1

Given a 24 word BIP39 mnemonic phrase, I would like to have a way to split it into 5 shares, so that any 3 would allow me to reconstruct the phrase (but any less than 3 would not).

This is easy enough to do with Shamir Secret Sharing, and very secure. But that requires, at the minimum, a computer, and I would rather have a way to achieve the same (or something similar) with only a pen and paper (and let's say not more than an hour's work).

Now, I don't mind it being slightly less secure, in the sense that obtaining 2 of the 5 shares makes it easier to guess any of the other 3, as long as the difficulty is reasonable (e.g. 90 bits entropy). I feel like a 24 word phrase is really entropy overkill, and a third of that entropy is, by itself, quite a lot and sufficient for my purposes.

Ideas?

1 Answers1

0

Figured out a solution that can easily be done with a pen and paper and at most a pocket calculator.

You take your secret (264 bits) and divide into 6 equal-length parts. Call them A, B, C, D, E, F.

For brevity I write XY as meaning X xor Y. Share 1: A,B Share 2: C,D Share 3: E,F Share 4: CE,AF,BD (remember these are xors) Share 5: ABCE,ACDF,BDEF

Now with a bit of xoring any 3 of these give you the entire secret. I'll write a proper blog post with instructions exactly how to combine shares and a proof that it's reliable.

Downside is that unlike SSSS, each share is only 1/3 of the entropy, so if someone has two of the five shares, it's only 2**88 attempts to guess the third. Still, 88 bit entropy by itself is not bad at all, at least in my book.

Also, unlike SSSS, the "order" of shares is important. You need to note beside each share which it's supposed to be (S1, S2...) so you know what sort of xoring to do.

What do you think? Any other weakness in this?