How to use seedXOR

Mixing randomness from different sources

Good randomness (entropy) is fundamental to crypto security. If your mnemonic/seed can be guessed because it’s predictable then sooner or later your funds will be gone. That is what happened during the ColdCard crisis. And that is the reason you should always use real word randomness to generate your mnemonics, rather than blindly trusting a device to generate randomness for you.

Seedmate enables you to generate mnemonics using dice rolls, coin toss, poker cards or just random word typing (these words must belong to the BIP39 word list and must be picked randomly, just print the list, cut them, suffle and blindly pick 24). Word typing is the most transparent method, as you did the word picking, no need to trust the device. But there is a catch, the last word contains the checksum, and it cannot be calculated manually (well, it is possible, but is extremely difficult to do). Seedmate will modify the last bits of the last word to meet the checksum rules, and the other words will remain as you picked them.

Now, if you want to enhance even more the randomness, you could generate several mnemonics using several methods and mix them all together, using the seedXOR function. The resulting mnemonic will have combined entropy and can be safely used to store funds.

If you want to verify the Seedmate XOR logic you could do a few test in advance using online tools (or other devices) to check that the results are equivalent.

Creating recovery schemes

XOR has a useful characteristic:

if you XOR A with B to create C,

then C XOR B= A

and C XOR A = B

You could take advantage of this to create a 2 out of 2 scheme. Lets say A is the mnemonic where your funds are. Then create a random mnemonic B using seedmate, combine A XOR B to get C. Then instead of storing the A list of words you keep lists B and C.

When you want to recover A just combine B and C using XOR.

But if you lose either, then you lose access to A. Similar to the passphrase scheme, no redundancy. To achieve redundancy you could keep several copies of B and C in several places.

Another strategy to achieve redundancy could be as follows:

A is where your funds are

Create random mnemonics B & C, combine A XOR B XOR C to get D.

Now A can be recovered using B XOR C XOR D.

Store in one location B and C

In other location B & D

In other location C & D.

This way if you lose one of the locations you can still recover access to your funds held in A. This is called a ‘2 out of 3’ scheme.

What is Seedmate?

Maybe we should start with what it’s NOT.

Seedmate is not another hardware wallet. It cannot connect to the internet — no PC, no phone, no software to install.

Seedmate is an air-gapped, standalone BIP39 calculator. 

It was designed specifically to fill the security gaps left behind by most hardware wallets. Seedmate doesn’t replace your hardware wallet — it complements it. 

Self-custody is about keeping a secret safe: safe from loss, safe from prying eyes. 

Firstly, you don’t trust a third party to generate a secret for you. You create it yourself. With Seedmate you can generate mnemonics with real-world randomness: dice, coins, words and poker cards. 

Typing words is the most transparent and trustless method, you pick 24 words and it adjusts  the last one to meet the checksum rules. Just make sure that you shuffle them properly and pull them out blindly.

Secondly, Seedmate lets you mix randomness from different physical sources for maximum entropy. Inputs and outputs are standard BIP39 mnemonics. You can type them using the on-screen keyboard or via an SD card. The SD card option is provided to simplify operations — not for long-term storage — and should be wiped after usage for security, keep it analog!

Thirdly, Seedmate allows you to create advanced recovery schemes, like ‘2 out of 3’.

Your secret is divided into three parts: finding a single part reveals zero bits of information about your secret. Yet, combining any two parts fully recovers it. This gives you both redundancy and security — keeping your secret safe from loss, and safe from prying eyes.

Seedmate achieves this using either XOR logic or Shamir’s Secret Sharing.

• XOR is compatible with other devices, but is limited to 2-of-3 schemes.

• Shamir allows custom, flexible schemes up to 6-of-9.

Because Shamir uses a custom implementation, relying solely on hardware could be a risk if the device is lost. To eliminate that risk, Seedmate includes a standalone, offline HTML tool that replicates every single feature. You can download it, run it on an air-gapped machine, and verify or recover your secrets anytime.

Lastly, Seedmate provides built-in obfuscation functions.

Rather than storing a clear-text copy of your secret, you can apply reversible transformations to it. If someone finds your backup, they won't gain access to your funds unless they know the exact reverse logic.

For example, you can shift every word in your seed by “N” positions. The result is a completely different, valid BIP39 mnemonic.

You can then load this obfuscated seed with a small amount of funds to act as a decoy or as your 'canary in a coal mine'. If those funds ever move, you know immediately that your physical backup has been compromised. 

This decoy/canary strategy can also be used with the recovery schemes mentioned before, as all parts are valid BIP39 seeds.

Seedmate is a personal project engineered in Spain. The hardware consists of 2 boards: a custom-designed processor board powered by a PIC32, paired with a commercial display and SD module.

The software is completely open-source, written from scratch in C code plus a few libraries for SHA256, QR code generation, and Shamir arithmetic.

Seedmate is stateless, it fully clears when powered off. No seeds can be stored inside the device.

Seedmate overview video

Self-custody checklist

This checklist only applies to significant amounts of money that would make you sad if lost. As the quantity increases, so does the need for higher security.

Checkpoint 1. Reliable BIP39 mnemonic

Correctly generated, making sure it’s actually random without trusting any software. CC was not the first wallet to generate weak entropy seed phrases and it won’t be the last. 

Just don’t take the risk. 

A simple and trust less method IMO is printing the word list, cutting it into pieces of paper and blindly pulling out 23 random words. Use offline HW to find the 24th word which cannot be calculated manually. This way you pick 23 words yourself and rely on a third party to generate the checksum only.

