencrypted mnemonic but that is how security is. it requires a lot of effort.

P.S. note that what i posted above is just an example showing the idea. i don't know how secure the site used for AES encryption is, or the method might have some flaws.

So, instead of keeping in secret only one piece of data, which is unencrypted seedphrase, the average user will have to keep several pieces of data. Encrypted seed phrase needs to be hidden just in case to avoid undesired leaks of information, I don't want to expose even encrypted one. A passphrase to decrypt our AES encrypted file needs to be hidden, otherwise, it becomes a lot easier to crack our security (in case we used additional passphrase to our unencrypted seed). A passphrase to our unencrypted seed phrase needs to be hidden. We also need a back up of our seed phrase, just in very possible case we forget or lose our key used to encrypt a seed phrase. What s the point of such complexity in the first place?

you are thinking about it all wrong.
mnemonic is the human readable encoding of raw data. that raw data can be your entropy (which is what BIP39 or any similar proposal does) or it can be the encrypted result.
for example the phrase could be encrypted using AES-256 to get a fixed vector result then that "raw data" can be encoded using the same scheme used by BIP39 to get similar looking set of words with different lengths depending on the length of the input.

example
AES-256-CBC encrypt using (http://cryptojs.altervista.org/secretkey/aes_cryptojs-v3.html)

playing with the encrypted result (ciphertext) ignoring salt and IV for simplicity:
now you have the encrypted mnemonic with a new set of words!

Until I read it on wiki, I had no idea that "mnemonic" is a obsolete term, especially, when there is a constant string called "mnemonic" in function used to derive root seeds and is being used as an input in HMAC-SHA512 function. This part may be confusing because there are plenty of things called "seed number", "seed phrase", "root seed" and so on. So, root seed is the number which is derived from seed phrase plus some salt. Salt is the passphrase we use to add some additional security, it also can be equal to "none" when we decide not to use a passphrase at all. Root seed plus passphrase is the number that is used to generate HD wallets. What did I miss here, because it seems I used older literature to find out how things work, maybe I have missed something? Why do we prefer to backup a seed phrase instead of entropy?

Well, there are some factors that perhaps back up paper will be lost even it is well laminated or covers with hard plastic, --just like what happened to my friend. All papers documents he had were burnt when their house was accidentally burnt and nothing left. Perhaps OP includes of back up seed phrase through a piece of hard metal engraving. You can hide this anywhere without worried about being wet or burn. Indeed, this is a good suggestion of OP thread and we are the one who is responsible for this to keep in a safe place and my suggestion though is good for an uninspected disaster.

You should in any circumstance allow your seed to touch a digital storage device after creating it and I would even give the advice to people that you should avoid creating your Bitcoin wallet and its seed on a live computer connected to the internet. What you should do is create it on a offline computer which has been secured and then write the seed down physically. Its up to you if you want to use lamented paper to avoid it getting wet or place it in a fire proof safe what is important is that seed has not been on a computer which is connected to the internet otherwise you are at risk of it already being compromised before even storing it.

Maybe you have drafted this immediately I created this article, I have changed it even before the first person commented, I changed it from poor to good because writing seed phrase down is one of the best ways for seed phrase back up. Many people have commented and they did not see such an obbious mistake because I changed it even before first person commented.

Using backup paper is a good choice in my opinion, because backup paper will not be connected directly to the online network and is always offline. If you are afraid of being exposed to liquids, the spare paper can be given plastic lamination so that it will be safe from liquids and won't be easily damaged.

However, the main factor is how you store it so that the backup paper containing the seed phrase is safe from the hands of others and only you and the people you trust can hold it.

I see home as a safe place if properly planned, but only if the area is not prone to flood, earthquake, and other natural disaster as o_e_l_e_o said.
The likely questions that comes to my mind about the safety are:
How would the backup not exposed to liquids?
How would it not be affected by fire in case?

