Re: [bitcoin-dev] SLIP-0039: Shamir's Secret-Sharing for Mnemonic Codes

From: Ignacio Berrozpe <iberrozpe@gmail•com>
To: andrew.kozlik@satoshilabs•com, bitcoin-dev@lists•linuxfoundation.org
Subject: Re: [bitcoin-dev] SLIP-0039: Shamir's Secret-Sharing for Mnemonic Codes
Date: Mon, 24 Sep 2018 21:49:08 +0200	[thread overview]
Message-ID: <CAF8cz+pxaEpg9FtqmegxAZyGWGb1Z2P8rJCCAVerLhMZ5B8xOA@mail.gmail.com> (raw)
In-Reply-To: <4e2c7b41-1e16-b89a-04d8-776f3469141a@satoshilabs.com>

[-- Attachment #1.1: Type: text/plain, Size: 2528 bytes --]

Hi Andrew

Please allow me to comment on your work, as I happened to publish an
article 5 months ago proposing SSS to split bitcoins private keys into
shares that could be encoded directly using BIP-0039 mnemonic words. While
cryptographically much simpler than your proposal, the proposal had the
characteristic that it could be applied directly to existing private keys
backups, by splitting the keys into SSS shares that could benefit from the
existing BIP-0039 mnemonic to encode directly the shares. I thought it
would be a simple path for hardware wallets providers such as Trezor into
providing a better/more secure alternative the existing BIP-0039 privatekey
backups of 24 words.

The article can be found here, and I've enclosed a simplified version

https://privatekeys.org/2018/04/24/k-of-m-private-key-generation-and-backup-in-bitcoin-wallets/

Mind two questions? Your proposed work provides a way to split the
pre-secret into SSS shares, a format of encoding the shares, and finally
several methods to derive the master secret from the pre-secret. Would you
envision standarizing these different topics under the same proposal? Also,
have you thought of a way to deal with the existing legacy privatekeys
already encoded into BIP-0039, or stored in other formats, and how to
migrate them securely into a schema of encoded SSS shares?

Best regards
Ignacio Berrozpe

On Fri, Sep 21, 2018 at 8:18 PM Andrew Kozlik via bitcoin-dev <
bitcoin-dev@lists•linuxfoundation.org> wrote:

> Hello everyone,
>
> We are currently writing a new specification for splitting BIP-32 master
> seeds into multiple mnemonics using Shamir's secret sharing scheme. We
> would be interested in getting your feedback with regard to the
> high-level design of the new spec:
> https://github.com/satoshilabs/slips/blob/master/slip-0039.md
> Please focus your attention on the section entitled "Master secret
> derivation functions", which proposes several different solutions. Note
> that there is a Design Rationale section at the very end of the
> document, which should answer some of the questions you may have. The
> document is a work in progress and we are aware that some technical
> details have not been fully specified. These will be completed once the
> high level design has been settled.
>
> Thanks,
>
> Andrew Kozlik
> TREZOR Team
>
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists•linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

[-- Attachment #1.2: Type: text/html, Size: 3540 bytes --]

[-- Attachment #2: KofM  Private Key Generation and Backup in Bitcoin Wallets _ Submit.rtf --]
[-- Type: application/msword, Size: 1074372 bytes --]