Proposal: Base58 encoded HD Wallet root key with optional encryption

The spec has been updated a bit.

Even if the bulk of the key-stretching work has been outsourced to another device, and that device is compromised, the passphrase is now protected by minimum 8192 rounds of salted PBKDF2-HMAC-SHA512.

The idea is that more powerful devices (mobile phones, laptops, etc.) can do all the key-stretching on their own, whereas weaker devices with access to another device with more computing power (like Trezors) do a fair amount of key-stretching on their own, but can safely export the rest of the key-stretching to the other device.

Will

On Tue, Mar 11, 2014 at 10:17 PM, Jean-Paul Kogelman < jeanpaulkogelman@me•com> wrote:

> Hi everyone,
>
> We've been hard at work updating the spec to include features that were
> requested. We've removed the Scrypt dependency that was present in the
> initial drafts, added new KDFs, added plausible deniability and have a
> reference implementation.
>
>
> Kind regards,
>
>
> Jean-Paul Kogelman
>

Gmaxwell pointed out that we could safely front-load all the key pre-stretching. The spec has been updated to take advantage of this.

The user's password is now protected by 10,000 rounds of salted PBKDF2-HMAC-SHA512, as well as the main KDF (which ranges from scrypt 2^14/8/8 to scrypt 2^18/16/16 and PBKDF2-HMAC-SHA512 2^16 to 2^21).

Will

On Mon, Apr 21, 2014 at 7:05 PM, William Yager <will.yager@gmail•com> wrote:

>
> The idea is that more powerful devices (mobile phones, laptops, etc.) can
> do all the key-stretching on their own, whereas weaker devices with access
> to another device with more computing power (like Trezors) do a fair amount
> of key-stretching on their own, but can safely export the rest of the
> key-stretching to the other device.
>