So, I think, getting it on little metal sheet is good and buried it in a safe place that is likely not to be affected by fire like bathroom. Burying itwo locations will make someone more secure about it.


In such this situation, I can try to also always memorize the seed phrase but will only just see it as an alternative when I can no longer access it in such these situations. But trusting on memorizing as a way of backup is totally wrong but just in case.

Having a copy of your back up at home, either in a safe or hidden somewhere,* is fine, but you need at least one off site back up, and preferably more. There's no point keeping your cold wallet/airgapped wallet/hardware wallet/whatever and the only back up in the same physical location. Fire, flood, earthquake, natural disaster, etc., is going to hit them both equally.

*I sometimes wonder about inventive places to hide a seed phrase in a house that would take a thief the longest to find. We've all heard about the hiding it inside the pages of a book or making a story out of it methods, but I've been thinking of different physical locations within a house. Taking a door off its hinges, writing it on the bottom, and replacing the door was one thought which occurred. Opening a piece of soft furniture at at seam, such as a sofa or mattress, inserting a piece of paper and stitching it back up was another. Underneath a floorboard underneath a carpet underneath some heavy furniture would surely take a thief a while to find, or hidden in a wall, covered with plaster and then wallpaper, although the latter two do mean damaging your own house if you ever need to access your back up.

Home is both a safe and dangerous place to hide your stuff. Thefts coulld easily determine which is important or not if you hide it in safes and the like so it's actually just better to hide it in a nonconspicious way or just make a hidden compartment. Banks are the same, though the difference is mostly if the bank is robbed, then it's almost a guaranteed goodbye tbh. Plus the only way to avoid digital theft is to not use any digital device to store your seed phrase. Physical theft is unavoidable imo, and if you get hit, you get hit and that's that.

"Seed phrase" and "mnemonic phrase" are the same thing. I think you are confusing "seed number" with "seed phrase". See here: https://en.bitcoin.it/wiki/Seed_phrase#Alternative_name_.22Mnemonic_Phrase.22

Further, a 512 bit seed is not derived directly from entropy. The steps are generate 128 or 256 bits of entropy, use SHA256 to calculate and then append the 4 or 8 bit checksum, split in to 11 bit sections and convert to a seed phrase, then use the seed phrase and optional passphrase as input parameters for 2048 rounds of PBKDF2 to generate the 512 bit seed.

Mnemonic phrase is just a convinient way to write a sequence of binary numbers. It is easier to backup, store, restore a wallet with using of mnemonic, especially for human beings who speak on machine language very very badly. Seed phrase is not the same as mnemonic phrase, it is derived from an entropy, which mnemonic actually represents (entropy plus checksum), by using special function. The result of calculation is the seed - 512 bit or so number, which is impossible for humans to remember or read. So, calling mnemonic a seed is not correct, however, I also prefer it over mnemonic because it is shorter to say.

That is what I meant.

Shamirs secret sharing scheme is a N out of M scheme, which means you can not only divide it into 2 shares, but a (somewhat) freely chosen amount of shares.
The reason such a scheme is used, is that having N-1 shares does reveal any information about the secret at all. You inevitably need all N shares to learn the secret.




Emails are unencrypted.
If you not explicitly encrypt the content, the mail server (i.e. your mail provider) can read the content.

Backups on private email can still lead to breaches, I will not suggest this as it is a poor method to back up seed phrase. I will suggest you to use the second method you said, writing the seed phrase on steel is better but should be in a place not accessible to people.

If you are going to make use a secret splitting method anyway, and you are going to make 4 shares, then you would probably be better off with a 3-of-4 arrangement, rather than a duplicated 2-of-2 arrangement, as it adds more security to your set up.

This is the reason I dislike the words "mnemonic phrase" and tend to use the words "seed phrase" instead. Seed phrases should not be remembered, or at least, should not only be remembered. Committing something to memory is one of the most fragile and error prone back up methods, and the easiest for something to go wrong. Seed phrases should always be recorded on a physical medium.

