BIP: ? Layer: Applications Title: Great Wall—Tacit-knowledge seed derivation by fractal recall Authors: Yuri S Villas Boas <yuri@t3infosecurity.com> Status: Draft Type: Specification Assigned: ? License: BSD-2-Clause Discussion: https://github.com/Yuri-SVB/Great-Wallet Requires: 32, 39
This BIP describes Great Wall, a procedure for deriving a BIP-0032 master seed from a secret that exists only in the user's memory. Instead of writing down a BIP-0039 mnemonic, the user memorizes a sequence of locations on a deterministically rendered fractal. The recalled locations are decoded by a bijective bisection algorithm into raw entropy, which is then re-encoded as a BIP-0039 mnemonic and stretched into a seed exactly as in BIP-0039, so all derived keys and addresses are identical to those a BIP-0039 wallet would produce from the same entropy.
The scheme is built around Tacit Knowledge-Based Authentication (TKBA): the secret is held as non-verbalizable procedural memory and its deployment is gated by a tunable memory-hard key-derivation function, so that the secret cannot be extracted under coercion and brute-force search is computationally expensive. The proposal is forward- and backward-compatible with BIP-0039 and composes with Formosa (BIP-0450).
This BIP is licensed under the BSD 2-clause license.
Every conventional Bitcoin backup is a physical artifact: a seed phrase on paper or metal, a hardware wallet, an encrypted file. Each can be stolen, seized, photographed, destroyed, or surrendered under a "$5 wrench" coercion attack. A seed that exists only in memory removes the artifact, but naive memorization of 128–256 bits is unreliable, and a secret that can be recited can be extracted under duress.
Great Wall addresses both problems at once. The secret is a set of locations on a fractal that the user learns through spaced repetition until recall becomes tacit — procedural knowledge that the user can reproduce by doing but cannot accurately dictate from memory. Recovery additionally requires running a deliberately slow, memory-hard key-derivation function, so even a coerced user cannot produce the seed faster than that function allows, and an attacker who learns the entire method gains nothing without both the tacit recall and the computation time.
This document specifies only how computer-generated entropy is transported through human tacit memory into a BIP-0032 seed. It is not a scheme for turning user-invented passphrases or pictures into keys (a "brainwallet").
- mathematics-canonical fractal: the bare Burning Ship escape-time set defined by its mathematical formula alone.
- app-canonical fractal: the fractal the application actually renders for stage 1 — the mathematics-canonical Burning Ship with a fixed baseline perturbation always applied (see below). It is identical for every user and is what is meant by "canonical fractal" elsewhere in this document.
- perturbed fractal: the stage-2 user-specific Burning Ship variant produced by perturbation parameters derived from the user's stage-1 recall.
- bisection algorithm: the deterministic procedure that, given a fractal, recursively splits the current area into exactly two valid halves plus one discarded area; one entropy bit selects which valid half to descend into.
- binary area tree: the regular binary tree induced by the bisection algorithm over a fractal; each node is an area, each node has exactly two valid children, and the recursion ends at a leaf area.
- leaf area: the terminal area a finite bit string decodes to; the visual region the user must recognize from memory.
- point: one memorized location, i.e. one leaf area; each point encodes a fixed 32 bits of entropy.
- stage-1 bits / stage-2 bits: the entropy shares decoded from the points on the app-canonical and perturbed fractals respectively.
- raw entropy: the concatenation
stage-1 bits || stage-2 bits, of length 128–256 bits, equal to a BIP-0039 entropy. - KDF: the memory-hard key-derivation function (Argon2) whose runtime is calibrated by the user.
All fractal mathematics MUST be evaluated in a fixed-point format,
hereafter I4F60: one sign bit, three integer bits and sixty
fractional bits, representing values in the half-open interval
[-8, +8) with uniform precision 2^-60
(approximately 8.67 x 10^-19). IEEE-754 floating point MUST NOT be used for
any value that influences the bisection path, because rounding modes,
denormals and NaN handling vary across platforms and would break the
bijection between entropy and locations. The escape-time iteration, the
contraction/zoom math, the neighbor ordering and the bisection algorithm
MUST all be specified and implemented bit-for-bit identically; any deviation
invalidates previously encoded secrets.
Each fractal is navigated by a bisection algorithm that lives up to its name: at every step it splits the current area into exactly two valid sub-areas. The cut is made across whichever dimension is currently the largest (a vertical cut when the area is wider than tall, a horizontal cut when it is taller than wide), so successive descents alternate between a left/right choice and an up/down choice as the area's aspect ratio changes. The split is governed by two deterministic heuristics:
- Weighted median placement. The cut is not placed at the geometric centre but at the weighted median of the sample distribution of "good islands" found within the current area. This typically yields one larger and one smaller valid half.
- Contraction of the larger half. The span between the weighted median and the larger half's opposing edge is shortened by an amount proportional to how much larger that half is than the smaller one. The shortened-away strip becomes a discarded area.
Applied recursively, the bisection algorithm associates to each fractal a regular binary area tree: every node is an area, every internal node has exactly two valid children (the discarded area is not a child), and the leaves are the recognisable leaf areas. Reading a memorized point as the sequence of binary descents — each taken along the current area's largest dimension, hence alternating between left/right and up/down — yields its bits; concatenating the points in order yields the stage bits. The mapping between bit strings and leaf areas is bijective.
The discarded areas give the scheme a checksum-like effect: a randomly or wrongly recalled coordinate frequently lands in a discarded area and is rejected outright rather than silently decoding to wrong entropy.
