Secrets and Sources
Last week, something terrible happened in Bitcoin. The network itself is untouched, but many of its most passionate users, the ones who believed in the cause and did exactly what so many of us teach, lost their coins. More precisely, their coins were stolen.
Custody of Bitcoin boils down to control of a large random number that is used to sign transactions. If that number is sufficiently random and nobody else finds out what it is, it is, for all practical purposes, impossible for anyone but you to transact with your Bitcoin. This is, in simplified terms, the essence of what we call "strong cryptography." How strong it is boils down to this simple question: how random is the number and how well do you keep it secret? That's it.
Generating a big random number is very easy. To generate a nice big secret number, put five fair dice in a shoebox, shake it and write down the numbers. Do this 24 times and you have a secret that can never be guessed, even by all the computers in the world. The hard part of secrets, however, is in the keeping.
One of the hardest parts of keeping a secret like this is when you enter it into a computer that is connected to the Internet. That's when there is a path from everyone else in the world to a machine that can be hacked to steal your secret.
One solution to this is to keep your magic number on a special device that never gets directly connected. When you have a transaction you want to sign, you save it on a little memory card, move the card to the device, and sign it there. In Bitcoin, these secret-holding devices are called "hardware wallets."
But these devices almost universally, by default, guide you to trust the device to make up the random number for you. Last week we learned a harsh lesson about this. A large number of users who had used a widely trusted hardware wallet called the Coldcard woke up to find their funds were gone. Life savings, in many cases. Years of work. Hopes and dreams. Gone.
The device they bought to help them keep that all-important secret number safe had lied to them. It had a small defect in the most important place. The number wasn't that random at all. It could be guessed out of a small range. It got the easy part wrong. The part they could have done themselves by rolling a handful of dice. Devastating.
I've lost everything before. I've been betrayed. To the people who are hurting, hold on. The future isn't written. Never give up.
To the people to whom I have personally recommended Coldcards over the years, I apologize. The Coldcard was my first hardware wallet. Coinkite, the company behind it, did a better job than others of signaling security to me. The ethos they evinced was convincing.
I hope I told you to roll dice. I usually did, but maybe not always. I won't make that mistake again.
In this essay, which I've had in mind since before the incident, I am going to make an argument that hardware wallets are not the right long-term direction for self-custody. You can use them safely, but I think they are largely theater and come with risks that make them counterproductive to security. I will no longer recommend retail hardware wallets at all and I am proposing a different direction for Bitcoin tooling in general.
But before all of that, I want to make something crystal clear. When you take your secret from the randomness of the natural world, with your own hands and eyes, where no one else can see, that is the only way to have a secret that you truly know is yours alone. When you take it from a machine that you did not build and program yourself, you are involving other people in the source of your secret, and putting trust in them.
Everywhere I turn right now, I still hear people saying that rolling dice is for experts. As an expert, who has worked in roles where I have been responsible for generating, holding, and employing critical secrets of this kind for more than 25 years, that is backwards. I am comfortable generating important secrets on machines that I know and control, under certain conditions, because of my knowledge and experience. And even still, when I want to be the most sure that I will get a truly unguessable secret, I take it directly from nature myself. For someone who does not specialize in these things, this is even more true.
More pointedly: if your secret comes from a device, you cannot be sure that you are practicing self-custody at all. There is a human chain of supply through which that secret came to you. And that chain can be compromised. At a certain point, it becomes theater, and is not that much different than trusting a custodian.
I hope that manufacturers will consider removing the generation of these secrets from their products entirely, or at least stop making it the default and path of least resistance. Encourage users to gather their own randomness. Noisily inform them that they are doing something less secure when they use an electronic device as the source. It's legitimate to support lower threat levels, but we have a responsibility to inform our users when they choose them. Guiding users to rely on another party as the source of their master secret to save five minutes with dice is irresponsible.
Let's make sure that those who got hurt here didn't suffer for nothing. We owe it to them to learn from what happened. And this is the first and most direct lesson.
I'd also like the wallet manufacturers, educators, and custody solution providers to stop selling fear. They probably won't, because it works. "Cuts sell bandaids" and fear is the most effective marketing strategy they have. But I am calling for it just the same.
That's why I wrote this essay: because I've been hearing that "self-custody is hard so buy my easy button or subscribe to my service" and while there is a kernel of truth in it, as is often the case in marketing, the truth is being spun in a misleading and manipulative way.
The most important security tool you will ever have is the truth. I'll do my best to help to make things clearer.
Self-Custody Has Three Important Parts
One of the problems with hardware wallets is that most of the tools we have right now don't do a great job of separating three things: creating, storing and using a secret. Let's pull them apart and see what happens.
First you have to create a secret.
Creating a secret is actually easy if you follow a recipe, as we've already established, so I suggest you just do it yourself. Using some computer circuits and software that you can't easily verify with your own two eyes doesn't make sense when you are going to put a life-changing amount of money on it. So take a few minutes to read a few instructions and roll dice. When someone tells you otherwise, consider what they're selling.
Then you have to translate it into words, called a "seed phrase," to make it easy to use. To do that, you can use a printed table where you can look up groups of 5 dice rolls and get a word.
Unfortunately, with Bitcoin, you do need to involve a computer in processing those words. So you will need to make sure that computer cannot share your secret at this point. But that is not the same as getting your secret from the computer or device. In fact, it only has to help you to "fix" the very last word.
I've included a very simple computer program, called a shell script, at the end of this essay to demonstrate how simple it is. In fact, it also includes instructions and word lists, so that it can be used as a complete recipe for creating your own secret and turning it into a valid seed phrase.
I'm not suggesting that everyone needs to get comfortable running scripts on the command line, though almost anyone could. But ask yourself why the tool you are being provided doesn't come with this list or have a function that will adjust that last word for you, so that you can be the source of your own pristine secret. Ask why they are telling you "that's for experts."
Next you have to store your secret.
How best to store your secret depends on your stakes and circumstances. My advice is don't make this some abstract thing. You've probably kept an important secret before. There is nothing strange or high-tech about this. It's a timeless part of the human experience.
Do what is practical for you and keep it simple. A good option for some is to get a metal plate and a stamping kit at the hardware store, stamp your secret onto the metal plate and put it in a safe or safety deposit box. What you need to do is situational, but it's not rocket science. It is unique to you and your situation.
I will say there is something special about pounding your own secret words into a chunk of metal. It has a way of making the freedom tangible.
Notice that, other than that little adjustment of your 24th word, no computers have been involved thus far. Creating and keeping a secret are actually not bitcoin-specific problems, or even computer problems at all. And you are better off listening to your own common sense than the fear-based marketing of a gadget company.
An even better solution, but one that would take industry agreement, would be to just make the "fix the last word" thing unneccesary. We could just move the error checking into an optional 25th word. The authors of BIP-39, the standard for creating seed phrases, chose to mix error checking and randomness in the final word. The whole reason you are being forced to trust a machine at this most sensitive of all places, at the very source of your secret, is so that you can get an error if you mistype it later. That has value too, but mixing it into that last word might have been a mistake.
