Seed Phrase in Your Head

About a year ago Aaron Feickert gave a talk at Monerokon about mnemonic seeds in high-risk situations. The main focus was on temporary seed phrases with lower entropy that you can actually memorize, so that cold storage devices and paper keys cannot be confiscated. I am not going to get into the details here, you can still watch it on YouTube. What matters more is what it triggered in me.

Why Jump Through Extra Hoops?

Here is the thing: why build extra hoops and jump through them when you can simply take the existing BIP39 mnemonic words and flip the mapping?

All the caveats and concerns Aaron raised apply here too. This is not meant for building long-term storage wallets. The moment you start building keys from self-chosen words, you walk straight into every social engineering trap there is. I am a basketball coach, here is my favorite BTC wallet seed:

hard practice great team work will win basket ball champion ship run

Try it out, it works. Both (the seed and winning basketball games).

The Shell Script

To build a seed like that, I wrote a "brute force last word" shell script last autumn, inspired by Aaron's talk. You provide 11 seed words and the script gives you 128 candidates for a valid 12th word.

Why exactly 128? A 12-word phrase contains 128 bits of entropy plus 4 bits of checksum, totalling 132 bits split across 12 words at 11 bits each. The last word carries 7 free entropy bits and the 4 checksum bits. 2^7 = 128 possible last words. With 128 candidates you will almost certainly find one that fits your seed phrase theme.

With longer seed phrases the number of valid last words shrinks, because the checksum grows along with the phrase:

More words mean more total entropy, but the last word gets increasingly constrained by the checksum. For our use case that is irrelevant, since we want a short, memorable seed. It becomes relevant in our second use case.

The Colleague with the Scrap of Paper

This actually happened, exactly like this. A colleague of a colleague, while talking about Bitcoin, remembered he had some once and that somewhere there should still be a scrap of paper with the seed on it. Found it, but unfortunately incomplete, partly no longer legible. What to do.

I rebuilt the shell script as a standalone browser tool, and it handles exactly this: enter all the words you have, leave one field blank, the tool brute-forces the candidates and displays them. The longer the seed, the shorter the list. For a 24-word seed there are only 8 possible last words left, which makes working through them straightforward.

And Monero?

I built the same thing for 25-word Monero seeds. You provide 23 words and the tool finds the 24th. The 25th word is always the checksum, calculated from the 24 words, and always one of the words already used. Things get a bit more involved here, especially if you want to use the recover function to build a seed the way the BTC Seed Helper allows. That comes down to the triplet encoding Monero uses. Technical details are in the tool.

Offline. Always. No Exceptions.

NEVER EVER enter real seeds into an online-connected webpage. Never ever never. Even better: never on an online-connected device at all.

These tools are, firstly, a demonstration of what is possible and, secondly, intended only for absolute emergencies. Picture this: you have to cross a border where you know the TLA (three-letter agency) will search your phone, probably copy it, and analyze it later. You do not want your real funds in a wallet whose keys are on a mobile device they can take from you.

If you want to take 5 bitcoin across a border, you need the wallet with you, and sometimes the only place for it is inside your head. That is where this helps:

pretty girl love flower rude boy run away woman have pink ring

Three word clusters that belong together and make internal sense. Or how about this for the journey, a Monero seed:

nurse aunt aunt aunt aunt aunt aunt aunt aunt aunt aunt aunt aunt aunt aunt aunt aunt aunt aunt aunt aunt aunt aunt aunt aunt

Easy to remember. Promise.

The BTC Seed Helper and XMR Seed Helper run entirely in the browser. No server, no outbound connection. Both can be downloaded as an offline file and used on an air-gapped device.

Hardware wallets are your friend. Always.

Peace out Alexander