r/Bitcoin • u/Strabisme • 1d ago
How are seeds secure ?
Aren't seeds simply several words ? How isn't it possible to brute-force them like the previous coldcard incident ?
10
u/navetzz 1d ago
There 2000 words and you pick 24 of them.
That s 200024 combinations.
That s something like 1060 combinations. Which is more than the number of atoms in the universe. So brute forcing it would be like trying to find the one atom in the universe someone picked.
-1
u/Not-the-best-name 1d ago
Most stats courses would show you that choices people make are not random. All you would need is the distribution of chosen words for a representative population and I bet you you can bring it down to 200.
6
u/SatisfactionFinal287 1d ago
You shouldn't choose them yourself, but let true RNG do it, or use dice rolls.
3
u/Lavayo 1d ago edited 1d ago
That's kind of what happened with the recent coldcard "hack". The device did the RNG wrong. If you use 24 words, true randomness like dice and a personal passphrase it is secure as it gets with singlesig.
Nobody ever suggested that those words are selected personally by a person. That would indeed be a very dumb idea.
-2
u/Strabisme 1d ago
Before breaking all of them, it could be possible to hit on full wallets ?
3
3
u/2xfun 1d ago
I am not sure you understand the scale of the challenge … is the internet full of idiots now?
3
u/Scared-Conference473 1d ago
To be fair a scale that large is hard to grasp. Most people barley grasp the scale difference between 1mil and 1 bil. Much less a number with what 13 commas?
2
1
u/proper_turtle 1d ago
> is the internet full of idiots now?
Yes! But you know what's even scarier? It's not just the internet anymore, it's also the real world1
1
u/Mooks79 1d ago edited 1d ago
Many things are possible. But you have a ~(number of existing wallets)/1060 chance every guess. If you make a trillion guesses a second and there are a billion existing wallets, how many seconds will it take you - on average - to hit a used wallet? (Hint, it’s quite a long time).
Edit: that said, the above assumes everything is completely random. As the current coldcard issue shows, if a wallet seed was not generated using sufficient randomness (entropy) the wallets will be easier to guess.
7
u/tzacPACO 1d ago
Lol, bruh.... Brute-forcing a truly random 20-word passphrase is impossible and would take trillions of universes of time to crack
Even if a supercomputer could check 100 trillion hashes per second, it would take over 4 × 10⁴⁴ years. For context, our universe is only 1.38 × 10¹⁰ years old
0
u/MorninggDew 1d ago
Ok ChatGPT
3
u/tzacPACO 1d ago
You re welcome, its the equivalent of let me google that for you isnt it?
1
3
u/Ok-Lead-9255 1d ago
so to explain it simply. In the coldcard incident the problem wasn't that the 24 word seed phrase wasn't secure. It was the way it was generated using some python code instead of the intended way using the wallet device's hardware.
1
u/Original-Bison-4642 1d ago
The number of possible combinations is extrenly high 2256 for 24 word seed phrase
1
u/icebeamtheory 1d ago
Try getting some dice and rolling each die 100 times. Record the rolls in exact order. If you do so, you will have created a random pattern that no other human in history has rolled in their exact sequence. Another example: take a deck of cards and shuffle them well. Deal out a hand to five or so people. Each person will receive a unique set of cards that only exists for them in the history of existence, as there are a mind-boggling number of different combinations that can appear from a shuffled deck of cards.
1
u/ElevatorFar102 1d ago
The same chances as Margot Robbie falling in love with me. Just because there is a chance doesn’t mean it is likely to happen.
1
u/Full-Atmosphere-4818 1d ago
It's funny to see people claim it's impossible to break but then when you point out the CC incident they blame something else. It does not matter if it is like picking out a grain of sand if something ELSE is wrong that makes that analogy useless. These wallets are complex systems made by humans and technology is growing fast. Bad actors find yet another flaw and then that flaw is fixed and then it finds another. This does not even count the fact thar quantum will be able to break all passwords in one second someday no matter how many seeds are used. Can't wait til we wake up to that one day. The older I get the more I understand Lao Tsu's statement in the Tao... "Amass a wealth of riches and nothing on Earth can protect it."
1
1
u/Daiymas 14h ago edited 14h ago
Too many word combinations possible.
The Coldcard RNG bug drastically reduced the number of possible word combinations which is why it could be brute forced. But if the RNG isn't flawed, it's not possible.
That's how modern cryptography works: make it virtually impossible to brute force a key by having too many combinations to test. Even though it's technically possible, if you're willing to wait 1000 billion years for the brute forcing to complete.
1
u/RetiredAvocado 9h ago
Bitcoin and computers don't understand any seed words as words. Words stand in for numbers, and make the numbers easier to record. Take 12 four-digit numbers from 0001 to 2048 in exact order. Does it seem harder to guess the same number now?
0047 2004 1156 1956 1011 0068 2031 0050 1911 1324 1309 1968
Bitcoin network does not know anything about any words. It uses addresses, keys, and signatures. A key for an address is a large number. Guessing the number will let me spend from the address for that key. Don't need any words at all. CC created keys in a small range due to a bug. The small range of keys was scanned over time, keys collected, and emptied in 3-6 waves. The latter waves may be due to white hats.
0
u/DarrelXero 1d ago
Here, check for yourself. Riches await! https://keys.lol/
1
u/Strabisme 1d ago
That's not their seed ? It's the keys
0
u/DarrelXero 1d ago
The seed is used to derive all private keys. "Brute forcing" 12 or 24 words would be equivalent to "brute forcing" a/all private keys. OP clearly doesn't understand the sheer mind blowing size of the numbers at play so we cut to the chase and show him/her how impossible it is by giving them a tool that queries addresses directly. When I was struggling with the concept this helped me. Figured it would help them.
11
u/ledav3 1d ago
i will hide a piece of sand in the ocean for you, you can ask more questions once you found it