Either way, my point stands: "dice are for experts" is a choice builders are making and it doesn't really stand up to common sense. It serves their intests and not yours. In my experience, when someone wants you to be more dependent on them than necessary, you should assume there's a rug.
Most importantly, don't be intimidated into giving a custodian control of your money or into buying into a gadget company's "easy button." Both are preying on your fear and making you less secure.
Finally, you have to use your secret.
The third and final element of self-custody, where it does actually get technical, is using your secret. This is the actual "hard part" right now, and as tool-builders, I think we need to take responsibility. The tooling doesn't actually have to be hard to use, but it mostly still is. It's harder to use, requires more expertise, and is more error-prone than it ought to be. This isn't because the people building the tools are bad or incompetent either. And it doesn't mean they don't deserve our gratitude for the great progress that has been made.
Bitcoin and cryptography in general used to be a lot harder and we were collectively a lot worse at it. It's easy to look back and forget that some things can only be forged in experience. But I also believe the correct attitude for those of us building the tools should be that this problem is our responsibility. Blaming the users or saying the problem is just too hard is also not acceptable. "It's too hard" is an admission that we have not yet truly succeeded in our work.
We will get to the future of the tools below, but the principle that I want to put forward, which I think is useful to everyone now, is that the goal should be to separate the storage of the secret from the using of the secret. That is something that the hardware wallet model doesn't do by default. The better ones do separate the internet-connected computer from the signing. We call that "air-gapping," and it is very important. But creation and storage are not being separated, which is precisely what burned us here. Nor do we, with notable exceptions, separate storage and signing.
You can mitigate that by putting your Bitcoin under control of multiple secrets, so that some number of those secrets are needed to consent to transactions. This is called a "multisig." You can split the seed itself into pieces, called "shards" that can be stored in multiple locations, to make full authority over your funds recoverable without it being possible to capture it at any one location. You can derive one secret from another, which allows you to combine sharding and multisigs to get the best of both worlds, to put different funds in different buckets under different levels of security, and to create more separation between storage and signing.
Do you see how complicated that just got? This is where the tooling simply needs to mature, until we have a small set of good patterns that can ossify into a protocol and verifiable implementations, so that users have reasonably simple decisions to make, presented in simple human terms. Secure self-custody is still something that normal people can do, but it is harder than it should be and users deserve honesty and respect, not theater and dependency.
Fear, Dependency, and Growth
Rodolfo Novak, known widely as NVK, the CEO of Coinkite, obviously knows full well that it isn't wise to trust a device like theirs to create your secret. He seems to justify encouraging it with a low opinion of his users, which is both cynical and ironic in retrospect.
"My money is on people screwing themselves out of their BTC before any vendor tries a retirement attack.
Alternatively people could just use dice ;)"
— https://x.com/nvk/status/1341213389549412353
For context, a "retirement attack" is exactly what you would call the incident that just occurred if it were intentional on the part of the manufacturer.
I think users are owed both proper tools and the respectful assumption that they are competent adults, but I'm going to decline to pull this thread further. Evidence is still emerging. Some of what is coming out is very concerning, but it is a distraction from my purpose here to get caught up in speculation. There will always be bad actors, negligence, and honest mistakes. Which one this was doesn't change the point I am intending to make to you.
And it's not just him. He is just prominent and his name is on the immediate incident. The culture of learned helplessness is widespread and is actually being engineered into the tools. Take the "fix your last word" issue we ran into above. As I pointed out, wallets could just give you a way to do that. To my knowledge, none of them do. But all wallet makers and custody providers sing the same chorus about how "rolling dice is for experts."
I heard Zach Herbert, the CEO of Foundation, and Jameson Lopp both say this on a podcast called "The Block" earlier this very day. They know why you need a computer to "fix the last word" and how easy it is to let you do it in any of these wallets. But instead they turn dice rolling into something you do through the device. This inserts the device into the dice rolling process, defeating the very purpose of it, and making it feel like the dark arts. Theater. It's funny how the easy button finds a way to make the easy part hard, scary, and kind of pointless at the same time.
All of these experts know that the possibility of a "retirement attack" makes self-custody theater. It means that a vendor could rug you or fumble your bags, just like an exchange. Yet they continue to call it "self-custody" when, by default, unless you roll your own, they have more control over the source of the secret that controls your bitcoin than you do.
Yes, self-custody is hard, in many irreducible ways. And there will always be risks. But it's also a journey and it is one that every human being is on.
And yes, it's scary to self-custody your Bitcoin, and it is supposed to be. That fear is useful when it drives us to learn, to innovate, and to take control of our circumstances. Bitcoin changes you, and this is precisely how. Taking responsibility puts the fear of God into you, and it makes you grow.
When you learn to drive, operate a firearm, or take control of your money, you are supposed to feel afraid. That doesn't mean it's too hard or you can't do it. Custody providers and "easy" wallet manufacturers have the same perverse incentive to sell us dependency and short-circuit our development. When your stack begins to grow and you begin to feel anxiety about how you are holding it, that's when Bitcoin is doing its work. We've been redirecting that into easy-button theater and lulling users into complacency instead.
It's time for more honesty. You can learn from fear or you can learn from pain. And this moment is definitely the latter. So let's learn from it.
If you've made it this far with me, I want to take you one layer deeper, to the meta lesson I think we need to learn from what has happened: that bitcoin-specific solutions at the root of self-custody are not the right approach. And by "bitcoin-specific" I don't mean "as opposed to so-called cryptocurrencies in general." I mean: as opposed to solutions for keeping and using cryptographic secrets in general. That's a much broader technological need we all have. And it gets to the deeper point of why Bitcoin is so important and worthy of our dedication in the first place.
Along the way, I will point to some tools the Bitcoin gadget makers have tried to scare us away from. These happen to be precisely the tools that show us a better way.
The Case for General-Purpose Tools
So what are the problems with these gadgets being bitcoin-specific?
First and foremost, they are a target and they make you a target. Buying one and owning one reveal that you have Bitcoin. The supply chain can be poisoned with counterfeit or tampered devices to attack your Bitcoin. And even more importantly, bitcoin-specific solutions are fragile because they are niche. Finally, application-specific solutions to actually general problems, like keeping and using cryptographic secrets, fragment the problem and make coherent solutions impossible.
This is why I would say that we see an objectively better approach in the SeedSigner. The SeedSigner is a DIY microcomputer that you can assemble yourself from mass-market computer products: namely the Raspberry Pi. The components are widely available, widely used, relatively cheap, and are not an obvious path for targeting Bitcoin users. The firmware and software are mostly open source and it does not generate randomness for you. It insists that you bring your own, such as with dice, or by using the camera to capture real randomness from the world. It does not store your seed and when you turn it off and on again, you are starting with a clean slate.
Where wallets use bitcoin-specific hardware to create, store, and use your seed in one place, the SeedSigner is just software for you to build your own signing device for responsible air-gapping.
NVK has attacked SeedSigner repeatedly and, according to some reporting that I tend to believe from Matthew Kratter at Bitcoin University, has even squatted their domains. Although I think some competitive rough play is far from shocking, up to a point, when the gadget makers systematically push us away from a superior security model, sit on important grant funding boards in the space, and attack alternatives, I think it needs to be addressed.
