<p>Appending numbers doesn't open you up to any particular vulnerability, but using any human derived private key is an extremely poor idea. Markov chains are extraordinarily good at attacking passphrases, which is counter intuitive when most people assume an exhaustive search character by character.</p>

CC BY-SA 3.0
2015-07-01T01:38:48.597Z
2015-07-01T01:38:48.597Z
Claris
<p>Be sure to take an old computer that you intend to decommission and use it "exclusively" for key generation.  Don't ever use your key generation platform in a "periods processing" mode, nor save synthesized keys on the key generation platform. If a Web browser Javascript key generator is used, be sure to clear your browser's cache afterwards. Never have key generator computer connect to any network from the 1st day it is used to operationally synthesize keys. Never have a printer print unencrypted private keys in either text or QR code image form. For example, a rogue <a href="https://github.com/glassechidna/zxing-cpp" rel="nofollow">ZXing</a> application can easily applied to scan QR images for the raw private keys.</p>

<p>Be sure your key generation computing platform has all the key generation software you intend to use installed on it and have backup key generation S/W that won't ever touch a networked machine again.  Don't even think about sneaker netting a thumb drive containing keys. Secure the S/W in a similar fashion as the key generating platform, but keep them separated. </p>

<p>Have your old computer generate QR codes that you optically scan that are out of sight from others, and above all ensure your old computer is physically secure or destroyed after you no longer intend to use it. This "data diode" key generation approach should afford you substantial security.</p>

<p>Picking a passphrase with high entropy is very important!  Be sure to include at least a few extra oddball special characters that are spread out such as: !@#$%^&amp;*(){}[]. Entropy can be improved by cryptographically hashing (e.g., SHA256) your passphrase you can remember yourself and then performing one or more nonlinear operations to create more complex data to seed the brain wallet. Specific details for performing such nonlinear operations should not be shared with others. </p>

<p>For an example of nonlinear operations, let's use say the first 13 hexidecimal characters of a SHA256 operation's results are used to prefix the original passphrase and say the last 29 hexidecimal characters to the right side of the hash are used to postfix to right of your original phrase or transpose the previously described prefix or postfix. And/or possibly look for a repeating adjacent characters to delimit a prefix and postfix hexidecimal numbers for your original passphrase. </p>

<p>Repeat this whole brain wallet synthesis process many times over the course of a few days to be absolutely certain your complex base passphrase used to seed your brain wallet can be reconstructed successfully by ensuring your public addresses associated with you brain wallet are the same. Rushing the generation of of an effective brain wallet seed is your enemy...</p>

<p>Then for good measure, postfix and/or prefix your complex base passphrase again with a sequential number as you did to make it easier to make subsequent brain wallets. </p>

<p>Your brain wallet(s) can also be used as a seed for a BIP38 AES encoded paper wallet to that won't need as much password entropy as long as they are not exposed to the Internet and it is kept in a safe place. People can't tell how much money is in your BIP38 wallets as long as you don't store companion public addresses with them. Only print BIP38 AES encoded keys with a printer that you are not so sure you can trust. Once the a portion of a cold wallets funds are imported into a hot wallet, the cold wallet is no nonger cold. It is at least lukewarm...</p>

<p>If you are using a Javascript branwallet key generator, be sure to save the code for reuse possibly a decade or so later. For key process generation integrity purposes to ensure you won't burn swept funds, apply other key generator S/W to confirm that a given private key generated from the initial brain wallet can be used to create an identical public address.</p>

<p>Additionally, it very difficult for a crook to hold you for ransom for your brain wallet described above because it will take considerable time to synthesize and require proper computing resources.</p>

<p>I've been doing something like what was stated above for several years... It is a very secure approach as long as you are sure you don't burn any coins when performing your sweeps to a bad public address that you may have accidentally associated with one of your cold wallet's private key. </p>

<p>Ensuring the integrity of public keys from your key generator to you hot wallet is critical. I use my cell phone or tablet's QR code scanner to reliably capture public key addresses. When texting captured QR codes across a network to another wallet performing sweeps to the cold wallet, you'll need to ensure the integrity of the public address sent across a network before performing sweeps.</p>

