<p>Sorry to hear you were robbed.</p>

<p>An attacker cannot reverse engineer a private key to obtain the original mnemonic phrase. </p>

<p>What essentially happens is just another multitude of hashes with an algorithm (SHA256). Different approaches to this are taken by different deterministic wallet generators.</p>

<p>As SHA256 is considered secure. So is your mnemonic phrase</p>

CC BY-SA 3.0
2014-01-16T01:10:44.473Z
So you are guaranteeing me that a one way permutation is used to generate the private key for the wallet generators such as brainwallet.py?
user12247
CC BY-SA 3.0
2014-01-16T01:21:00.207Z
Is this just an opinion or do you have any facts or evidence to back your claim? Dont take offense but im not going to risk losing all of my money on an opinion
user12247
CC BY-SA 3.0
2014-01-16T01:45:39.050Z
I did some research... what I am worried about is called a preimage attack.
user12247
CC BY-SA 3.0
2014-01-16T01:52:41.983Z
Someone claims ripemd-160 is a one-way hash function: http://www.reddit.com/r/Bitcoin/comments/1lsweg/
user12247
CC BY-SA 3.0
2014-01-16T09:15:42.093Z
As long as your mnemonic phrase has enough entropy not to be brute forced then it is safe. I think Electrum uses 12 dictionary words to get 128bits of entropy. Don't quote me on that though.
MaxSan
CC BY-SA 3.0
2014-01-15T16:35:39.580Z
2014-01-15T16:35:39.580Z
MaxSan
<p>Someone robbed me at gunpoint and took my laptop. The laptop contained an encrypted hardrive with a wallet.dat file. Both the hardrive and wallet.dat had at best weak passphrases for the encryption. I have assumed both to be compromised.</p>

<p>My question has to do with the one-way permutation hash function of ripemd-160 to generate both the private and public keys used in brain wallet generators.</p>

<p>[I am assuming that wallet generators are using one way permutations. I could be wrong. If I am then please inform me. Most wallet generators use the brainwallet.py available on github.]</p>

<p>If an attacker has obtained your private key can he "reverse engineer" the key to obtain the original brain wallet passphrase used when the wallet was generated?</p>

<p>If so I assume he can use that to bruteforce any other wallet that would use the same passphrase as a seed as mentioned in this post here:</p>

<p><a href="https://crypto.stackexchange.com/questions/10246/question-regarding-multiple-sha-256-rounds-on-a-bitcoin-brain-wallet-passphrase">https://crypto.stackexchange.com/questions/10246/question-regarding-multiple-sha-256-rounds-on-a-bitcoin-brain-wallet-passphrase</a></p>

CC BY-SA 3.0
2014-01-15T16:42:15.380Z
Why does it matter if he can reverse-engineer the key to your passphrase? If he has the private key, he can spend your balance. You won't be able to make a new brain wallet with the same passphrase, as it will result in the same address. So unless your passphrase was the password you use for everything (stupid idea!), this doesn't really matter.
Steven Roose
CC BY-SA 3.0
2014-01-15T18:09:32.660Z
Any reason for [your cross-post at crypto.se](http://crypto.stackexchange.com/q/12932/6961)? You obviously already received an answer here...
e-sushi
CC BY-SA 3.0
2014-01-16T01:06:55.810Z
I did not know where to best post the question. Sorry
user12247
CC BY-SA 3.0
2014-01-16T01:15:36.220Z
Steven re-read the post. The question was relevant to the seed passphrase being obtained. The wallet was already secured (empty wallet)
user12247
<ripemd160>
Can a brainwallet passphrase be derived if an attacker has obtained the private keys of an empty wallet.dat file?
user12247
# Can a brainwallet passphrase be derived if an attacker has obtained the private keys of an empty wallet.dat file?

(Asked by: username_0 on 2014-01-15)

Someone robbed me at gunpoint and took my laptop. The laptop contained an encrypted hardrive with a wallet.dat file. Both the hardrive and wallet.dat had at best weak passphrases for the encryption. I have assumed both to be compromised.

My question has to do with the one-way permutation hash function of ripemd-160 to generate both the private and public keys used in brain wallet generators.

[I am assuming that wallet generators are using one way permutations. I could be wrong. If I am then please inform me. Most wallet generators use the brainwallet.py available on github.]

If an attacker has obtained your private key can he "reverse engineer" the key to obtain the original brain wallet passphrase used when the wallet was generated?

If so I assume he can use that to bruteforce any other wallet that would use the same passphrase as a seed as mentioned in this post here:

<https://crypto.stackexchange.com/questions/10246/question-regarding-multiple-sha-256-rounds-on-a-bitcoin-brain-wallet-passphrase>

**Tags:** ripemd160

> **Comments:**
> **username_1**: Why does it matter if he can reverse-engineer the key to your passphrase? If he has the private key, he can spend your balance. You won't be able to make a new brain wallet with the same passphrase, as it will result in the same address. So unless your passphrase was the password you use for everything (stupid idea!), this doesn't really matter.  
> **username_2**: Any reason for [your cross-post at crypto.se](http://crypto.stackexchange.com/q/12932/6961)? You obviously already received an answer here...  
> **username_0**: I did not know where to best post the question. Sorry  
> **username_0**: Steven re-read the post. The question was relevant to the seed passphrase being obtained. The wallet was already secured (empty wallet)  

---

## 1 answers

### Answer by username_3 on 2014-01-15. Score: 1

Sorry to hear you were robbed.

An attacker cannot reverse engineer a private key to obtain the original mnemonic phrase.

What essentially happens is just another multitude of hashes with an algorithm (SHA256). Different approaches to this are taken by different deterministic wallet generators.

As SHA256 is considered secure. So is your mnemonic phrase

> **Comments:**
> **username_0**: So you are guaranteeing me that a one way permutation is used to generate the private key for the wallet generators such as brainwallet.py?  
> **username_0**: Is this just an opinion or do you have any facts or evidence to back your claim? Dont take offense but im not going to risk losing all of my money on an opinion  
> **username_0**: I did some research... what I am worried about is called a preimage attack.  
> **username_0**: Someone claims ripemd-160 is a one-way hash function: http://www.reddit.com/r/Bitcoin/comments/1lsweg/  
> **username_3**: As long as your mnemonic phrase has enough entropy not to be brute forced then it is safe. I think Electrum uses 12 dictionary words to get 128bits of entropy. Don't quote me on that though.  

---