Security is a serious responsibility, and we have a duty to put the security of our users above our personal and professional self-interest. This is doubly true in financial security and triply true in Bitcoin, for those of us who view honest money and digital freedom as existential civilizational matters.
A similar alternative to the SeedSigner is to use something called Tails OS on an old laptop with no connection to the Internet. This is an "amnesiac" or stateless version of Linux where the networking is optional at startup. As with SeedSigner, you download the software image, verify it via separately distributed hash, signature, and key, and it doesn't store anything unless you go out of your way to store it.
Both of these are great options for air-gapped signing and wallet and address generation. Neither requires bitcoin-specific hardware or turns you, or your Bitcoin, into a target.
Do note, however, that you still have to take responsibility for verifying the firmware and software. They both also have fairly deep upstream hardware and software supply chains. Tails is a bigger project with more eyes on it and is more general-purpose, but it also has a much bigger attack surface. I am comfortable using either, but there is always risk. There is no easy button. There is no free lunch. Whether it is a wallet company or a custodian, there is always risk.
The last example I want to give was actually my original inspiration for this essay and why I called it "NVK Was Wrong." I heard him on a podcast some months ago (I apologize, I can't remember where) FUDing (spreading fear, uncertainty, and doubt) against a widely used general-purpose, mass-market security device: the YubiKey. He was arguing, in essence, that a vulnerability found in the YubiKey's secure element firmware was a reason not to trust it. I did not find his logic to be sound.
The vulnerability in question, known as EUCLEAK, was found by a security research lab called NinjaLab and responsibly disclosed. In this vulnerability, a highly sophisticated adversary needs to steal the physical device, take it apart, and perform a side-channel attack on the secure element to extract a key using about $11k worth of specialized lab equipment to physically probe a subtle timing bug. There is no evidence that this attack has ever been performed in the wild. Yubico replaced the Infineon secure element's non-constant time ECDSA firmware implementation with their own to eliminate the timing variability that was being probed and responsibly executed a coordinated public disclosure.
This is actually healthy and shows the level of hardening pressure that YubiKeys are under. This is how security works, and I find it more reassuring than a cause for fear. I think I have been using YubiKeys for 15 years. It's a reminder that nothing is perfectly secure, but it also shows the battle testing they are subjected to.
YubiKeys are deployed pervasively within the US Government, including the Army, Navy, Air Force, Marine Corps, Space Force, the DoD's Missile Defense Agency, the FBI, and the NSA. The same is true in the most security-sensitive corporate sectors, including tech, the financial sector, and critical infrastructure. FIPS models carry FIPS 140-3 validation under NIST's Cryptographic Module Validation Program. Do you think all of these government agencies and companies trust each other? Do you think they don't take their security seriously? Besides the fact that Yubico itself has 10-60 times the revenue of Coinkite and at least an order of magnitude more technical staff, many of these interested parties are putting their devices under their own adversarial pressure, with extraordinarily strong incentives to keep them secure.
The logic of devaluing the security of the YubiKey by comparison to the security of the Coldcard on this basis is simply outlandish on its face. And it reads, to me, as irresponsible and self-serving. It's what made me see this flaw in our collective thinking about security for Bitcoin self-custody and the problem with the thought leadership we've been getting from the gadget makers. Hardware wallets have become synonymous with self-custody and their model has become the model, and I think it's the wrong one.
I would prefer if Yubico's hardware and firmware were open source. And we shouldn't trust anything blindly, but security is about tradeoffs. On balance, it does not stand to reason that any bitcoin-specific gadget is more secure than a YubiKey. It's not a knock on the many brilliant and expert people working on them. It's just a reality of resources. It's not remotely a fair fight. The toughest street gang in the world doesn't last 10 minutes against the US Marines. Our users are putting a lot on the line. They deserve realism.
None of this is to say that we should not build or that we should compromise our values. Quite the opposite, it is to say that we have to be honest about the scale of the problems that we are solving, or that we aren't. We have to have the courage to set our sights on something beyond being the biggest fish in our pond. We need general-purpose solutions to general problems. We need to build Bitcoin for the world and in the world, not just build our own little world in Bitcoin. Otherwise, this is all just larp. Speaking for myself, at least: I'm not interested in larp.
Conclusion: Are We Cypherpunks, or Not?
The goal of the cypherpunk movement was not to create a ghetto. It was always to use the power of cryptography to change the world. We've lost our way. We blamed the users and said "cryptography is just too hard for Johnny." So we gave up on building the kinds of tools that everyone can use. We decided to teach and sell hobbyist-grade opsec theater to each other, instead of stepping up to the real mission.
This wasn't about AI. This wasn't about NVK's chest beating and sharp elbows. What this was and is about is the fact that security is not a bitcoin-specific problem. Go back to the whitepaper and look at that little line in Satoshi's diagram under Section 10 ("Privacy"). That's the line where Bitcoin ends and the world begins. What that means is that self-custody is not a bitcoin-specific problem. It's identity itself. And we need to face that securing identity is an even bigger and harder problem to solve.
It's time for us to decide if we are really cypherpunks or if this is just a scene. Self-custody is hard because we have not solved the problem of securing control of our own identities in the world.
Satoshi gave us a critical piece of the puzzle, but it's up to us to preserve it and to figure out how to plug it in.
Self-custody does not exist to enable Bitcoin. Bitcoin exists to enable self-custody. Nostr exists to enable self-custody. Private communications exist to enable self-custody. Cryptography exists to enable self-custody. When we get it upside down, people get hurt.
"We the Cypherpunks are dedicated to building anonymous systems. We are defending our privacy with cryptography, with anonymous mail forwarding systems, with digital signatures, and with electronic money."
