<p>Bip39 has an optional "encryption" over PBKDF2 (passphrase-to-key) used as salt (this allows possible deniability).
<a href="https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#from-mnemonic-to-seed" rel="nofollow noreferrer">https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#from-mnemonic-to-seed</a></p>

<p>The weakness there is that BIP39 uses <strong>only 2048 rounds</strong> during KDF. Which is easy to bruteforce. </p>

<p>If you store it in a cloud (or similar), I recommend to do a AES-256-CBC encryption of the mnemonic with a strong password and a strong KDF (maybe use PBKDF2 with at least 30'000 rounds).</p>

CC BY-SA 3.0
2017-04-10T11:55:33.667Z
Jonas, thank you for your reply. Please can you help me understand the benefits of AES-256-CBC over AES-256-GCM? Specifically in relation to encrypting a mnemonic in the browser
Will-In-China
CC BY-SA 3.0
2017-04-10T12:01:03.783Z
That's a difficult question with probably multiple answers. GCM has serval advantages (HMAC) and some disadvantages (small IV) over CBC. It depends on your use-case. For purely disk encryption, CBC seems to be the most common choice.
Jonas Schnelli
CC BY-SA 4.0
2022-12-17T10:00:55.110Z
>The weakness there is that BIP39 uses only 2048 rounds during KDF. Which is easy to bruteforce.  An attacker would have to take the mnemonic + append a password guess + do KDF rounds + get HD master key + derive a set of address keys + query the blockchain for balances. Is this not enough of a slowdown? I see that the salt is capped at 64-bit entropy :( One could put some balance with master keys resulting from dummy weak passwords, to detect a compromised seed and be alerted to move funds.

Here's an interesting read:
https://coldbit.com/can-bip-39-passphrase-be-cracked/
bca-0353f40e
CC BY-SA 3.0
2017-04-10T07:45:42.167Z
2017-04-10T07:45:42.167Z
Jonas Schnelli
<p>With no server and only in the browser I'm generating an a bip39 key and giving the user the mnemonic to store some place safe for restoring, I also want the user to be able to login with a password.</p>

<p>1) Could I encrypt the mnemonic with a password?</p>

<p>2) If I do encrypt the mnemonic, which algorithm should I use?</p>

<encryption>
How should I encrypt a bip39 mnemonic with a password?
Will-In-China
# How should I encrypt a bip39 mnemonic with a password?

(Asked by: username_0 on 2017-04-10)

With no server and only in the browser I'm generating an a bip39 key and giving the user the mnemonic to store some place safe for restoring, I also want the user to be able to login with a password.

1) Could I encrypt the mnemonic with a password?

2) If I do encrypt the mnemonic, which algorithm should I use?

**Tags:** encryption


---

## 1 answers

### Answer by username_1 on 2017-04-10. Score: 3 | Accepted answer

Bip39 has an optional "encryption" over PBKDF2 (passphrase-to-key) used as salt (this allows possible deniability).
<https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#from-mnemonic-to-seed>

The weakness there is that BIP39 uses **only 2048 rounds** during KDF. Which is easy to bruteforce.

If you store it in a cloud (or similar), I recommend to do a AES-256-CBC encryption of the mnemonic with a strong password and a strong KDF (maybe use PBKDF2 with at least 30'000 rounds).

> **Comments:**
> **username_0**: Jonas, thank you for your reply. Please can you help me understand the benefits of AES-256-CBC over AES-256-GCM? Specifically in relation to encrypting a mnemonic in the browser  
> **username_1**: That's a difficult question with probably multiple answers. GCM has serval advantages (HMAC) and some disadvantages (small IV) over CBC. It depends on your use-case. For purely disk encryption, CBC seems to be the most common choice.  
> **username_2**: >The weakness there is that BIP39 uses only 2048 rounds during KDF. Which is easy to bruteforce.  An attacker would have to take the mnemonic + append a password guess + do KDF rounds + get HD master key + derive a set of address keys + query the blockchain for balances. Is this not enough of a slowdown? I see that the salt is capped at 64-bit entropy :( One could put some balance with master keys resulting from dummy weak passwords, to detect a compromised seed and be alerted to move funds.  Here's an interesting read: https://coldbit.com/can-bip-39-passphrase-be-cracked/  

---

