Source
r/ethstaker•
ethrevolution

Creating ETH2 wallet from ETH1 seed?

Looking for opinions to decrease complexity going forward.
As I already have a (imo) decent, tested recovery procedure in place for my wallet's seed phrases, I'm inclined to derive my ETH2 staking wallet from the same seed.
Why would this work, why not, what are the risks I'm not accounting for?

Posted Aug 28, 2020, 7:49 AM UTC

1315
Karyo_Ten•

You can't without going through hoops.

The internal process of generating a key is the following:

  • Retrieve random bytes from your PC random number generator (commonly called IKM, input keying material in crypto)
  • Pass it through a key derivation function
  • Take the result modulo "r" the curve order (the number of points on the elliptic curve)
    • 115792089237316195423570985008687907852837564279074904382605163141518161494337 for secp256k1 curve (Eth1 and Bitcoin)
    • 52435875175126190479447740508185965837690552500527637822603658699938581184513 for BLS12-381 (Eth2)
    • As you can see with a "simple" substraction, there are 633562140621900049441232445005019420151470117785472665600015 04441579580309824 more valid keys ETH1 (They use 2^256 bits while ETH2 uses 2^255 bits) and it is extremely likely that your ETH1 key is part of the invalid ETH2 key range
  • The keygen derives your public key from that secret key (using something called "scalar multiplication" which is the corner stone of elliptic curve-based cryptography has it's not invertible on current hardware, even if you have Google/Amazon/Facebook compute behind you)

Alternatively, usually the input keying material goes through a process called Lamport key generation to create an "infinite" amount of secret keys from a single master key (see EIP2333 for ETH2 keygen - https://eips.ethereum.org/EIPS/eip-2333).

Now not all hope is lost. What can be done is using your Eth1 secret key as the input-keying material to generate your Eth2 secret keys, since IKM can be any (large) size, i.e. plug it in the IKM_to_lamport_SK mentioned in EIP2333.

In terms of risk, it's all deterministic and specified so it's mostly what you use to transform your seed into raw bytes and then feed those raw bytes into an implementation of EIP2333. Like always, ensure it's done on a safe box, disconnect from the web, etc.

In terms of software to ease that, I'm not sure they exist yet though all ETH2 teams have implemented the ETH2 keygen, the ETH1 secret keys -> raw bytes part is likely missing (but it shouldn't that big of a work either since it's necessary for internal operations and testing of Geth/Parity/Trinity/Bitcoin so at best it exists somewhere and at worst you need to expose that internal detail).

And if someone wants a weekend project, the reference implementation of EIP2333 is here:

7
jgm-orinoco•

Although all of this is correct, it is perfectly possible to use the same seed phrase for both Ethereum 1 and Ethereum 2 wallets.

When creating an Ethereum 2 wallet, most software allows you to specify the seed phrase, or mnemonic, which is used to generate the master key. For example if you wanted to use ethdo to create an HD wallet based on a given mnemonic you can do so with the --mnemonic option. You could also append a "25th word" to the mnemonic if you want, so that even if someone did obtain your seed phrase they couldn't use it without the additional information.

5
Karyo_Ten•

Do you have a link to the Eth2 wallets you mention?

1
jgm-orinoco•

ethdo is at https://github.com/wealdtech/ethdo

The other wallets are those that come with the validator clients.

3
chonghe•

Thanks for the high quality post.

This means that the 24 seed word in ETH1 has about 2x possible combination than ETH2

Does this also mean that the seed phrase for ETH2 will always be 24 words, instead of 12 words in ETH1? That 24 words will provide as much possible combination as 12 words in ETH1 to achieve the same level of security?

3
Karyo_Ten•

Unfortunately I have yet to check/implement ETH1 key generation or mnemonic for ETH2 so can't comment on the internals but on ETH1 I've seen the following key length

2
chonghe•

I also read that the security of eth1 & 2 are the same, i.e. key sizes are the same

But from an outsider just looking at the numbers 2^256 and 2^255 it seems that eth1 provides more possible numbers, hence higher security. Can't get my head around this

1
Karyo_Ten•

Disclaimer: I'm a crypto implementer not a cryptographer or cryptanalyst so while I understand probably better than users, a lot still eludes me.

Due to the birthday paradox, keys are likely to collide once we reach the square root of input length and this is what we use to estimate secret key security. sqrt(2^256) = 2^128, while sqrt(2^255) = 2^127.5 , hence ETH1 keys have 128 bits as "security level" while ETH2 has 127.5. The loss of 0.5 bits is considered a good tradeoff for the benefits the BLS12-381 curve brings, in particular signature aggregation, which allow stuffing all validator signatures in a single Signature (48 bytes instead of say 128*48 bytes as we can have 128 attesters per block)

Note, this is also different from elliptic curve security (ECDLP: Elliptic Curve Discrete Logarithm Problem) as this one depends on finding the secret key from the public key. This is ultimately protected by the length of the prime, and in ETH2 we have 381 bits while ETH1 only has 256 bits.

In short,

  • ETH2 secret keys have 2x higher chance of collision (still less probable than a solar flare extinguishing all life after your read this post)
  • but ETH2 public keys have significantly less chance of being reverse computed (public key -> secret key takes an exponential amount of time so increasing prime length by 125 bits is huge)
2
ErikBjare•

That should work fine.

2
Sfdao91•

Not possible they use different schemes. Eth2 used bls 18 something which is not the same as eth 1.

-1