— Eric Hughes, "A Cypherpunk's Manifesto," 9 March 1993
Appendix: BIP39 24-Word Diceware Seed Generator
#!/bin/bash -p
# BIP39 24-word single-file diceware seed generator
#
# Use at your own risk, not audited.
# Use this on a safe computer, like air-gapped Tails OS.
# Do not just pick words. Humans are very predictable. You are not special.
# Be mindful of your surroundings, cameras, etc.
#
# You can use casino dice if you want to be very careful, though it would only
# matter if an attacker could know the particular bias of your particular dice.
# There are no known general biases of mass-produced dice.
#
# How to use
#
# 1. Print the table below and put five dice in a shoebox
# 2. Roll: shake and tilt the box, so dice are in a row. Call them A B C D E
# 3. If B and C or D and E are both a 5 or a 6, reroll
# 4. Note if A is odd or even (shown as - or + in the table).
# 5. Look up your roll in the table below and write down the word
# 6. Roll until you have 24 words - the last word will need to be "fixed"
# 7. Run this script on the command line and type in your seed to fix the last word
#
# $ chmod u+x bip39-diceware.sh
# $ ./bip39-diceware.sh
#
# The output is your new last word.
#
read -r -d '' DICE_TABLE <<'BIP39_DICE_TABLE' || :
-1111 abandon -2111 blossom -3111 copy -4111 elite -5111 gas -6111 hybrid
+1111 length +2111 object +3111 quote +4111 siege +5111 theme +6111 useless
-1112 ability -2112 blouse -3112 coral -4112 else -5112 gasp -6112 ice
+1112 lens +2112 oblige +3112 rabbit +4112 sight +5112 then +6112 usual
-1113 able -2113 blue -3113 core -4113 embark -5113 gate -6113 icon
+1113 leopard +2113 obscure +3113 raccoon +4113 sign +5113 theory +6113 utility
-1114 about -2114 blur -3114 corn -4114 embody -5114 gather -6114 idea
+1114 lesson +2114 observe +3114 race +4114 silent +5114 there +6114 vacant
-1115 above -2115 blush -3115 correct -4115 embrace -5115 gauge -6115 identify
+1115 letter +2115 obtain +3115 rack +4115 silk +5115 they +6115 vacuum
-1116 absent -2116 board -3116 cost -4116 emerge -5116 gaze -6116 idle
+1116 level +2116 obvious +3116 radar +4116 silly +5116 thing +6116 vague
-1121 absorb -2121 boat -3121 cotton -4121 emotion -5121 general -6121 ignore
+1121 liar +2121 occur +3121 radio +4121 silver +5121 this +6121 valid
-1122 abstract -2122 body -3122 couch -4122 employ -5122 genius -6122 ill
+1122 liberty +2122 ocean +3122 rail +4122 similar +5122 thought +6122 valley
-1123 absurd -2123 boil -3123 country -4123 empower -5123 genre -6123 illegal
+1123 library +2123 october +3123 rain +4123 simple +5123 three +6123 valve
-1124 abuse -2124 bomb -3124 couple -4124 empty -5124 gentle -6124 illness
+1124 license +2124 odor +3124 raise +4124 since +5124 thrive +6124 van
-1125 access -2125 bone -3125 course -4125 enable -5125 genuine -6125 image
+1125 life +2125 off +3125 rally +4125 sing +5125 throw +6125 vanish
-1126 accident -2126 bonus -3126 cousin -4126 enact -5126 gesture -6126 imitate
+1126 lift +2126 offer +3126 ramp +4126 siren +5126 thumb +6126 vapor
-1131 account -2131 book -3131 cover -4131 end -5131 ghost -6131 immense
+1131 light +2131 office +3131 ranch +4131 sister +5131 thunder +6131 various
-1132 accuse -2132 boost -3132 coyote -4132 endless -5132 giant -6132 immune
+1132 like +2132 often +3132 random +4132 situate +5132 ticket +6132 vast
-1133 achieve -2133 border -3133 crack -4133 endorse -5133 gift -6133 impact
+1133 limb +2133 oil +3133 range +4133 six +5133 tide +6133 vault
-1134 acid -2134 boring -3134 cradle -4134 enemy -5134 giggle -6134 impose
+1134 limit +2134 okay +3134 rapid +4134 size +5134 tiger +6134 vehicle
-1135 acoustic -2135 borrow -3135 craft -4135 energy -5135 ginger -6135 improve
+1135 link +2135 old +3135 rare +4135 skate +5135 tilt +6135 velvet
-1136 acquire -2136 boss -3136 cram -4136 enforce -5136 giraffe -6136 impulse
+1136 lion +2136 olive +3136 rate +4136 sketch +5136 timber +6136 vendor
-1141 across -2141 bottom -3141 crane -4141 engage -5141 girl -6141 inch
+1141 liquid +2141 olympic +3141 rather +4141 ski +5141 time +6141 venture
-1142 act -2142 bounce -3142 crash -4142 engine -5142 give -6142 include
+1142 list +2142 omit +3142 raven +4142 skill +5142 tiny +6142 venue
-1143 action -2143 box -3143 crater -4143 enhance -5143 glad -6143 income
+1143 little +2143 once +3143 raw +4143 skin +5143 tip +6143 verb
-1144 actor -2144 boy -3144 crawl -4144 enjoy -5144 glance -6144 increase
+1144 live +2144 one +3144 razor +4144 skirt +5144 tired +6144 verify
-1145 actress -2145 bracket -3145 crazy -4145 enlist -5145 glare -6145 index
+1145 lizard +2145 onion +3145 ready +4145 skull +5145 tissue +6145 version
-1146 actual -2146 brain -3146 cream -4146 enough -5146 glass -6146 indicate
+1146 load +2146 online +3146 real +4146 slab +5146 title +6146 very
-1151 adapt -2151 brand -3151 credit -4151 enrich -5151 glide -6151 indoor
+1151 loan +2151 only +3151 reason +4151 slam +5151 toast +6151 vessel
-1152 add -2152 brass -3152 creek -4152 enroll -5152 glimpse -6152 industry
+1152 lobster +2152 open +3152 rebel +4152 sleep +5152 tobacco +6152 veteran
-1153 addict -2153 brave -3153 crew -4153 ensure -5153 globe -6153 infant
+1153 local +2153 opera +3153 rebuild +4153 slender +5153 today +6153 viable
-1154 address -2154 bread -3154 cricket -4154 enter -5154 gloom -6154 inflict
+1154 lock +2154 opinion +3154 recall +4154 slice +5154 toddler +6154 vibrant
-1161 adjust -2161 breeze -3161 crime -4161 entire -5161 glory -6161 inform
+1161 logic +2161 oppose +3161 receive +4161 slide +5161 toe +6161 vicious
-1162 admit -2162 brick -3162 crisp -4162 entry -5162 glove -6162 inhale
+1162 lonely +2162 option +3162 recipe +4162 slight +5162 together +6162 victory
-1163 adult -2163 bridge -3163 critic -4163 envelope -5163 glow -6163 inherit
