I'm working on a safe way to store a mnemonic key.

  • It's 24 words long.
  • Each word is 11 bits of entropy, based on a standard word-list
  • I want to store it in 3 locations
  • One plate should not allow you to unlock the code
  • Two plates should allow you to unlock the code

Now to the interesting challenges

  • If I die, I want my loved ones to be able to extract the mnemonic keys. They know nothing of cryptography.
  • To protect it from fire, I'm etching it on metallic plates so the instructions for unlocking can't be to long or complicated.
  • I want it to last for at least 100 years, so I can't rely on any current computer software.

My first idea was to just leave 8 different words out of each plate, but that is just 88 bits of entropy, too little to crack (or is it?). There are also tools to do Shamir's Secret Sharing Scheme, with mnemonic phrases, but it's not really something you do without a computer.

Is there some other good way to increase the bits of entropy without too much complication? Maybe mixing up the words or add extra words or something?

  • 3
    I don't know of a way to do this without computers, as you mention in the title. I do however know of Shamir's Secret Sharing Scheme which is exactly what you're looking for. – Luc Oct 13 '17 at 14:42
  • 2
    I also point out that in 50 years, if someone gets 1/3 of your passphrase of 24 words, they will likely be able to bruteforce your password quickly anyways. – schroeder Oct 13 '17 at 14:55
  • 1
    Shamir's secret sharing is pretty easy to compute, even without computers. (But storing the dictionary for the encoding as words is a problem) – CodesInChaos Oct 13 '17 at 15:13
  • 2
    What are the recipients supposed to do with the key without a computer? – CodesInChaos Oct 13 '17 at 15:16
  • 1
    Why does the key have to be mnemonic? After all, you are writing it down. – Anders Oct 14 '17 at 10:54
up vote 7 down vote accepted

I propose plates with the following instructions, a decoding table, and a block of monospaced text (different on the three plates), as follows:

Take two plates and combine the text at their bottom, letter by letter, using the following decoding table, in order such that the first decoded character is . (figuring space). Ignore it, then decode the rest in the same manner to obtain the passphrase.

    | A B C D E F G H I J K L M N O P Q R S T U V W X Y Z .
----+------------------------------------------------------
- A | A B C D E F G H I J K L M N O P Q R S T U V W X Y Z .
- B | C A B F D E I G H L J K O M N R P Q U S T X V W . Y Z
- C | B C A E F D H I G K L J N O M Q R P T U S W X V Z . Y
- D | G H I A B C D E F P Q R J K L M N O Y Z . S T U V W X
- E | I G H C A B F D E R P Q L J K O M N . Y Z U S T X V W
- F | H I G B C A E F D Q R P K L J N O M Z . Y T U S W X V
- G | D E F G H I A B C M N O P Q R J K L V W X Y Z . S T U
- H | F D E I G H C A B O M N R P Q L J K X V W . Y Z U S T
- I | E F D H I G B C A N O M Q R P K L J W X V Z . Y T U S
- J | S T U V W X Y Z . A B C D E F G H I J K L M N O P Q R
- K | U S T X V W . Y Z C A B F D E I G H L J K O M N R P Q
- L | T U S W X V Z . Y B C A E F D H I G K L J N O M Q R P
- M | Y Z . S T U V W X G H I A B C D E F P Q R J K L M N O
- N | . Y Z U S T X V W I G H C A B F D E R P Q L J K O M N
- O | Z . Y T U S W X V H I G B C A E F D Q R P K L J N O M
- P | V W X Y Z . S T U D E F G H I A B C M N O P Q R J K L
- Q | X V W . Y Z U S T F D E I G H C A B O M N R P Q L J K
- R | W X V Z . Y T U S E F D H I G B C A N O M Q R P K L J
- S | J K L M N O P Q R S T U V W X Y Z . A B C D E F G H I
- T | L J K O M N R P Q U S T X V W . Y Z C A B F D E I G H
- U | K L J N O M Q R P T U S W X V Z . Y B C A E F D H I G
- V | P Q R J K L M N O Y Z . S T U V W X G H I A B C D E F
- W | R P Q L J K O M N . Y Z U S T X V W I G H C A B F D E
- X | Q R P K L J N O M Z . Y T U S W X V H I G B C A E F D
- Y | M N O P Q R J K L V W X Y Z . S T U D E F G H I A B C
- Z | O M N R P Q L J K X V W . Y Z U S T F D E I G H C A B
- . | N O M Q R P K L J W X V Z . Y T U S E F D H I G B C A
EKIAIJEBRP.ZOXHAOLKXMBWSPENLGKIIJYRDEYJQYOYISHMLQPRPNHKEPHNOLOMBCRDMGNXRSHBCQOVZFNIRIQFGPONEFDXAO.ILFHLCJEPVC..K
RTXAYBREAOWMYWXAWVYYXDIUBUSHKMVQWMJWVBHDBDNNEIBANTFECVXE.LVAFYBIMLTBD.PNYLCCCYNUN.XUJPVGQE.CFHPNRMYRPPLBBATDXMMG
SBLAQUSHWKSCBVJADHFTEIJTXPIVXRKYIANOOOXUOWCSRG.TKFUUYLGEHVFZ.B.DZOR.AABJVVACVBFVVALFWRNGRVAGFCB.LBQOT.LAUIFMRBBX

