SLIP39 wallet recovery: shares, thresholds and common problems

What is SLIP39?

SLIP39 is a cryptocurrency wallet recovery mechanism that supports multiple shares used to enable recovery. You do not need all shares to recover the cryptocurrency wallet successfully which means unlike BIP39 it does not suffer from a single point of failure.

Why does SLIP39 exist?

SLIP39 exists because BIP39 has an inherent single point of failure due to the single mnemonic that must be accurately recorded and protected from damage or theft. Some cryptocurrency wallet owners resorted to splitting their mnemonic into four or six pieces and distributing them to achieve greater security but this will sometimes at the expense of recovery. Loss of any one of the pieces would make recovery difficult or impossible.

Using BIP39 there’s only one seed phrase mnemonic and if it is lost or broken you cannot recover. If it’s stolen the thief has full control of your cryptocurrency.

What is a SLIP39 share?

You might be wondering what a SLIP39 share is and why it’s not called a mnemonic. It would be very easy to call it a mnemonic especially since it looks like one! The BIP39 mnemonic words can be broken down into the actual seed value along with the checksum. SLIP39 on the other hand uses the words to represent metadata about the shares (which are very useful for recovery), seed value and a checksum. So as you can see there’s more to a SLIP39 share than meets the eye.

What’s in the SLIP39 metadata?

There are various values in the SLIP39 metadata:

• Identifier – All shares must have the same identifier!
• Iteration Exponent – A security setting used to increase work required
• Group Count – The number of groups defined
• Group Threshold – The number of groups required for recovery
• Group Index – The group this share is part of
• Member Index – Which member of the group this share represents
• Member Threshold – The number of members required for recovery

From a recovery perspective these values are very important and all are derived from just the first four words in the share. Even if the remainder of the share is damaged this metadata can be recovered.

What is SLIP39 and what makes it different to BIP39?

The first thing to note about SLIP39 is the share length. They are either 20 or 33 words long. BIP39 uses mnemonic lengths 12, 15, 18, 21 or 24. This is a very quick and easy way to understand what you have.

If you are unfamiliar with BIP39 you might be interested in our other articles: BIP39 Explained and What is the BIP39 wordlist. For those familiar with BIP39 do not think that a single share is sufficient for wallet recovery. It is critical to meet the threshold requirement to have enough information. More on this later.

If you have read our article on BIP39 you might think that it’s all you need to recover your cryptocurrency wallet and you would be right. But BIP39 has a single point of failure because there’s only one seed phrase and if you lose it the result can be catastrophic.

If you use SLIP39 you can specify how many shares you want to have and how many are required to enable recovery also known as the recovery threshold.

Most simple implementations will have a single group made up of three shares and you need two for recovery. This has the added advantage that if you lose one of the shares you can still recover your cryptocurrency wallet.

SLIP39 is based on an algorithm called Shamir’s Secret-sharing. It allows you to create a pool of shares and you can define how many shares you need to be able to recover your wallet. As another example you could create 5 shares and set your threshold to 3 shares for recovery. This means that any three of the valid shares are required to support recovery. The benefit here is clear, if you lose a share, it does not impact your ability to recover. You must lose more than two to prevent recovery.

You can create as many shares as you want but in doing so you are increasing the administrative overhead that needs to be securely stored, managed and tested.

When is it best to use SLIP39

SLIP39 is designed for cryptocurrency wallets holding a lot of value. It is particularly useful in corporate or financial services institutions where additional resilience is required because the sums involved are so large. It should be noted that such firms should also not rely on a single hardware device for daily operations due to the risk of hardware failure. When considering the resilience aspects of a service it is important to take a holistic approach.

What happens in practice

After most users unpack their new cryptocurrency wallet the first thing they do is create a wallet. If they are unfamiliar with SLIP39 they may choose to keep things simple and this means having a single share. That’s because most people are used to BIP39 and this approach keeps the approach familiar. If you simply want a wallet and a basic form of recovery, many users choose a single share SLIP39 configuration. The problem with such an approach is that it eliminates the key benefits of using SLIP39 in the first place. The good news is that some wallets support converting single SLIP39 share to a multi-share later.

Do I have a SLIP39 single share mnemonic?

This is easy to check. In most single-share SLIP39 wallets if the third and fourth words of your mnemonic share are ‘academic’ ‘academic’ then you have a single share mnemonic.

Wallet support

It is essential to note that not all wallets support SLIP39 and you should research the given wallet you are planning to use to understand it’s capabilities. Recovery is a critical feature especially when a hardware wallet fails (and it will fail at some point), if a wallet vendor has ceased trading and if you want to migrate to a different platform altogether. Before selecting a wallet you need to investigate wallet creation, recovery and migration support.