+1163 long +2163 orange +3163 record +4163 slim +5163 toilet +6163 video
-1164 advance -2164 brief -3164 crop -4164 episode -5164 glue -6164 initial
+1164 loop +2164 orbit +3164 recycle +4164 slogan +5164 token +6164 view
-1211 advice -2211 bright -3211 cross -4211 equal -5211 goat -6211 inject
+1211 lottery +2211 orchard +3211 reduce +4211 slot +5211 tomato +6211 village
-1212 aerobic -2212 bring -3212 crouch -4212 equip -5212 goddess -6212 injury
+1212 loud +2212 order +3212 reflect +4212 slow +5212 tomorrow +6212 vintage
-1213 affair -2213 brisk -3213 crowd -4213 era -5213 gold -6213 inmate
+1213 lounge +2213 ordinary +3213 reform +4213 slush +5213 tone +6213 violin
-1214 afford -2214 broccoli -3214 crucial -4214 erase -5214 good -6214 inner
+1214 love +2214 organ +3214 refuse +4214 small +5214 tongue +6214 virtual
-1215 afraid -2215 broken -3215 cruel -4215 erode -5215 goose -6215 innocent
+1215 loyal +2215 orient +3215 region +4215 smart +5215 tonight +6215 virus
-1216 again -2216 bronze -3216 cruise -4216 erosion -5216 gorilla -6216 input
+1216 lucky +2216 original +3216 regret +4216 smile +5216 tool +6216 visa
-1221 age -2221 broom -3221 crumble -4221 error -5221 gospel -6221 inquiry
+1221 luggage +2221 orphan +3221 regular +4221 smoke +5221 tooth +6221 visit
-1222 agent -2222 brother -3222 crunch -4222 erupt -5222 gossip -6222 insane
+1222 lumber +2222 ostrich +3222 reject +4222 smooth +5222 top +6222 visual
-1223 agree -2223 brown -3223 crush -4223 escape -5223 govern -6223 insect
+1223 lunar +2223 other +3223 relax +4223 snack +5223 topic +6223 vital
-1224 ahead -2224 brush -3224 cry -4224 essay -5224 gown -6224 inside
+1224 lunch +2224 outdoor +3224 release +4224 snake +5224 topple +6224 vivid
-1225 aim -2225 bubble -3225 crystal -4225 essence -5225 grab -6225 inspire
+1225 luxury +2225 outer +3225 relief +4225 snap +5225 torch +6225 vocal
-1226 air -2226 buddy -3226 cube -4226 estate -5226 grace -6226 install
+1226 lyrics +2226 output +3226 rely +4226 sniff +5226 tornado +6226 voice
-1231 airport -2231 budget -3231 culture -4231 eternal -5231 grain -6231 intact
+1231 machine +2231 outside +3231 remain +4231 snow +5231 tortoise +6231 void
-1232 aisle -2232 buffalo -3232 cup -4232 ethics -5232 grant -6232 interest
+1232 mad +2232 oval +3232 remember +4232 soap +5232 toss +6232 volcano
-1233 alarm -2233 build -3233 cupboard -4233 evidence -5233 grape -6233 into
+1233 magic +2233 oven +3233 remind +4233 soccer +5233 total +6233 volume
-1234 album -2234 bulb -3234 curious -4234 evil -5234 grass -6234 invest
+1234 magnet +2234 over +3234 remove +4234 social +5234 tourist +6234 vote
-1235 alcohol -2235 bulk -3235 current -4235 evoke -5235 gravity -6235 invite
+1235 maid +2235 own +3235 render +4235 sock +5235 toward +6235 voyage
-1236 alert -2236 bullet -3236 curtain -4236 evolve -5236 great -6236 involve
+1236 mail +2236 owner +3236 renew +4236 soda +5236 tower +6236 wage
-1241 alien -2241 bundle -3241 curve -4241 exact -5241 green -6241 iron
+1241 main +2241 oxygen +3241 rent +4241 soft +5241 town +6241 wagon
-1242 all -2242 bunker -3242 cushion -4242 example -5242 grid -6242 island
+1242 major +2242 oyster +3242 reopen +4242 solar +5242 toy +6242 wait
-1243 alley -2243 burden -3243 custom -4243 excess -5243 grief -6243 isolate
+1243 make +2243 ozone +3243 repair +4243 soldier +5243 track +6243 walk
-1244 allow -2244 burger -3244 cute -4244 exchange -5244 grit -6244 issue
+1244 mammal +2244 pact +3244 repeat +4244 solid +5244 trade +6244 wall
-1245 almost -2245 burst -3245 cycle -4245 excite -5245 grocery -6245 item
+1245 man +2245 paddle +3245 replace +4245 solution +5245 traffic +6245 walnut
-1246 alone -2246 bus -3246 dad -4246 exclude -5246 group -6246 ivory
+1246 manage +2246 page +3246 report +4246 solve +5246 tragic +6246 want
-1251 alpha -2251 business -3251 damage -4251 excuse -5251 grow -6251 jacket
+1251 mandate +2251 pair +3251 require +4251 someone +5251 train +6251 warfare
-1252 already -2252 busy -3252 damp -4252 execute -5252 grunt -6252 jaguar
+1252 mango +2252 palace +3252 rescue +4252 song +5252 transfer +6252 warm
-1253 also -2253 butter -3253 dance -4253 exercise -5253 guard -6253 jar
+1253 mansion +2253 palm +3253 resemble +4253 soon +5253 trap +6253 warrior
-1254 alter -2254 buyer -3254 danger -4254 exhaust -5254 guess -6254 jazz
+1254 manual +2254 panda +3254 resist +4254 sorry +5254 trash +6254 wash
-1261 always -2261 buzz -3261 daring -4261 exhibit -5261 guide -6261 jealous
+1261 maple +2261 panel +3261 resource +4261 sort +5261 travel +6261 wasp
-1262 amateur -2262 cabbage -3262 dash -4262 exile -5262 guilt -6262 jeans
+1262 marble +2262 panic +3262 response +4262 soul +5262 tray +6262 waste
-1263 amazing -2263 cabin -3263 daughter -4263 exist -5263 guitar -6263 jelly
+1263 march +2263 panther +3263 result +4263 sound +5263 treat +6263 water
-1264 among -2264 cable -3264 dawn -4264 exit -5264 gun -6264 jewel
+1264 margin +2264 paper +3264 retire +4264 soup +5264 tree +6264 wave
-1311 amount -2311 cactus -3311 day -4311 exotic -5311 gym -6311 job
+1311 marine +2311 parade +3311 retreat +4311 source +5311 trend +6311 way
-1312 amused -2312 cage -3312 deal -4312 expand -5312 habit -6312 join
+1312 market +2312 parent +3312 return +4312 south +5312 trial +6312 wealth
-1313 analyst -2313 cake -3313 debate -4313 expect -5313 hair -6313 joke
+1313 marriage +2313 park +3313 reunion +4313 space +5313 tribe +6313 weapon
-1314 anchor -2314 call -3314 debris -4314 expire -5314 half -6314 journey
+1314 mask +2314 parrot +3314 reveal +4314 spare +5314 trick +6314 wear
-1315 ancient -2315 calm -3315 decade -4315 explain -5315 hammer -6315 joy
+1315 mass +2315 party +3315 review +4315 spatial +5315 trigger +6315 weasel