(Each plate has only one of the three above blocks of text).


This decodes to (including the leading .to be ignored)

.SMALL.GREEN.BOAT.WITH.BROWN.HOT.MILK.ON.LOW.COLD.MOON.AT.TOP.OF.GOOD.RED.CAR.LIT.MY.BLACK.FAIR.GOLD.TABLE.SPOON

This is a manual Shamir secret sharing performed on the individual letters of the passphrase, using a Latin square. I'll introduce the principle with an example using 3 symbols, before describing the full system.

If the key was composed of n digits among 012, noted Kj where 1 ≤ jn , e.g. 120221.. we could proceed as follows:

  • one plate is marked E followed by n random digits among 012, noted Ej,
      e.g. E012101..
  • one plate is marked R followed by n digits among 012, noted Rj, with
      Rj = (3 + Ej - Kj) % 3;   [where % is the modulo operator]
      e.g. R222210..
  • one plate is marked S followed by n digits among 012, noted Sj, with
      Sj = (3 + Rj - Kj) % 3;
      e.g. S102022..

To recover the key for any two plates, use that
    Kj = (3 + Ej - Rj) % 3;
    Kj = (3 + Rj - Sj) % 3;
    Kj = (3 + Sj - Ej) % 3;
depending on which plates are used. This recovers the key. Each plate in isolation is random, thus gives no clue at all about the key.

Equivalently, encoding and decoding can use this subtraction table:

    | 0 1 2
----+------
- 0 | 0 1 2
- 1 | 2 0 1
- 2 | 1 2 0

This is adapted to more than three symbols by representing them in base 3. The 26 letters and the special sign . (for space) can be written as three digits in base 3, with the alphabet ABCDEFGHIJKLMNOPQRSTUVWXYZ. represented by 000 to 222. The table for subtraction ( - ) is the one on the plates.

One plate has uniformly random characters ABCDEFGHIJKLMNOPQRSTUVWXYZ. except the first is E, and the other two plates are prepared from the key, with a dummy K0 set to ..

    Rj = Ej - Kj
    Sj = Rj - Kj

Decoding is per the equations:

    Kj = Ej - Rj
    Kj = Rj - Sj
    Kj = Sj - Ej

The E R S at start of the plates allow identifying them, and lead to the decryption of . as the first character.

  • Really interesting, though, since there is a predefined wordlist, won't that limit the possible words, even if you just have one wordlist? – Himmators Oct 14 '17 at 12:11
  • 1
    @Himmators: the method works without limitation in the phrase/wordlist, beyond being composable from the 26 usual letters plus space. – fgrieu Oct 14 '17 at 19:50
  • +1, pretty clever! Ps. In case you didn't notice yet, there's a question over at crypto.SE asking for a more detailed explanation of how you constructed this table. Unfortunately I don't have time to write one myself, but perhaps you might like to. – Ilmari Karonen Oct 8 at 1:43

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.