Seed phrases on their own have no plausible deniability to being with, so encrypting them does not change that. Only by the addition of a passphrase can you achieve plausible deniability.

That's my biggest issue with using electronic devices for long term storage - these things have a lifespan. Best case scenario they might last for 10 years, but I'm sure we've all had hardware which has failed on us well before it should have. You have no way of knowing if the SD card with your seed phrase is on might fail before the next time you access it, even if you are replacing it regularly. There are no such concerns with paper or metal, although I'll concede this is largely mitigated if you use multiple cards and multiple locations.

I used a wiped laptop with no wifi card to create encrypted folders on multiple micro SD cards. They get placed in various areas around the globe and are regularly replaced. They're only accessed on the same computer. There's no reason not to encrypt them

I'm not really a fan of anything written out in the open like paper or steel. You're creating a security problem that doesn't need to exist.

I don't know about others but I do back up with a private email address that I dont use for any online things, just for backup seeds only and also I back up seeds by writing on steel just in case of email access lost.

I think that part of the reason we haven't got any proposals or solutions regarding encryption of mnemonics yet is because this contradicts the idea of ​​the mnemonic phrases themselves. Encrypted mnemonics are no longer easy to remember, it would be look like getting back to storing of single private keys to each address, which was not very convenient approach, quite the opposite. It also contradicts to the idea of plausible deniability, since there will be the only one key to decrypt your mnemonic. Of course, you still can encrypt it with additional passphrase, but it might become very complex security, which means you have to keep too much private key, possibility of losses increases.

Mobile can also be destroyed and stolen so its not that secured you can only use this as an option to stored your keys and phrase .

Second option but you need to have another ideas  for storing it other than that old mobiles you own .

encryption is missing here.
although it may not be the critical factor for many since the backup is stored at home and usually outside of reach of anyone, but it still is a good idea to encrypt what you store too.
unfortunately i have not seen any tools or proposals about encrypting mnemonics but it still isn't a complicated thing since you can easily treat it as a text that you encrypt and then print the encrypted result on paper.

BTW we can't consider Shamir Secret Sharing as an alternative to encryption. it is for secret "Sharing".

Shamir's Secret Sharing is one of the good ways to backup the seed phrase, according to Wikipedia:
Shamir's Secret Sharing is an algorithm in cryptography created by Adi Shamir. It is a form of secret sharing, where a secret is divided into parts, giving each participant its own unique part https://en.m.wikipedia.org/wiki/Shamir%27s_Secret_Sharing

Using Shamir's Secret Sharing, the seed phrase can be divided into two in a way that each halve will be useless to hackers if seen. But using the common sense to separate the seed phrase, if one halve of it is known to hackers, it is possible to know the other halve of the phrase.

After using Shamir's Secret Sharing to divide the seed phrase, it can be replicated and the four can be stored in four locations. I will prefer it laminated or on metallic sheet and be buried in a safe place.

Ensuring the computer has no malware is not enough. The computer should be a clean install of an OS, or even better a live OS such as Tails ran from a USB stick, and the computer should be permanently airgapped. Using an internet enabled computer which you think has no malware is a recipe for disaster.

In some cases locked phones encrypt the data stored on them and the PIN is used to access the decryption key, but in many cases this is not the case. If the data isn't encrypted, then the PIN is trivial to bypass by anyone with physical access to the phone. Further, removing the SIM card does not make the phone airgapped. It will still transmit data to cell towers or similar, and will still have WiFi, Bluetooth, NFC, and potentially other connectivity methods. It is not an airgapped device. Backing your seed up non-electronically, either writing it down or stamping/engraving it in to metal, is the safest option.

OP did not mention an important aspect about back ups, and that is redundancy. You should have more than one back up of your seed phrase, to avoid having a single point of failure. Backing your seed phrase up on titanium is all well and good, until a flood or a hurricane carries it 5 miles away and you can't find it in the rubble. Two or more back ups in separate and secure physical locations is a must.