-1316 anger -2316 camera -3316 december -4316 expose -5316 hamster -6316 judge
+1316 master +2316 pass +3316 reward +4316 spawn +5316 trim +6316 weather
-1321 angle -2321 camp -3321 decide -4321 express -5321 hand -6321 juice
+1321 match +2321 patch +3321 rhythm +4321 speak +5321 trip +6321 web
-1322 angry -2322 can -3322 decline -4322 extend -5322 happy -6322 jump
+1322 material +2322 path +3322 rib +4322 special +5322 trophy +6322 wedding
-1323 animal -2323 canal -3323 decorate -4323 extra -5323 harbor -6323 jungle
+1323 math +2323 patient +3323 ribbon +4323 speed +5323 trouble +6323 weekend
-1324 ankle -2324 cancel -3324 decrease -4324 eye -5324 hard -6324 junior
+1324 matrix +2324 patrol +3324 rice +4324 spell +5324 truck +6324 weird
-1325 announce -2325 candy -3325 deer -4325 eyebrow -5325 harsh -6325 junk
+1325 matter +2325 pattern +3325 rich +4325 spend +5325 true +6325 welcome
-1326 annual -2326 cannon -3326 defense -4326 fabric -5326 harvest -6326 just
+1326 maximum +2326 pause +3326 ride +4326 sphere +5326 truly +6326 west
-1331 another -2331 canoe -3331 define -4331 face -5331 hat -6331 kangaroo
+1331 maze +2331 pave +3331 ridge +4331 spice +5331 trumpet +6331 wet
-1332 answer -2332 canvas -3332 defy -4332 faculty -5332 have -6332 keen
+1332 meadow +2332 payment +3332 rifle +4332 spider +5332 trust +6332 whale
-1333 antenna -2333 canyon -3333 degree -4333 fade -5333 hawk -6333 keep
+1333 mean +2333 peace +3333 right +4333 spike +5333 truth +6333 what
-1334 antique -2334 capable -3334 delay -4334 faint -5334 hazard -6334 ketchup
+1334 measure +2334 peanut +3334 rigid +4334 spin +5334 try +6334 wheat
-1335 anxiety -2335 capital -3335 deliver -4335 faith -5335 head -6335 key
+1335 meat +2335 pear +3335 ring +4335 spirit +5335 tube +6335 wheel
-1336 any -2336 captain -3336 demand -4336 fall -5336 health -6336 kick
+1336 mechanic +2336 peasant +3336 riot +4336 split +5336 tuition +6336 when
-1341 apart -2341 car -3341 demise -4341 false -5341 heart -6341 kid
+1341 medal +2341 pelican +3341 ripple +4341 spoil +5341 tumble +6341 where
-1342 apology -2342 carbon -3342 denial -4342 fame -5342 heavy -6342 kidney
+1342 media +2342 pen +3342 risk +4342 sponsor +5342 tuna +6342 whip
-1343 appear -2343 card -3343 dentist -4343 family -5343 hedgehog -6343 kind
+1343 melody +2343 penalty +3343 ritual +4343 spoon +5343 tunnel +6343 whisper
-1344 apple -2344 cargo -3344 deny -4344 famous -5344 height -6344 kingdom
+1344 melt +2344 pencil +3344 rival +4344 sport +5344 turkey +6344 wide
-1345 approve -2345 carpet -3345 depart -4345 fan -5345 hello -6345 kiss
+1345 member +2345 people +3345 river +4345 spot +5345 turn +6345 width
-1346 april -2346 carry -3346 depend -4346 fancy -5346 helmet -6346 kit
+1346 memory +2346 pepper +3346 road +4346 spray +5346 turtle +6346 wife
-1351 arch -2351 cart -3351 deposit -4351 fantasy -5351 help -6351 kitchen
+1351 mention +2351 perfect +3351 roast +4351 spread +5351 twelve +6351 wild
-1352 arctic -2352 case -3352 depth -4352 farm -5352 hen -6352 kite
+1352 menu +2352 permit +3352 robot +4352 spring +5352 twenty +6352 will
-1353 area -2353 cash -3353 deputy -4353 fashion -5353 hero -6353 kitten
+1353 mercy +2353 person +3353 robust +4353 spy +5353 twice +6353 win
-1354 arena -2354 casino -3354 derive -4354 fat -5354 hidden -6354 kiwi
+1354 merge +2354 pet +3354 rocket +4354 square +5354 twin +6354 window
-1361 argue -2361 castle -3361 describe -4361 fatal -5361 high -6361 knee
+1361 merit +2361 phone +3361 romance +4361 squeeze +5361 twist +6361 wine
-1362 arm -2362 casual -3362 desert -4362 father -5362 hill -6362 knife
+1362 merry +2362 photo +3362 roof +4362 squirrel +5362 two +6362 wing
-1363 armed -2363 cat -3363 design -4363 fatigue -5363 hint -6363 knock
+1363 mesh +2363 phrase +3363 rookie +4363 stable +5363 type +6363 wink
-1364 armor -2364 catalog -3364 desk -4364 fault -5364 hip -6364 know
+1364 message +2364 physical +3364 room +4364 stadium +5364 typical +6364 winner
-1411 army -2411 catch -3411 despair -4411 favorite -5411 hire -6411 lab
+1411 metal +2411 piano +3411 rose +4411 staff +5411 ugly +6411 winter
-1412 around -2412 category -3412 destroy -4412 feature -5412 history -6412 label
+1412 method +2412 picnic +3412 rotate +4412 stage +5412 umbrella +6412 wire
-1413 arrange -2413 cattle -3413 detail -4413 february -5413 hobby -6413 labor
+1413 middle +2413 picture +3413 rough +4413 stairs +5413 unable +6413 wisdom
-1414 arrest -2414 caught -3414 detect -4414 federal -5414 hockey -6414 ladder
+1414 midnight +2414 piece +3414 round +4414 stamp +5414 unaware +6414 wise
-1415 arrive -2415 cause -3415 develop -4415 fee -5415 hold -6415 lady
+1415 milk +2415 pig +3415 route +4415 stand +5415 uncle +6415 wish
-1416 arrow -2416 caution -3416 device -4416 feed -5416 hole -6416 lake
+1416 million +2416 pigeon +3416 royal +4416 start +5416 uncover +6416 witness
-1421 art -2421 cave -3421 devote -4421 feel -5421 holiday -6421 lamp
+1421 mimic +2421 pill +3421 rubber +4421 state +5421 under +6421 wolf
-1422 artefact -2422 ceiling -3422 diagram -4422 female -5422 hollow -6422 language
+1422 mind +2422 pilot +3422 rude +4422 stay +5422 undo +6422 woman
-1423 artist -2423 celery -3423 dial -4423 fence -5423 home -6423 laptop
+1423 minimum +2423 pink +3423 rug +4423 steak +5423 unfair +6423 wonder
-1424 artwork -2424 cement -3424 diamond -4424 festival -5424 honey -6424 large
+1424 minor +2424 pioneer +3424 rule +4424 steel +5424 unfold +6424 wood
-1425 ask -2425 census -3425 diary -4425 fetch -5425 hood -6425 later
+1425 minute +2425 pipe +3425 run +4425 stem +5425 unhappy +6425 wool
-1426 aspect -2426 century -3426 dice -4426 fever -5426 hope -6426 latin
+1426 miracle +2426 pistol +3426 runway +4426 step +5426 uniform +6426 word
-1431 assault -2431 cereal -3431 diesel -4431 few -5431 horn -6431 laugh