For the ultra paranoid: mix different entropy sources using SeedXOR logic offline HW (test the SeedXOR logic first). 

Finally, 12 words are supposed to be ok, but I would stick to 24 words for higher security.

If you hold funds on addresses that don’t comply with this first checkpoint you should generate another seed phrase and move funds diligently.

Checkpoint 2. Keep the secret offline

The BIP39 world list (AKA seed phrase/ mnemonic) has never been stored/exposed to an online device. No phone pictures, no phone SeedQR scan, no digital text files, never used in a hot wallet, and you know that other persons cannot have had access to it. 

Of course, never type into any website and never share it with anyone.

Notice that a seed phrase previously used on a hot wallet will not become safer for being loaded into a cold/HW wallet, because the secret has already been exposed. 

If you hold funds on addresses derived from a mnemonic that has or may have been exposed to the internet or any other person, you definitively should generate another one and move funds diligently.

Check point 3. Redundancy

If you lose the seed phrase you probably lose access to your funds, so you should store redundant physical copies of it in different locations. Preferably on fire & water resistant material.

Or use a recovery scheme “2 out of 3”, see next point. 

Check point 4. Physical compromise

What if someone else finds a copy and knows how to use it? Or he/she takes a picture with their phone? Having redundant copies to meet checkpoint 3 seems incompatible with keeping your seeds secret, but there are a number of possibilities to deal with this dichotomy:

• Passphrase. An additional security layer. Mnemonic and passphrase are combined by the HW wallet to generate different private keys and addresses. Attackers need both to access funds. But if you lose one of them you lose access to your funds, this is a “2 out of 2” scheme. Store them separately and redundantly. It is safer than single-sig, but it is easier to lose access to your funds.

• SeedXOR recovery scheme “2 out of 3”. Lets call S the seed where the funds are. Generate other 2 random valid BIP39 seeds: A and B. Then XOR S with A and with B to generate C. Now S can be recovered XORing A with B with C. So you store A,B on one location; A,C on another and B, C on a third place. Effectively creating a “2 out of 3” scheme where finding one location provides no information about S. There are several HW wallets that allow SeedXOR logic.

• SSS “k out of n”. This is called Shamir Secret Sharing encoding. It's a technique to store/transmit information redundantly where you need at least ‘k’ parts or “shares” out of n to restore the original information. k-1 or fewer shares provide no information about the original secret. For example 3 out of 5, 4 out of 8, etc. In order to merge shares you must know what is the value of ‘k’ and each share id (share 1, share 2, etc)

  • Trezor implements Shamir with SLIP39, which is a standard they created unilaterally. It uses a different word list than the BIP39 standard, because the id of each share and the ‘k’ is stored along the SLIP39 word list. The problem: very few manufacturers have adhered to SLIP39. An SLIP39 mnemonic cannot be translated into BIP39 as far as I know.

  • Seedmate implements Shamir over BIP39 seeds, and the user has to write the share id and k next to each share. Shares are BIP39 seeds of the same size. You could leave some decoy funds on the shares. When merging, the result is the original BIP39 mnemonic. The problem: you need a Seedmate to merge shares, or use the HTML backup tool strictly offline. 

• Use invisible ink. Sometimes simpler is better. 

• Keep copies well hidden.

• Obfuscation. You may choose to make reversible transformations to your BIP39 seed ‘S’, to generate another valid BIP39 seed ‘X’ so if someone has physical access to X he/she would not have access to your funds unless he/she guesses correctly the transformation needed to go back to S. You could leave some decoy funds on seed X. An obfuscation example is to increase each word by N units. 

• BTC only: multi-sig & multi-vendor, it is a security mechanism for Bitcoin wallets that requires more than one key to authorize and send a transaction. Users generally setup a “2 out of 3” scheme (it could be 3-5, 5-9 or any other), using 3 different HW wallet manufacturers. Example: Bitbox, Trezor and Jade. Additionally the user needs to keep a descriptor file that holds setup details. Losing this file leads to loss of funds. Multisig is the final boss of self-custody.

All these options increase security at the expense of increased complexity. They can be combined in several ways, like multi sig with passphrases and mnemonics hidden with invisible ink. It is a trade-off, you have to find the right spot for you.

I did not mention custodial services because that is no self-custody. There are mixed approaches where a third party holds one of the keys of a multi-sig scheme.  

Check point 5. Test it.

Whatever the scheme you choose, test it thoroughly before moving significant amounts of money. Clear every HW wallet and build it from scratch again from every option, test every k-n combination. Generate receiving addresses, send small transactions, check you can spend it. Then you can move the bulk of the money.

At least twice a year check your backups and practice restoring the scheme.

Check point 6. Write down the treasury map

Prepare instructions for your family to recover funds if something happens to you, and to make sure you don’t forget. The place to store this document may be on you WILL, where only you are allowed to access. This is because... can you trust your wife?

Do not put the seed phrases along with the “treasury map”, the treasury map contains the location of the seeds and instructions to rebuild the self custody scheme.

Check point 7. Privacy 

Avoid KYC exchanges, learn how to use P2P networks. 

Use anonymous payment methods and anonymous physical delivery when buying HW wallets and other related products.

You don’t want to be on those companies' databases as a BTC/crypto holder, as these will eventually be leaked/hacked, and bad actors may physically attack you at home.

Unfortunately, self custody is a complex puzzle that requires a lot of work and study. It is not for everyone and it is one of the reasons mass adoption will not be easy.

As you can see, most of the self custody good practices are not necessarily done by a hardware wallet. It's all about keeping a secret safe, not losing it, not exposing it.