<p><a href="http://point-at-infinity.org/ssss/" rel="nofollow">Shamir's secret</a> can also be applied to create a process to reconstitute wallets in case of death for heirs to inherit.  This is a poor man's off-blockchain multisig.  A sealed will could be used as a vehicle to reveal the m of n extra shared secret information to reconstitute the shared secrets. Don't reveal how big m is of n to others. Plus since you have a brain/BIP 38 wallet you can change your will's allocations when heirs piss you off... </p>

CC BY-SA 3.0
2015-07-01T04:04:57.357Z
2015-07-01T04:04:57.357Z
skaht
<p>The only real problem with the approach is that whilst the first password may (with very low probability) be secure enough, the others are effectively the same password. If <code>long_and_complex_enough_but_yet_easy_to_remember_passphrase</code> is ever compromised by whatever means (spyware, untrustworthy confidant, you publishing the clever recipe in a blog post), then the next step for the person would be to iterate through:</p>

<pre><code>long_and_complex_enough_but_yet_easy_to_remember_passphrase[0-9a-zA-Z]{1,6}
</code></pre>

<p>as well which wouldn't take very long. Since humans are bad entropy generators we value pieces of memorable high entropy output so much we tend to reuse it (the above approach counts as reuse), which is one of the biggest weaknesses of the brain wallet approach. Reversing the phrase, changing capitalization, introducing l33t, etc are all variations of the same password that would occur just as easily to someone who effectively a professional at coming up with these.</p>

<p>At the end of the day, you wouldn't scrap your super clever password as readily as you would the bunch of characters that come from a CSPRNG. </p>

CC BY-SA 3.0
2016-02-13T07:30:02.040Z
2016-02-13T07:30:02.040Z
jeteon
<p>Let's suppose I derive a private-public keypair from a passphrase like this : </p>

<p>long_and_complex_enough_but_yet_easy_to_remember_passphrase</p>

<p>Now I wish to generate 100 more keypairs using same passphrase, so I append consecutive numbers : </p>

<p>long_and_complex_enough_but_yet_easy_to_remember_passphrase_001
long_and_complex_enough_but_yet_easy_to_remember_passphrase_002
long_and_complex_enough_but_yet_easy_to_remember_passphrase_003
...
long_and_complex_enough_but_yet_easy_to_remember_passphrase_100</p>

<p>Is this safe enough to do, as long as the initial passphrase is enough complex one, or maybe the consecutive numbers add any vulnerability ?</p>

<brain-wallet>
Is this brainwallet approach safe enough?
Gustavo
# Is this brainwallet approach safe enough?

(Asked by: username_0 on 2015-06-30)

Let's suppose I derive a private-public keypair from a passphrase like this :

long\_and\_complex\_enough\_but\_yet\_easy\_to\_remember\_passphrase

Now I wish to generate 100 more keypairs using same passphrase, so I append consecutive numbers :

long\_and\_complex\_enough\_but\_yet\_easy\_to\_remember\_passphrase\_001
long\_and\_complex\_enough\_but\_yet\_easy\_to\_remember\_passphrase\_002
long\_and\_complex\_enough\_but\_yet\_easy\_to\_remember\_passphrase\_003
...
long\_and\_complex\_enough\_but\_yet\_easy\_to\_remember\_passphrase\_100

Is this safe enough to do, as long as the initial passphrase is enough complex one, or maybe the consecutive numbers add any vulnerability ?

**Tags:** brain-wallet


---

## 3 answers

### Answer by username_1 on 2015-07-01. Score: 5

Appending numbers doesn't open you up to any particular vulnerability, but using any human derived private key is an extremely poor idea. Markov chains are extraordinarily good at attacking passphrases, which is counter intuitive when most people assume an exhaustive search character by character.


---

### Answer by username_2 on 2015-07-01. Score: 1

Be sure to take an old computer that you intend to decommission and use it "exclusively" for key generation. Don't ever use your key generation platform in a "periods processing" mode, nor save synthesized keys on the key generation platform. If a Web browser Javascript key generator is used, be sure to clear your browser's cache afterwards. Never have key generator computer connect to any network from the 1st day it is used to operationally synthesize keys. Never have a printer print unencrypted private keys in either text or QR code image form. For example, a rogue [ZXing](https://github.com/glassechidna/zxing-cpp) application can easily applied to scan QR images for the raw private keys.