+1431 mirror +2431 pitch +3431 rural +4431 stereo +5431 unique +6431 work
-1432 asset -2432 certain -3432 diet -4432 fiber -5432 horror -6432 laundry
+1432 misery +2432 pizza +3432 sad +4432 stick +5432 unit +6432 world
-1433 assist -2433 chair -3433 differ -4433 fiction -5433 horse -6433 lava
+1433 miss +2433 place +3433 saddle +4433 still +5433 universe +6433 worry
-1434 assume -2434 chalk -3434 digital -4434 field -5434 hospital -6434 law
+1434 mistake +2434 planet +3434 sadness +4434 sting +5434 unknown +6434 worth
-1435 asthma -2435 champion -3435 dignity -4435 figure -5435 host -6435 lawn
+1435 mix +2435 plastic +3435 safe +4435 stock +5435 unlock +6435 wrap
-1436 athlete -2436 change -3436 dilemma -4436 file -5436 hotel -6436 lawsuit
+1436 mixed +2436 plate +3436 sail +4436 stomach +5436 until +6436 wreck
-1441 atom -2441 chaos -3441 dinner -4441 film -5441 hour -6441 layer
+1441 mixture +2441 play +3441 salad +4441 stone +5441 unusual +6441 wrestle
-1442 attack -2442 chapter -3442 dinosaur -4442 filter -5442 hover -6442 lazy
+1442 mobile +2442 please +3442 salmon +4442 stool +5442 unveil +6442 wrist
-1443 attend -2443 charge -3443 direct -4443 final -5443 hub -6443 leader
+1443 model +2443 pledge +3443 salon +4443 story +5443 update +6443 write
-1444 attitude -2444 chase -3444 dirt -4444 find -5444 huge -6444 leaf
+1444 modify +2444 pluck +3444 salt +4444 stove +5444 upgrade +6444 wrong
-1445 attract -2445 chat -3445 disagree -4445 fine -5445 human -6445 learn
+1445 mom +2445 plug +3445 salute +4445 strategy +5445 uphold +6445 yard
-1446 auction -2446 cheap -3446 discover -4446 finger -5446 humble -6446 leave
+1446 moment +2446 plunge +3446 same +4446 street +5446 upon +6446 year
-1451 audit -2451 check -3451 disease -4451 finish -5451 humor -6451 lecture
+1451 monitor +2451 poem +3451 sample +4451 strike +5451 upper +6451 yellow
-1452 august -2452 cheese -3452 dish -4452 fire -5452 hundred -6452 left
+1452 monkey +2452 poet +3452 sand +4452 strong +5452 upset +6452 you
-1453 aunt -2453 chef -3453 dismiss -4453 firm -5453 hungry -6453 leg
+1453 monster +2453 point +3453 satisfy +4453 struggle +5453 urban +6453 young
-1454 author -2454 cherry -3454 disorder -4454 first -5454 hunt -6454 legal
+1454 month +2454 polar +3454 satoshi +4454 student +5454 urge +6454 youth
-1461 auto -2461 chest -3461 display -4461 fiscal -5461 hurdle -6461 legend
+1461 moon +2461 pole +3461 sauce +4461 stuff +5461 usage +6461 zebra
-1462 autumn -2462 chicken -3462 distance -4462 fish -5462 hurry -6462 leisure
+1462 moral +2462 police +3462 sausage +4462 stumble +5462 use +6462 zero
-1463 average -2463 chief -3463 divert -4463 fit -5463 hurt -6463 lemon
+1463 more +2463 pond +3463 save +4463 style +5463 used +6463 zone
-1464 avocado -2464 child -3464 divide -4464 fitness -5464 husband -6464 lend
+1464 morning +2464 pony +3464 say +4464 subject +5464 useful +6464 zoo
-1511 avoid -2511 chimney -3511 divorce -4511 fix
+1511 mosquito +2511 pool +3511 scale +4511 submit
-1512 awake -2512 choice -3512 dizzy -4512 flag
+1512 mother +2512 popular +3512 scan +4512 subway
-1513 aware -2513 choose -3513 doctor -4513 flame
+1513 motion +2513 portion +3513 scare +4513 success
-1514 away -2514 chronic -3514 document -4514 flash
+1514 motor +2514 position +3514 scatter +4514 such
-1515 awesome -2515 chuckle -3515 dog -4515 flat
+1515 mountain +2515 possible +3515 scene +4515 sudden
-1516 awful -2516 chunk -3516 doll -4516 flavor
+1516 mouse +2516 post +3516 scheme +4516 suffer
-1521 awkward -2521 churn -3521 dolphin -4521 flee
+1521 move +2521 potato +3521 school +4521 sugar
-1522 axis -2522 cigar -3522 domain -4522 flight
+1522 movie +2522 pottery +3522 science +4522 suggest
-1523 baby -2523 cinnamon -3523 donate -4523 flip
+1523 much +2523 poverty +3523 scissors +4523 suit
-1524 bachelor -2524 circle -3524 donkey -4524 float
+1524 muffin +2524 powder +3524 scorpion +4524 summer
-1525 bacon -2525 citizen -3525 donor -4525 flock
+1525 mule +2525 power +3525 scout +4525 sun
-1526 badge -2526 city -3526 door -4526 floor
+1526 multiply +2526 practice +3526 scrap +4526 sunny
-1531 bag -2531 civil -3531 dose -4531 flower
+1531 muscle +2531 praise +3531 screen +4531 sunset
-1532 balance -2532 claim -3532 double -4532 fluid
+1532 museum +2532 predict +3532 script +4532 super
-1533 balcony -2533 clap -3533 dove -4533 flush
+1533 mushroom +2533 prefer +3533 scrub +4533 supply
-1534 ball -2534 clarify -3534 draft -4534 fly
+1534 music +2534 prepare +3534 sea +4534 supreme
-1535 bamboo -2535 claw -3535 dragon -4535 foam
+1535 must +2535 present +3535 search +4535 sure
-1536 banana -2536 clay -3536 drama -4536 focus
+1536 mutual +2536 pretty +3536 season +4536 surface
-1541 banner -2541 clean -3541 drastic -4541 fog
+1541 myself +2541 prevent +3541 seat +4541 surge
-1542 bar -2542 clerk -3542 draw -4542 foil
+1542 mystery +2542 price +3542 second +4542 surprise
-1543 barely -2543 clever -3543 dream -4543 fold
+1543 myth +2543 pride +3543 secret +4543 surround
-1544 bargain -2544 click -3544 dress -4544 follow
+1544 naive +2544 primary +3544 section +4544 survey
-1545 barrel -2545 client -3545 drift -4545 food
+1545 name +2545 print +3545 security +4545 suspect
-1546 base -2546 cliff -3546 drill -4546 foot
+1546 napkin +2546 priority +3546 seed +4546 sustain
-1551 basic -2551 climb -3551 drink -4551 force
+1551 narrow +2551 prison +3551 seek +4551 swallow
-1552 basket -2552 clinic -3552 drip -4552 forest
+1552 nasty +2552 private +3552 segment +4552 swamp
-1553 battle -2553 clip -3553 drive -4553 forget
+1553 nation +2553 prize +3553 select +4553 swap
-1554 beach -2554 clock -3554 drop -4554 fork
+1554 nature +2554 problem +3554 sell +4554 swarm
-1561 bean -2561 clog -3561 drum -4561 fortune
