BIP 39 Replacement

[Rspigler]

Due to the issues with BIP39 and the objection from the Core devs, we at Yeti have come up with our own backup solution, that I thought I would share here for collaboration.

You can back up the WIF key or hdseed, and to help our users write it down, display it in the NATO phonetic alphabet with a checksum every 5th word. This then doesn't affect entropy (still relies entirely on Core), and is just a method of backing up/restoring. It also doesn't have any versioning issues.

This can be automated and stored on a CD/USB, or displayed on screen to be written down on a piece of paper.

This does obviously result in more words (instead of 24 words, you have 13 rows of 5 words each).

You can see a single sig wallet video walkthrough here: (https://www.youtube.com/watch?v=sjExNFcdVmo) 14:05-17:05

[ChristopherA]

This sounds interesting. I'd suggest that you consider using bytewords and UR style approaches instead of NATO phonetic — these words and validation were chosen very carefully for the UR PSBT.

Word selection criteria

• All words are English.
• All words are exactly 4 ASCII letters.
• No proper names.
• Prefer words in common usage.
• Avoid homophones and near homophones.
• Prefer two-syllable words.
• Each word's first three letters must be a unique sequence (XXX-).
• Each word's last three letters must be a unique sequence (-XXX).
• Each word's first and last letters must be a unique sequence (X--X).
• The Damerau-Levenshtein distance between any two words is at least 2.
• Prefer words with positive connotations.
• Prefer words which are "interesting" (strong emotional valence) even if connotation is neutral or slightly negative.
• Avoid words with strong negative connotations.
• Represent initial letters somewhat equally when possible.
• Word list is sorted alphabetically.

• Research and current spec: https://github.com/BlockchainCommons/Research/blob/master/papers/bcr-2020-012-bytewords.md
• Library: https://github.com/BlockchainCommons/bc-bytewords
• CLI: https://github.com/BlockchainCommons/bc-bytewords-cli

As the UR PSBT uses bytewords (in their compact form), it is a library that wallets will need to adopt anyhow.

[Rspigler]

Interesting! Will look into it, thanks

[ChristopherA]

/cc @wolfmcnally @Fonta1n3

[Fonta1n3]

I dont think its ever a good idea to encourage users to back up individual private keys, I think bip32 and bip39 serve their purposes quite well. The nuances that the bitcoin core devs site to critique bip39 are not significant enough to justify not using it, the benefits to using are immense in comparison to the impractical downsides and now Bitcoin Core is perfectly usable in conjunction with bip39.

[Rspigler]

Let me explain better:

1. Create address
2. Get WIF key
3. Create new wallet, with WIF key set as hdseed
4. Dump the xpriv
5. Repeat Steps 1-4 Y times to get Y unique xprivs from Y unique hdseeds
6. Create multisig wallet using descriptor containing all Y xprivs (X of Y multisig)
7. Use the Y WIF keys, written in NATO phonetic alphabet as backup (along with the public-key only descriptor)

This could be refactored a bit cleaner to do:

1. Create wallet (hd is default)
2. Dump the hdseed
3. Create address, drump xpriv
4. Do Steps 1-3 Y times
5. Create multisig wallet using descriptor containing all Y xprivs (X of Y multisig)
6. Use the Y hdseeds, written in NATO phonetic alphabet as backup (along with the public-key only descriptor)

We currently use the first example in Yeti if you want to look at the code. This is because the hdseed wasn't in dumpwallet previously. So we set it ourselves.

So all this really is, is a better way (IMO) to back up BIP32.

[Fonta1n3]

Apart from the backup method which I see as inferior to bip39, I would still strongly disagree with this flow for many reasons.

Most significantly:

• By using the same instance of bitcoind to create each seed and then importing all xprv's in a single descriptor you are completely losing all of the major benefits of multisig. (avoiding single points of failure)

• This method would not allow you to recreate the HD wallet as watch-only on any other device as Bitcoin Core only directly supports hardened derivation.

[Rspigler]

using the same instance of bitcoind

That's an implementation detail of how we happen to set up (some of) our multisig wallets. We have different levels of security and there's no reason to get into that here, but nothing prevents setting up a multi-device multi-signature wallet using this backup scheme. Ultimately, that's all I'm trying to discuss here (the new backup scheme for the BIP32 seed).

This method would not allow you to recreate the HD wallet as watch-only

To recreate a watch-only wallet, you need the Account Map (the xpub-only descriptor). That's something entirely different (and we also do). What we are discussing here is how to backup/recover the wallet private seed.

[bitcoinhodler]

A WIF normally represents a single privkey. Using it as hdseed is nonstandard and therefore seems likely to confuse. (I'm thinking about heirs who discover the deceased's printed WIF keys.)

One advantage is that it's much shorter than an xprv.

[Rspigler]

Yes, we will be using hdseed in the a later refactor.
The backup idea still applies (writing it in the NATO phonetic alphabet with a checksum).