cc375c3d3294d3e3a418afd395da1b66c25ca9
1 Received: from sog-mx-3.v43.ch3.sourceforge.com ([172.29.43.193] 2 helo=mx.sourceforge.net) 3 by sfs-ml-4.v29.ch3.sourceforge.com with esmtp (Exim 4.76) 4 (envelope-from <thomasv@electrum.org>) id 1YViHV-0006fB-1d 5 for bitcoin-development@lists.sourceforge.net; 6 Wed, 11 Mar 2015 15:10:45 +0000 7 X-ACL-Warn: 8 Received: from slow1-d.mail.gandi.net ([217.70.178.86]) 9 by sog-mx-3.v43.ch3.sourceforge.com with esmtp (Exim 4.76) 10 id 1YViHO-0007mh-Lf for bitcoin-development@lists.sourceforge.net; 11 Wed, 11 Mar 2015 15:10:45 +0000 12 Received: from relay3-d.mail.gandi.net (relay3-d.mail.gandi.net 13 [217.70.183.195]) 14 by slow1-d.mail.gandi.net (Postfix) with ESMTP id D91ED47A338 15 for <bitcoin-development@lists.sourceforge.net>; 16 Wed, 11 Mar 2015 15:58:17 +0100 (CET) 17 Received: from mfilter38-d.gandi.net (mfilter38-d.gandi.net [217.70.178.169]) 18 by relay3-d.mail.gandi.net (Postfix) with ESMTP id 34035A80BC; 19 Wed, 11 Mar 2015 15:58:09 +0100 (CET) 20 X-Virus-Scanned: Debian amavisd-new at mfilter38-d.gandi.net 21 Received: from relay3-d.mail.gandi.net ([217.70.183.195]) 22 by mfilter38-d.gandi.net (mfilter38-d.gandi.net [10.0.15.180]) 23 (amavisd-new, port 10024) 24 with ESMTP id wnC4RqHBxJx2; Wed, 11 Mar 2015 15:58:07 +0100 (CET) 25 X-Originating-IP: 78.52.85.214 26 Received: from [192.168.1.45] (f052085214.adsl.alicedsl.de [78.52.85.214]) 27 (Authenticated sender: thomasv@electrum.org) 28 by relay3-d.mail.gandi.net (Postfix) with ESMTPSA id EBAFBA80F2; 29 Wed, 11 Mar 2015 15:58:05 +0100 (CET) 30 Message-ID: <550057FD.6030402@electrum.org> 31 Date: Wed, 11 Mar 2015 15:58:05 +0100 32 From: Thomas Voegtlin <thomasv@electrum.org> 33 User-Agent: Mozilla/5.0 (X11; Linux x86_64; 34 rv:31.0) Gecko/20100101 Thunderbird/31.4.0 35 MIME-Version: 1.0 36 To: Mike Hearn <mike@plan99.net> 37 References: <54F32EED.6040103@electrum.org> 38 <CANEZrP23buJF0ENfrKGRuzpQ3Uod09s-kRcb3CBw1-OmUxEyZg@mail.gmail.com> 39 In-Reply-To: <CANEZrP23buJF0ENfrKGRuzpQ3Uod09s-kRcb3CBw1-OmUxEyZg@mail.gmail.com> 40 Content-Type: text/plain; charset=utf-8 41 Content-Transfer-Encoding: quoted-printable 42 X-Spam-Score: 0.0 (/) 43 X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. 44 See http://spamassassin.org/tag/ for more details. 45 X-Headers-End: 1YViHO-0007mh-Lf 46 Cc: Bitcoin Development <bitcoin-development@lists.sourceforge.net> 47 Subject: Re: [Bitcoin-development] Electrum 2.0 has been tagged 48 X-BeenThere: bitcoin-development@lists.sourceforge.net 49 X-Mailman-Version: 2.1.9 50 Precedence: list 51 List-Id: <bitcoin-development.lists.sourceforge.net> 52 List-Unsubscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>, 53 <mailto:bitcoin-development-request@lists.sourceforge.net?subject=unsubscribe> 54 List-Archive: <http://sourceforge.net/mailarchive/forum.php?forum_name=bitcoin-development> 55 List-Post: <mailto:bitcoin-development@lists.sourceforge.net> 56 List-Help: <mailto:bitcoin-development-request@lists.sourceforge.net?subject=help> 57 List-Subscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>, 58 <mailto:bitcoin-development-request@lists.sourceforge.net?subject=subscribe> 59 X-List-Received-Date: Wed, 11 Mar 2015 15:10:45 -0000 60 61 Thanks Mike, and sorry to answer a bit late; it has been a busy couple 62 of weeks. 63 64 You are correct, a BIP39 seed phrase will not work in Electrum, and vice 65 versa. It is indeed unfortunate. However, I believe BIP39 should not be 66 followed, because it reproduces two mistakes I did when I designed the 67 older Electrum seed system. Let me explain. 68 69 The first problem I have with BIP39 is that the seed phrase does not 70 include a version number. 71 72 Wallet development is still in an exploratory phase, and we should 73 expect even more innovation in this domain. In this context, it is 74 unwise to make decisions that prevent future innovation. 