3 ms·

How is it different from having a private key + mnemonic phrase split between three persons? Once you have your private key stolen, you can recover your mnemoni

by Udik 6y ago

How is it different from having a private key + mnemonic phrase split between three persons? Once you have your private key stolen, you can recover your mnemonic phrase and transfer your funds to another wallet. Of course, this needs to happen before the thief can do the same, but this is not different from the proposed "social recovery wallet". The problem is that transactions are a one-time, irreversible operation. I wonder if it would be possible to: a) create wallets with an unchangeable per-transaction spending limit; b) with the need to have transactions above a set amount to be confirmed after a set amount of time, with an email or other type of messaging sent between first and second confirmation. (edit): The messaging part is impossible, as the blockchain cannot be aware if the message was actually sent- the miner could say it was and there's no check. But an app could observe the blockchain and notify the wallet owner of the transaction request.

jhardy54 6y ago
One important difference: you can set the quorum. If you just take a key (or phrase) and split it between 5 trusted folks, there's no way to say "a quorum of 3 people must be present to get my key back".
- Udik 6y ago
  I believe it just depends on how you split it, right? You can split it so that each subgroup of three out of the five can reconstruct the entire phrase. Slight change to the idea above: - wallet with a daily limit for transactions that don't need a second confirmation a day apart. - need for a second confirmation one day apart for transactions over said limit. - "social recovery key" able to immediately bypass all limits. So for daily use you can set your limit in such a way that you can perform immediate transactions. Bigger transactions (such as all your money) need to be confirmed a second time after 24 hours. During that time, a transaction request is written on the blockchain and can be observed by your wallet app. If someone steals your private key they can only transfer amounts within the daily limit, or trigger a warning by attempting to transfer more. If your private key is stolen, you can use a "social recovery key" that bypasses all limits and can be used to transfer your entire amount to a new wallet. What do you think?
  - jhardy54 6y ago
    > You can split it so that each subgroup of the five can reconstruct the entire phrase. How? Example: Split a secret phrase ("correct horse battery staple") between 4 friends with a quorum of 2. - Alice: correct - Bob: horse - Carol: battery - Dave: staple Great! But that's a quorum of 4. How do we reduce it to 2? Each person needs two words: - Alice: correct horse - Bob: battery staple - Carol: correct horse - Dave: battery staple But what if Alice and Carol want to get the secret? Or Bob and Dave? Well, each person needs the entire secret. - Alice: correct horse battery staple - Bob: correct horse battery staple - Carol: correct horse battery staple - Dave: correct horse battery staple ...but now the quorum is 1, and all of them just have a copy of your secret. If you want to be able to have arbitrary quorums, you need cryptography.
    - Udik 6y ago
      Secret phrases are (typically) made of between 12 and 24 words.
      - jhardy54 6y ago
        Please try the above examples with 12 or 24 words if you think that will make it easier. Example: Secret: either "a b c d e f g h i j k l" or "a b c d e f g h i j k l m n o p q r s t u v w x" Participants: Alice, Bob, Carol, Dave Quorum: 2 Which parts of the secret does each participant receive? Every combination of participant pairs must be able to recreate the full secret No single participant may have the full secret. --- HN won't let me reply to the below comment so I'll copy and paste here: > It's actually trivially possible [...] for [...] very long (60 words+) passphrases. It is not. It doesn't matter if your passphrases is 6000 words, you can't have 4 participants with a quorum of 2. > https://iancoleman.io/slip39/ https://iancoleman.io/slip39/ This uses the exact cryptography that I said you'd need. This isn't just "mnemonic phrase split between three person's", it's literally Shamir's Secret Sharing.
        Udik 6y ago
        It's actually trivially possible but the entropy for each shard will be abysmally low, requiring very long (60 words+) passphrases. So you're right, there's no trivial way (by hand) to split a 24 passphrase in 5 shards. However, it feels like a detail: such sharding is possible even if it's not trivial: https://iancoleman.io/slip39/ https://iancoleman.io/slip39/

by Udik 6y ago

jhardy54 6y ago

One important difference: you can set the quorum. If you just take a key (or phrase) and split it between 5 trusted folks, there's no way to say "a quorum of 3 people must be present to get my key back".

Udik 6y ago
I believe it just depends on how you split it, right? You can split it so that each subgroup of three out of the five can reconstruct the entire phrase. Slight change to the idea above: - wallet with a daily limit for transactions that don't need a second confirmation a day apart. - need for a second confirmation one day apart for transactions over said limit. - "social recovery key" able to immediately bypass all limits. So for daily use you can set your limit in such a way that you can perform immediate transactions. Bigger transactions (such as all your money) need to be confirmed a second time after 24 hours. During that time, a transaction request is written on the blockchain and can be observed by your wallet app. If someone steals your private key they can only transfer amounts within the daily limit, or trigger a warning by attempting to transfer more. If your private key is stolen, you can use a "social recovery key" that bypasses all limits and can be used to transfer your entire amount to a new wallet. What do you think?
- jhardy54 6y ago
  > You can split it so that each subgroup of the five can reconstruct the entire phrase. How? Example: Split a secret phrase ("correct horse battery staple") between 4 friends with a quorum of 2. - Alice: correct - Bob: horse - Carol: battery - Dave: staple Great! But that's a quorum of 4. How do we reduce it to 2? Each person needs two words: - Alice: correct horse - Bob: battery staple - Carol: correct horse - Dave: battery staple But what if Alice and Carol want to get the secret? Or Bob and Dave? Well, each person needs the entire secret. - Alice: correct horse battery staple - Bob: correct horse battery staple - Carol: correct horse battery staple - Dave: correct horse battery staple ...but now the quorum is 1, and all of them just have a copy of your secret. If you want to be able to have arbitrary quorums, you need cryptography.
  - Udik 6y ago
    Secret phrases are (typically) made of between 12 and 24 words.
    - jhardy54 6y ago
      Please try the above examples with 12 or 24 words if you think that will make it easier. Example: Secret: either "a b c d e f g h i j k l" or "a b c d e f g h i j k l m n o p q r s t u v w x" Participants: Alice, Bob, Carol, Dave Quorum: 2 Which parts of the secret does each participant receive? Every combination of participant pairs must be able to recreate the full secret No single participant may have the full secret. --- HN won't let me reply to the below comment so I'll copy and paste here: > It's actually trivially possible [...] for [...] very long (60 words+) passphrases. It is not. It doesn't matter if your passphrases is 6000 words, you can't have 4 participants with a quorum of 2. > https://iancoleman.io/slip39/ https://iancoleman.io/slip39/ This uses the exact cryptography that I said you'd need. This isn't just "mnemonic phrase split between three person's", it's literally Shamir's Secret Sharing.
      - Udik 6y ago
        It's actually trivially possible but the entropy for each shard will be abysmally low, requiring very long (60 words+) passphrases. So you're right, there's no trivial way (by hand) to split a 24 passphrase in 5 shards. However, it feels like a detail: such sharding is possible even if it's not trivial: https://iancoleman.io/slip39/ https://iancoleman.io/slip39/