This is not a good method because phone can lost or damage at any time. And it can be stolen, it is even hard to steal a metallic sheet and paper compared to phones.

Seed phrase written on a sheet of paper is the most convenient and less risky way of saving your seed phrases. Personally, laminating the paper you have used on writing your seed is enough to protect those phrase from common physical threats such as flood, tear and being crampled.

If you have some bucks to spare, try purchasing a metal bitcoin seed storage: https://jlopp.github.io/metal-bitcoin-storage-reviews/

No, this is not the recommended way of storing your seed phrase because it is more likely to be vulnerable from an online vector attack especially if you accidentally used it for online purposes or connected it to an infected computer. It is also important to keep in mind that the files saved on a USB stick or memory can be corrupted anytime if the USB stic was not properly disconnected.

Furthermore, saving your seed phrase by simply typing it on a plain text will greatly reduce your security. Even if it is stored encrypted it is still not advisable to save it on any digital form.

What about using an old redundant mobile phone? If it doesn’t have a SIM card, you could store the seed phrase on that. The mobile will have a pin code and the phone can be locked away securely . Cheap and effective  Or am I being naive ?

A physical copy is essential and really the only thing you need. Be it on paper, or metallic sheet, whatever suits you. You can laminate the seed for extra security. Don't rely on digital copies on USBs or memory cards. It's not a safe method especially when used on a computer with internet connection. Stick to the basics, pen and paper. Store several copies in safe places in different locations.

Introduction
I have been reading the best ways to backup seed phrase, seed phrase is very important to backup because it can recover back wallets or coins during wallet damage. Some wallet owners have lost their crypto wallets and coins stored on it because of their carelessness, because they did not back up the seed phrase, some people backup the seed phrase but the backup lost because of carelessness also and this result to lost of coins. So, that is why we need to talk about the excellent ways to back up seed phrase.

Methods of seed phrase backup
There are different ways to backup seed phrase, I will mention few.

1. Stamping the seed on metallic sheet
This is good as metallic sheets are not prone to liquids, it may even not be prone to fire, if properly stored in a safe place, it is one of the best ways to backup seed phrase.

2. Paper back up
Seed phrase can be written on a sheet of paper, this method is good also but it can be affected by liquid, but good if you can save it in a place that no liquid can contact or touch it.

3. USB plain text or on memory card
A USB method is good such as the idea of flash drive or the use of memory card but making sure the computer used during this process has no malware, this has been suggested below not to be an excellent way of backup. I may still edit this based on others opinions.

Backup against physical thefts
We should be careful of thieves and carelessness, for example, if you back up seed phrase on paper or stamped on a metallic sheet and safe it at home inside a safe, it can be easily stolen by thieves if thives visit the wallet owner. So, that is a good backup method but bad saving method. Also, some people can be so careless to put the seed phrase in a place that can be accessible by other people which can steal it. After the good method of backup, we should also consider it not to be physically pilfered.

Backup against digital thefts
Some people back up the seed phrase on phones, computers, email, google cloud or one cloud, this is not recommended at all in any way, paper, USB plain texts, or metal back up are the best.


Questions
1. To backup seed phrase on paper, metalic sheet or on card/flash drive and save it at home, is this excellent?
2. To back up seed phrase on paper, metalic sheet or on card/flash drive and save it in bank, is this excellent?
3. Which one is best to bury underground? Is it paper? Metal sheets or USB plain text?
4. More ways to avoid physical thefts
5. More ways to avoid digital thefts?

Let us have your take, to know the 100% excellent ways seed phrase can be safe for backup in a way to avoid both physical and digital theft and also in a way that it is 100% safe from damages.
 
Your opinions can help others



From maus0728: I like his comment below:
If you have some bucks to spare, try purchasing a metal bitcoin seed storage: https://jlopp.github.io/metal-bitcoin-storage-reviews/

Comment from o_e_l_e_o