+1561 near +2561 process +3561 seminar +4561 swear
-1562 beauty -2562 close -3562 dry -4562 forum
+1562 neck +2562 produce +3562 senior +4562 sweet
-1563 because -2563 cloth -3563 duck -4563 forward
+1563 need +2563 profit +3563 sense +4563 swift
-1564 become -2564 cloud -3564 dumb -4564 fossil
+1564 negative +2564 program +3564 sentence +4564 swim
-1611 beef -2611 clown -3611 dune -4611 foster
+1611 neglect +2611 project +3611 series +4611 swing
-1612 before -2612 club -3612 during -4612 found
+1612 neither +2612 promote +3612 service +4612 switch
-1613 begin -2613 clump -3613 dust -4613 fox
+1613 nephew +2613 proof +3613 session +4613 sword
-1614 behave -2614 cluster -3614 dutch -4614 fragile
+1614 nerve +2614 property +3614 settle +4614 symbol
-1615 behind -2615 clutch -3615 duty -4615 frame
+1615 nest +2615 prosper +3615 setup +4615 symptom
-1616 believe -2616 coach -3616 dwarf -4616 frequent
+1616 net +2616 protect +3616 seven +4616 syrup
-1621 below -2621 coast -3621 dynamic -4621 fresh
+1621 network +2621 proud +3621 shadow +4621 system
-1622 belt -2622 coconut -3622 eager -4622 friend
+1622 neutral +2622 provide +3622 shaft +4622 table
-1623 bench -2623 code -3623 eagle -4623 fringe
+1623 never +2623 public +3623 shallow +4623 tackle
-1624 benefit -2624 coffee -3624 early -4624 frog
+1624 news +2624 pudding +3624 share +4624 tag
-1625 best -2625 coil -3625 earn -4625 front
+1625 next +2625 pull +3625 shed +4625 tail
-1626 betray -2626 coin -3626 earth -4626 frost
+1626 nice +2626 pulp +3626 shell +4626 talent
-1631 better -2631 collect -3631 easily -4631 frown
+1631 night +2631 pulse +3631 sheriff +4631 talk
-1632 between -2632 color -3632 east -4632 frozen
+1632 noble +2632 pumpkin +3632 shield +4632 tank
-1633 beyond -2633 column -3633 easy -4633 fruit
+1633 noise +2633 punch +3633 shift +4633 tape
-1634 bicycle -2634 combine -3634 echo -4634 fuel
+1634 nominee +2634 pupil +3634 shine +4634 target
-1635 bid -2635 come -3635 ecology -4635 fun
+1635 noodle +2635 puppy +3635 ship +4635 task
-1636 bike -2636 comfort -3636 economy -4636 funny
+1636 normal +2636 purchase +3636 shiver +4636 taste
-1641 bind -2641 comic -3641 edge -4641 furnace
+1641 north +2641 purity +3641 shock +4641 tattoo
-1642 biology -2642 common -3642 edit -4642 fury
+1642 nose +2642 purpose +3642 shoe +4642 taxi
-1643 bird -2643 company -3643 educate -4643 future
+1643 notable +2643 purse +3643 shoot +4643 teach
-1644 birth -2644 concert -3644 effort -4644 gadget
+1644 note +2644 push +3644 shop +4644 team
-1645 bitter -2645 conduct -3645 egg -4645 gain
+1645 nothing +2645 put +3645 short +4645 tell
-1646 black -2646 confirm -3646 eight -4646 galaxy
+1646 notice +2646 puzzle +3646 shoulder +4646 ten
-1651 blade -2651 congress -3651 either -4651 gallery
+1651 novel +2651 pyramid +3651 shove +4651 tenant
-1652 blame -2652 connect -3652 elbow -4652 game
+1652 now +2652 quality +3652 shrimp +4652 tennis
-1653 blanket -2653 consider -3653 elder -4653 gap
+1653 nuclear +2653 quantum +3653 shrug +4653 tent
-1654 blast -2654 control -3654 electric -4654 garage
+1654 number +2654 quarter +3654 shuffle +4654 term
-1661 bleak -2661 convince -3661 elegant -4661 garbage
+1661 nurse +2661 question +3661 shy +4661 test
-1662 bless -2662 cook -3662 element -4662 garden
+1662 nut +2662 quick +3662 sibling +4662 text
-1663 blind -2663 cool -3663 elephant -4663 garlic
+1663 oak +2663 quit +3663 sick +4663 thank
-1664 blood -2664 copper -3664 elevator -4664 garment
+1664 obey +2664 quiz +3664 side +4664 that
BIP39_DICE_TABLE
set -euo pipefail
set +x
export LC_ALL=C
ulimit -c 0
exec </dev/tty >/dev/tty 2>&1
die() {
printf 'error: %s\n' "$*"
exit 1
}
(($# == 0)) || die "usage: ${0##*/}"
pair_index() {
local a=$1 b=$2
if ((a <= 4)); then
REPLY=$(((a - 1) * 6 + b - 1))
else
REPLY=$((24 + (a - 5) * 4 + b - 1))
fi
}
declare -a words
declare -A index
while IFS=$' \t' read -r -a fields; do
((${#fields[@]} >= 2 && ${#fields[@]} % 2 == 0)) ||
die 'malformed embedded table row'
for ((i=0; i<${#fields[@]}; i+=2)); do
code=${fields[i]}
word=${fields[i+1]}
sign=${code:0:1}
digits=${code:1}
a=${digits:0:1}; b=${digits:1:1}
c=${digits:2:1}; d=${digits:3:1}
pair_index "$a" "$b"; hi=$REPLY
pair_index "$c" "$d"; lo=$REPLY
offset=0
[[ $sign == + ]] && offset=1024
n=$((hi * 32 + lo + offset))
[[ -z ${words[n]+x} ]] || die 'duplicate dice mapping'
words[n]=$word
done
done <<< "$DICE_TABLE"
unset DICE_TABLE fields code digits sign word a b c d hi lo offset n i
((${#words[@]} == 2048)) || die 'embedded table is incomplete'
for i in "${!words[@]}"; do
word=${words[i]}
[[ $word =~ ^[a-z]+$ && -z ${index[$word]+x} ]] ||
die 'embedded word list is invalid'
index["$word"]=$i
done
unset i word
IFS=' ' read -r -s -p 'Enter the 24 words: ' -a mnemonic
printf '\n'
IFS=' ' read -r -s -p 'Enter them again: ' -a again
printf '\n'
((${#mnemonic[@]} == 24 && ${#again[@]} == 24)) ||
die 'enter exactly 24 words'
[[ "${mnemonic[*]}" == "${again[*]}" ]] ||
die 'the two entries do not match'
unset again
bits=
for i in "${!mnemonic[@]}"; do
word=${mnemonic[i]}
[[ $word =~ ^[a-z]+$ ]] ||
die "word $((i + 1)) is not in the word list"
[[ -n ${index[$word]+x} ]] ||
die "word $((i + 1)) is not in the word list"
n=${index[$word]}
last_bit=0
if ((i == 23)); then
last_bit=8
fi
for ((b=10; b>=last_bit; b--)); do
bits+=$(((n >> b) & 1))
done
done
((${#bits} == 256)) || die 'internal entropy length error'
emit_entropy() {
local i oct
for ((i=0; i<256; i+=8)); do
printf -v oct '%03o' "$((2#${bits:i:8}))"
printf '%b' "\\$oct"
done
}
hash=$(emit_entropy | /usr/bin/sha256sum)
hash=${hash%% *}
[[ $hash =~ ^[0-9a-f]{64}$ ]] || die 'SHA-256 failed'
last=${index[${mnemonic[23]}]}
fixed=$(((last & 0x700) | 16#${hash:0:2}))
printf 'Use this as word 24: %s\n' "${words[fixed]}"