Closed mflaxman closed 4 years ago
This is a fair point, and not that controversial really. The fact that there are several valid words does complicate things. And the added entropy is - as you point out - both minimal and easily brute-forceable. As I see it, the only issue is how to clearly communicate this decision to the user. We will try to work out a suggestion and take it from there!
While many words can serve as a checksum, the fact that a user who hits the
Calculate!
button twice will likely see two different results is very dangerous.How this can cause loss of funds:
Calculate!
Years later, the user goes to use this key in recovery (perhaps another key was lost) and discovers that the seed they wrote down doesn't have access to their funds (which was the whole point of using this tool)! While it is theoretically possible for them to then try all the different valid 24th words, they don't know to do this and lose their life savings :(
Obviously, there is a competing argument that using some deterministic scheme slightly reduces the entropy of their seed. If you think more critically, you realize this reduction is very small (and any motivated attacker with a script could brute-force these few possibilities). When weighted against the risk of loss of funds, this tradeoff seems very worthwhile. To mitigate this, I recommend the following:
My suggestion is to use the alphabetical first valid word. The alphabetical last word would also be a good choice.