75 76 However, when we give a seed phrase to users, we have a moral obligation 77 to keep supporting this seed phrase in future versions. We cannot simply 78 announce to Electrum users that their old seed phrase is not supported 79 anymore, because we created a new version of the software that uses a 80 different derivation. This could lead to financial losses for users who 81 are unaware of these technicalities. Well, at least, that is how I feel 82 about it. 83 84 BIP39 and Electrum v2 have a very different ways of handling future 85 innovation. Electrum v2 seed phrases include an explicit version number, 86 that indicates how the wallet addresses should be derived. In contrast, 87 BIP39 seed phrases do not include a version number at all. BIP39 is 88 meant to be combined with BIP43, which stipulates that the wallet 89 structure should depend on the BIP32 derivation path used for the wallet 90 (although BIP43 is not followed by all BIP39 compatible wallets). Thus, 91 innovation in BIP43 is allowed only within the framework of BIP32. In 92 addition, having to explore the branches of the BIP32 tree in order to 93 determine the type of wallet attached to a seed might be somewhat 94 inefficient. 95 96 The second problem I see with BIP39 is that it requires a fixed 97 wordlist. Of course, this forbids innovation in the wordlist itself, but 98 that's not the main problem. When you write a new standard, it is 99 important to keep this standard minimal, given the goal you want to 100 achieve. I believe BIP39 could (and should) have been written without 101 including the wordlist in the standard. 102 103 There are two ways to derive a master key from a mnemonic phrase: 104 1. A bidirectional mapping between words and numbers, as in old 105 Electrum versions. Pros: bidirectional means that you can do Shamir 106 secret sharing of your seed. Cons: It requires a fixed wordlist. 107 2. Use a hash of the seed phrase (pbkdf). Pros: a fixed wordlist is not 108 required. Cons: the mapping isn't bidirectional. 109 110 Electrum v1 uses (1). Electrum v2 uses (2). 111 112 Early versions of BIP39 used (1), and later they switched to (2). 113 However, BIP39 uses (2) only in order to derive the wallet keys, not for 114 its checksum. The BIP39 checksum uses (1), and it does requires a fixed 115 wordlist. This is just plainly inconsistent. As a result, you have 116 neither wordlist flexibility, nor Shamir secret sharing. 117 118 Having a fixed wordlist is very unfortunate. First, it means that BIP39 119 will probably never leave the 'draft' stage, until all languages of the 120 world have been added. Second, once you add a wordlist for a new 121 language, you cannot change it anymore, because it will break existing 122 seed phrases; therefore you have to be extremely careful in the way you 123 design these wordlists. Third, languages often have words in common. 124 When you add a new language to the list, you should not use words 125 already used by existing wordlists, in order to ensure that the language 126 can be detected. It leads to a first come first served situation, that 127 might not be sustainable in the future. 128 129 In order to support the old Electrum v1 seeds, all future versions of 130 Electrum will have to include the old wordlist. In addition, when 131 generating new seed phrases, Electrum now has to avoid collisions with 132 old seed phrases, because the old ones did not have a version number. 133 This is painful enough, I will not repeat the same errors twice. 134 135 Electrum v2 derives both its private keys and its checksum/version 136 number using a hash of the seed phrase. This means that wordlists can be 137 added and modified in the future, without breaking existing seed 138 phrases. It also means that it will be very easy for other wallets to 139 support Electrum seedphrases: it requires about 20 lines of code, and no 140 wordlist is required. 141 142 143 Thomas 144 145 146 Le 02/03/2015 16:37, Mike Hearn a =C3=A9crit : 147 > Congrats Thomas! Glad to see Electrum 2 finally launch. 148 >=20 149 >=20 150 >> * New seed derivation method (not compatible with BIP39). 151 >=20 152 >=20 153 > Does this mean a "12 words" wallet created by Electrum won't work if 154 > imported into some other wallet that supports BIP39? Vice versa? This s= 155 eems 156 > unfortunate. I guess if seeds are being represented with 12 words 157 > consistently, people will expect them to work everywhere. 158 >=20 159 160