Not all wallets that support BIP39 can support SLIP39 – be careful and do your due diligence.

Common SLIP39 recovery problems

When creating a wallet, your device generates a seed phrase and asks you to record it. Most wallets require verification, but many users still:

• Rush and fail to take enough time
• Mistakenly write a word
• Have very poor handwriting
• Swap the word order
• Misspell a word
• Misread a word
• Lose the piece of paper
• Damage the paper it's written on
• Have insufficient shares to met the threshold
• Mixed share sets

Any single mistake means the wallet cannot be recovered, effectively locking you out of your funds. As stated above if the first four words of a share are available and valid then the metadata may still be useful.

 This becomes a crisis when:

• Your wallet stops working, is damaged or is replaced
• Your wallet is lost or stolen
• You accidentally delete your wallet
• You enter the PIN incorrectly too many times
• The screen or buttons simply fail

 When that happens, the seed phrase is your only lifeline.

How SLIP39 shares work

When it comes to SLIP39 and crypto coin recovery there is a significant overlap with BIP39. This is especially true when the wallet seed has been recovered. That’s because both rely on BIP32, BIP44, BIP49 and BIP84 to recover coins.

BIP39 vs SLIP39: What's the Difference?

Case Study 1 – High Net Worth Individual (HNWI) or Family Offices

For this group it is essential not to overengineer the solution as simplicity is key. It is also necessary that once in place it is regularly tested.

Case Study 2 – Global company

This example is for a large company with five or more major offices. This example is provided to show how SLIP39 can provide geographic resilience that protects against the usual Business Continuity issues of fire, flood, data centre loss, physical theft and political instability. The scenario is for a company that has major offices in London and across the EU.

This configuration avoids a single point of failure and protects against a major regional disaster.

 Case study 3 – Major crypto exchange

This example shows how SLIP39 can be configured to be resilient against individual loss, insider fraud, site loss, regional disasters and to a certain degree corporate restructuring.

In case studies 1 and 2 it is relatively straightforward with defined number of shares and threshold. In case study 3 there’s a defined number of shares for each group – board, security team and compliance team – along with thresholds for each. Then there’s an overall threshold for the number of groups required.

As a worked example:

If you have 3 shares from Board that gives you group 1 completed
You then need 3 shares from Security Team to give you group 2 completed
That gives you enough information to recover the cryptocurrency wallet.

In this example I have used Board + Security Team but it could have been Board + Compliance or event Security Team+ Compliance Team.

What happens when the Threshold is met?

Only when the threshold is met for recovery can you progress with secret reconstruction.  This is achieved using the Shamir Secret Sharing algorithm. This then allows you to continue the recovery process that is similar to BIP39 using BIP32, BIP44, BIP49 and BIP84.

Complexity and testing

When designing systems, it’s important that the measures being taken are commensurate with the risks being faced. Only use a more complex approach to SLIP39 if the risks warrant such a measure.

As with all critical systems you must test it regularly. This will help you identify issues and where additional training or expertise is required especially where there have been personnel changes. It is also necessary to maintain excellent documentation to support your recovery.

Wallet recovery

When processing mnemonics and attempting to recover wallets the key difference is that SLIP39 takes significantly more processing time compared to BIP39. That is because of the processing required up front for each combination of words in each share to determine if a valid share combination exists before it can proceed with wallet and address recovery. It places a significant amount of processing up front before further testing can be carried out. SLIP39 is more loss tolerant than BIP39 but recovery is more complex and takes longer.

Conclusion

The SLIP39 protocol can address the single point of failure inherent with BIP39. As with BIP39 it is critical to record your SLIP39 shares accurately and in the correct order. It is also important not to overengineer your SLIP39 configuration and keep things simple, straightforward to support recovery if things break.

The controls you deploy must be commensurate with the risks you or your organisation faces and the resources at your disposal. Calibrate this carefully and take your time!

And remember a SLIP39 share is not a mnemonic or a partial seed phrase. It’s a fragment of information that is mathematically generated and only useful when you have enough valid shares to satisfy the recovery threshold.

About our skills in this area

Jonathan Evans specialises in cryptocurrency wallet recovery, seed phrase analysis and digital resilience. He has a deep understanding of BIP39 and SLIP39 involving damaged, incomplete and incorrectly recorded recovery phrases. He has developed specialist software designed to perform mnemonic and share analysis, mnemonic and share reconstruction and finally substitution and transposition of key words within mnemonics and shares.

If you want a free assessment please get in touch and use our free assessment tool.