4 ms·

this idea of making a predictable key doesn't seem advantageous at all. what if you can't remember whatever series of words you used to generate this not-very-s

this idea of making a predictable key doesn't seem advantageous at all. what if you can't remember whatever series of words you used to generate this not-very-secure key? you'd have to store those words somewhere..... and so you might as well store the whole key there. seems like a reliable way to back up your private keys would be to print it on matte or card stock, and optionally laminate it. to recover the key you just OCR it

vel0city 5y ago
Instead of printing the text, you might think about printing it as a large QR code or some other kind of digital medium that would make it easier to import it. QR codes are pretty resilient.
- djbusby 5y ago
  I have a folder full of secrets, in large QR format, in a safe. Various keys, password, account details. Takes a few seconds to make and when it was needed - totally worth all the little minutes it took to build the storage when it saved my bacon those few times.
MauranKilom 5y ago
In what format do you store the "whole key" there, so that you can type it in easily and quickly if required? You might argue that a situation where you have to open the safe with the printed-out key material cannot be particularly urgent, but apparently the author found it useful for this kind of situation.
- 0xbadcafebee 5y ago
  In the format of regular armored ASCII text that all .pem keys have. It doesn't take a whole lot of time to download an OCR program. I think Google Docs has had OCR for a decade. You go to your safe, take a picture of the printout, open it in google docs, and OCR the text. Takes, what, 60 seconds? 2 minutes max? Or like somebody else said, a QR code.
  - deleted 5y ago
    [deleted]
  - jtsiskin 5y ago
    A 12 word mnemonic phrase is worlds easier to use than that. You will download an OCR program, send the photo from your phone to the computer, and run OCR on it? Or you will upload your cold key onto google drive?
    - 0xbadcafebee 5y ago
      Easier to use, but less reliable. If you don't get the words right (years after you first created them) your key is gone. It's also less secure to depend on a set of words that a human can remember (and thus leak via rubber-hose crypto). There's versioning and other issues mentioned in the critique of the paper, leading to them recommending nobody use it. And no, you wouldn't send the photo from your phone to the computer, you'd do it all on a phone, off-line, and could then copy the key to a YubiKey from your phone.
Kubuxu 5y ago
See BIP39 for an established standard to creating a mnemonic sequences out of entropy: https://github.com/bitcoin/bips/blob/ad745f2f0155c90f0471ba87e8687e9891e8a63f/bip-0039.mediawiki https://github.com/bitcoin/bips/blob/ad745f2f0155c90f0471ba8...
- deleted 5y ago
  [deleted]
c7DJTLrn 5y ago
It's a nonsense project with no utility. And it's not exactly rocket science that running a memorable phrase through a KDF is going to be more predictable than an actual CSPRNG. This is crypto/security 101. There's a good reason we say "don't roll your own crypto" in this industry.

vel0city 5y ago

Instead of printing the text, you might think about printing it as a large QR code or some other kind of digital medium that would make it easier to import it. QR codes are pretty resilient.

djbusby 5y ago
I have a folder full of secrets, in large QR format, in a safe. Various keys, password, account details. Takes a few seconds to make and when it was needed - totally worth all the little minutes it took to build the storage when it saved my bacon those few times.

MauranKilom 5y ago

In what format do you store the "whole key" there, so that you can type it in easily and quickly if required? You might argue that a situation where you have to open the safe with the printed-out key material cannot be particularly urgent, but apparently the author found it useful for this kind of situation.

0xbadcafebee 5y ago
In the format of regular armored ASCII text that all .pem keys have. It doesn't take a whole lot of time to download an OCR program. I think Google Docs has had OCR for a decade. You go to your safe, take a picture of the printout, open it in google docs, and OCR the text. Takes, what, 60 seconds? 2 minutes max? Or like somebody else said, a QR code.
- deleted 5y ago
  [deleted]
- jtsiskin 5y ago
  A 12 word mnemonic phrase is worlds easier to use than that. You will download an OCR program, send the photo from your phone to the computer, and run OCR on it? Or you will upload your cold key onto google drive?
  - 0xbadcafebee 5y ago
    Easier to use, but less reliable. If you don't get the words right (years after you first created them) your key is gone. It's also less secure to depend on a set of words that a human can remember (and thus leak via rubber-hose crypto). There's versioning and other issues mentioned in the critique of the paper, leading to them recommending nobody use it. And no, you wouldn't send the photo from your phone to the computer, you'd do it all on a phone, off-line, and could then copy the key to a YubiKey from your phone.

Kubuxu 5y ago

See BIP39 for an established standard to creating a mnemonic sequences out of entropy: https://github.com/bitcoin/bips/blob/ad745f2f0155c90f0471ba87e8687e9891e8a63f/bip-0039.mediawiki https://github.com/bitcoin/bips/blob/ad745f2f0155c90f0471ba8...

deleted 5y ago
[deleted]

c7DJTLrn 5y ago

It's a nonsense project with no utility. And it's not exactly rocket science that running a memorable phrase through a KDF is going to be more predictable than an actual CSPRNG. This is crypto/security 101. There's a good reason we say "don't roll your own crypto" in this industry.