Bleibt die Passphrase bei Ledger erhalten, wenn Sie sie auf einen Pin setzen?

[root_s2yse8vt]

Up

0

Down

::

Ich finde es gut, dass Ledger es Ihnen ermöglicht, Ihre Passphrase mit einem separaten Login-Pin zu verknüpfen. Denn es ist wirklich mühsam, die Passphrase jedes Mal über das Ledger-Gerät einzugeben.

Aber bedeutet das, dass sich das Ledger-Gerät in diesem Fall Ihre Passphrase “merkt”?

[loupiote2]

Up

0

Down

::

I had the same question so I asked ledger engineers. the answer I got is:

No, it does not store the bip39 passphrase. Instead, it stores the result of the hashing of the bip39 entropy (also called the mnemonic / recovery / seed phrase) with the bip39 passphrase. The result of this “hashing” is a 512-bit number known in the standard as the bip39 seed. That is basically the master bip39 root private key from which all other private keys are derived.

So the bip39 passphrase itself is not stored, what is stored is the internal 512-bit bip39 seed that is obtained from it being hashed with the 24-word phrase.

[itsnotlupus]

Up

0

Down

::

When you link a passphrase with a pin, your passphrase is used right after you type it into the device to alter the master key derived from your seed words into a new master key that is associated with that pin.
Then the passphrase is forgotten, but that doesn’t matter anymore.
The master key from which all private keys are derived is what matters.

As you may have noticed, not all wallets do this.
Other wallets make you type it every time and it’s kind of a pain, or at the least, it does not encourage the use of a long/secure passphrase.
Some wallet makers actually market having to type your passphrase each time you use it as a “feature” that mitigate their devices’ vulnerability to physical key extraction attacks.
But really it’s just piling on a bad user interaction flow on top of a weak hardware design.

[libert-y]

Up

0

Down

::

It has to. Otherwise the device wouldn’t know how to access the hidden wallet

[bje332013]

Up

0

Down

::

>does it mean the Ledger device “remember” your passphrase in this case?

I couldn’t think of any way it could spare you the trouble of typing out the passphrase unless it got saved on the device. Personally, I wouldn’t take that risk – especially now that it’s apparent that Ledger can extract private keys stored on its hardware devices.

[Solid-Yak3672]

Up

0

Down

::

i think it dose store it, i have the same problem not that i dont trust ledger i dont trust hackers using this path way to our keys

[Autor]

Beiträge