Conversation
pjkundert
added a commit
to pjkundert/python-shamir-mnemonic
that referenced
this pull request
Aug 26, 2026
Rewrite the ceremony checklists onto the public group_one_mnemonics API: C1 lost-card and C2 revealed-card are single group-local calls (C2 gains a READ THE REPORT step for the revocation's destruction requirement), C3 puts the resize in the same call, C4 composes the two public APIs to rebuild a lost group's full structure, C6 notes that revoke on a threshold-1 group is refused with an escalation pointer here. Add 'Structural notes for whoever carries this on': the two-level Shamir structure (groups as points on the master polynomial, members as points on per-group polynomials, threshold points determine the WHOLE polynomial); what the digest verifies and at which level; which metadata must be pinned for cross-group compatibility and why; regenerate-identical vs re-randomize and their different security consequences; augment vs revoke as identical cryptography with different organizational commitments; and the per-API RAM-reconstruction hazard windows. Replace the PR trezor#51 gaps section with the two-API surface (group_ems owns master-quorum ceremonies, group_one owns single-group ones), the shared internals both consume, the status of the four gaps (all closed, one by composition), and the remaining open items (CLI surface; unknowable original member count; C5/C6 are master-level by construction). Update the test map for the 7 new API-surface tests.
pjkundert
added a commit
to pjkundert/python-shamir-mnemonic
that referenced
this pull request
Aug 26, 2026
Rewrite the ceremony checklists onto the public group_one_mnemonics API: C1 lost-card and C2 revealed-card are single group-local calls (C2 gains a READ THE REPORT step for the revocation's destruction requirement), C3 puts the resize in the same call, C4 composes the two public APIs to rebuild a lost group's full structure, C6 notes that revoke on a threshold-1 group is refused with an escalation pointer here. Add 'Structural notes for whoever carries this on': the two-level Shamir structure (groups as points on the master polynomial, members as points on per-group polynomials, threshold points determine the WHOLE polynomial); what the digest verifies and at which level; which metadata must be pinned for cross-group compatibility and why; regenerate-identical vs re-randomize and their different security consequences; augment vs revoke as identical cryptography with different organizational commitments; and the per-API RAM-reconstruction hazard windows. Replace the PR trezor#51 gaps section with the two-API surface (group_ems owns master-quorum ceremonies, group_one owns single-group ones), the shared internals both consume, the status of the four gaps (all closed, one by composition), and the remaining open items (CLI surface; unknowable original member count; C5/C6 are master-level by construction). Update the test map for the 7 new API-surface tests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Recovering SLIP-39 EncryptedMasterSecrets from (possibly corrupted or otherwise attacked) sets of Mnemonics is the sole purpose of the SLIP-39 standard.
Verifying, grouping and vetting sets of mnemonics requires at least partial decoding of the mnemonic to extract identifier, extendable flag, group counts, thresholds, etc., so that only compatible mnemonics are considered. This is difficult to do "externally" to the SLIP-39 implementation.
Therefore, a robust API to recover one or more SLIP-39-encoded encrypted master secrets from a pool of collected mnemonics is not just useful, but critical to the proper operation of a SLIP-39 based recovery system.
Thus: I propose
shamir_mnemonic.group_ems_mnemonics, which takes a sequence of Mnemonics (as eitherstrorShare), and produces a sequence of EncryptedMasterSecrets and a dict of group indices and the list of Mnemonics used to recover the secret. It does so in a manner resilient to various corruptions or attacks, ignoring invalid, unrelated/incompatible or redundant Mnemonics.Fixes #44
Furthermore,
group_ems_mnemonicsprovides the ability to optionallyexpand1 or more groups with additional mnemonics, or even replace a failed mnemonic group with a single-Share mnemonic. This allows recovery from SLIP-39 group failures (too many lost mnemonics), by:All of these approaches are supported by the existing underlying cryptography of SLIP-39, assume no new extensions to the protocol, and will work with any set of existing SLIP-39 mnemonics.