Be sure your key generation computing platform has all the key generation software you intend to use installed on it and have backup key generation S/W that won't ever touch a networked machine again. Don't even think about sneaker netting a thumb drive containing keys. Secure the S/W in a similar fashion as the key generating platform, but keep them separated.

Have your old computer generate QR codes that you optically scan that are out of sight from others, and above all ensure your old computer is physically secure or destroyed after you no longer intend to use it. This "data diode" key generation approach should afford you substantial security.

Picking a passphrase with high entropy is very important! Be sure to include at least a few extra oddball special characters that are spread out such as: !@#$%^&\*(){}[]. Entropy can be improved by cryptographically hashing (e.g., SHA256) your passphrase you can remember yourself and then performing one or more nonlinear operations to create more complex data to seed the brain wallet. Specific details for performing such nonlinear operations should not be shared with others.

For an example of nonlinear operations, let's use say the first 13 hexidecimal characters of a SHA256 operation's results are used to prefix the original passphrase and say the last 29 hexidecimal characters to the right side of the hash are used to postfix to right of your original phrase or transpose the previously described prefix or postfix. And/or possibly look for a repeating adjacent characters to delimit a prefix and postfix hexidecimal numbers for your original passphrase.

Repeat this whole brain wallet synthesis process many times over the course of a few days to be absolutely certain your complex base passphrase used to seed your brain wallet can be reconstructed successfully by ensuring your public addresses associated with you brain wallet are the same. Rushing the generation of of an effective brain wallet seed is your enemy...

Then for good measure, postfix and/or prefix your complex base passphrase again with a sequential number as you did to make it easier to make subsequent brain wallets.

Your brain wallet(s) can also be used as a seed for a BIP38 AES encoded paper wallet to that won't need as much password entropy as long as they are not exposed to the Internet and it is kept in a safe place. People can't tell how much money is in your BIP38 wallets as long as you don't store companion public addresses with them. Only print BIP38 AES encoded keys with a printer that you are not so sure you can trust. Once the a portion of a cold wallets funds are imported into a hot wallet, the cold wallet is no nonger cold. It is at least lukewarm...

If you are using a Javascript branwallet key generator, be sure to save the code for reuse possibly a decade or so later. For key process generation integrity purposes to ensure you won't burn swept funds, apply other key generator S/W to confirm that a given private key generated from the initial brain wallet can be used to create an identical public address.

Additionally, it very difficult for a crook to hold you for ransom for your brain wallet described above because it will take considerable time to synthesize and require proper computing resources.

I've been doing something like what was stated above for several years... It is a very secure approach as long as you are sure you don't burn any coins when performing your sweeps to a bad public address that you may have accidentally associated with one of your cold wallet's private key.

Ensuring the integrity of public keys from your key generator to you hot wallet is critical. I use my cell phone or tablet's QR code scanner to reliably capture public key addresses. When texting captured QR codes across a network to another wallet performing sweeps to the cold wallet, you'll need to ensure the integrity of the public address sent across a network before performing sweeps.

[Shamir's secret](http://point-at-infinity.org/ssss/) can also be applied to create a process to reconstitute wallets in case of death for heirs to inherit. This is a poor man's off-blockchain multisig. A sealed will could be used as a vehicle to reveal the m of n extra shared secret information to reconstitute the shared secrets. Don't reveal how big m is of n to others. Plus since you have a brain/BIP 38 wallet you can change your will's allocations when heirs piss you off...


---

### Answer by username_3 on 2016-02-13. Score: 0

The only real problem with the approach is that whilst the first password may (with very low probability) be secure enough, the others are effectively the same password. If `long_and_complex_enough_but_yet_easy_to_remember_passphrase` is ever compromised by whatever means (spyware, untrustworthy confidant, you publishing the clever recipe in a blog post), then the next step for the person would be to iterate through:

```
long_and_complex_enough_but_yet_easy_to_remember_passphrase[0-9a-zA-Z]{1,6}

```

as well which wouldn't take very long. Since humans are bad entropy generators we value pieces of memorable high entropy output so much we tend to reuse it (the above approach counts as reuse), which is one of the biggest weaknesses of the brain wallet approach. Reversing the phrase, changing capitalization, introducing l33t, etc are all variations of the same password that would occur just as easily to someone who effectively a professional at coming up with these.

At the end of the day, you wouldn't scrap your super clever password as readily as you would the bunch of characters that come from a CSPRNG.


---