The underlying mathematics-canonical fractal is the Burning Ship set,
z_{n+1} = ( |Re(z_n)| + i|Im(z_n)| )^2 + c
The fractal rendered for stage 1 is, however, the app-canonical
fractal: the mathematics-canonical Burning Ship with a fixed baseline
value of the perturbation parameter p always applied. This
baseline is a protocol constant present even in the canonical case (it is
not the all-zero perturbation). Its purpose is to rule out a thin tail
region of the mathematics-canonical Burning Ship that is prone to yielding
bad (degenerate or non-recognisable) leaf areas; excluding it keeps every
leaf area navigable and memorable. The app-canonical fractal is rendered
over a fixed viewport in I4F60 arithmetic with a fixed escape radius and
iteration cap that are protocol constants, and is identical for every user.
The user memorizes an ordered sequence of points on the app-canonical fractal; decoding them through the binary area tree yields the stage-1 bits. Stage 1 is reproducible from memory alone and requires no stored state.
The stage-1 bits are passed through the KDF to derive the perturbation
parameters (o, p, q). Whereas the app-canonical fractal applies
only the fixed baseline value of p, stage 2 applies the full
user-specific (o, p, q), producing a visually distinct Burning
Ship landscape unique to that user, rendered with the same I4F60 rules and
navigated by the same bisection algorithm and binary area tree. The user
memorizes a second sequence of points on this perturbed fractal;
decoding them yields the stage-2 bits. The parameters
(o, p, q) are never stored; they exist only ephemerally while
the perturbed fractal is being rendered, so the stage-2 landscape cannot
materialize until the KDF over the stage-1 recall has completed.
Each point encodes exactly 32 bits. Entropy is split evenly between the two
stages, so the number of points memorized per stage is
(entropy bits) / 2 / 32. For the BIP-0039-valid entropy lengths
this gives:
| Raw entropy bits | Points per stage | Total points | BIP-0039 words | +------------------+------------------+--------------+----------------+ | 128 | 2 | 4 | 12 | | 192 | 3 | 6 | 18 | | 256 | 4 | 8 | 24 |
Implementations MAY offer intermediate BIP-0039 lengths (160, 224 bits) by allowing the per-stage split to differ by at most one point. Larger entropy increases security at the cost of more points to memorize and train.
raw entropy = stage-1 bits || stage-2 bits (128–256 bits)
BIP-0039 mnemonic = BIP-0039-encode(raw entropy + checksum)
seed (512 bits) = PBKDF2-HMAC-SHA512(
password = BIP-0039 mnemonic (UTF-8 NFKD),
salt = "mnemonic" + passphrase (UTF-8 NFKD),
c = 2048,
dkLen = 64 )
The raw entropy MUST be a valid BIP-0039 entropy length (128, 160, 192, 224
or 256 bits). A checksum of (entropy bits)/32 bits, taken from
SHA-256 of the entropy, is appended before BIP-0039 word encoding, exactly
as in BIP-0039. The resulting seed is fed to BIP-0032 unchanged. Because the
seed is a function of the raw entropy only, the same recall always yields
the same keys and addresses, and the entropy MAY equivalently be rendered as
a Formosa (BIP-0450) mnemonic or a plain BIP-0039 mnemonic for backup or
migration without changing any derived key.
The master secret MUST NOT be displayed; all derived material SHOULD exist only as ephemeral application state during a recall session.
The KDF runtime is NOT a protocol constant; the user calibrates it to a target attack model (e.g. hours to defeat opportunistic robbery, about a week to defeat multi-day coercion). Larger runtime increases coercion-resistance at the cost of longer legitimate recovery.
Implementations MAY additionally seal session state (the perturbation
parameters, encoded locations and scheduler data) under a key derived from
the solution of an RSW (Rivest–Shamir–Wagner) time-lock puzzle. The puzzle
requires t sequential modular squarings
x -> x^(2^t) mod N with O(1) setup for any chosen delay
t. Only the puzzle operands (N, x, t) — never the
ciphertext — may be handed to a third party for paid solving, so puzzle
solving can be outsourced (e.g. over Lightning) without surrendering
custody. A time-lock longer than the KDF runtime provides no extra
protection and SHOULD NOT be used, since a holder of the stage-1 recall can
re-derive faster through the KDF.
An OPTIONAL dead-man's-switch inheritance protocol MAY be layered on top.
The testator periodically rotates time-lock-gated channels; if rotation
stops, an heir may claim only after observed silence lasting one full
time-lock epoch plus a grace period, and any later rotation by a
still-living testator revokes an in-progress heir solve. The heir-branch
spending key is MuSig2(s_i·G, h·G), combining a per-epoch
testator hand-off scalar s_i (encrypted under the hash of the
time-lock solution) with an heir channel share h derived from
the heir's own Great Wall secret, so neither coercing the testator nor
robbing the heir alone suffices. Channel keys are deterministically derived
from each party's master secret, derivation path and epoch number, so no
channel state need be stored. Cascading inheritance is expressed with opaque
taproot fallback addresses, one independent leaf per next-generation heir.
The full inheritance construction is OPTIONAL and not required for the core
seed-derivation scheme.
Why a fractal rather than a word list? A fractal provides an effectively unbounded, navigable space whose locations can be rehearsed as motor/visual procedure. Spaced repetition turns navigation into tacit recall: reliable to reproduce, hard to verbalize, and therefore resistant to coerced disclosure in a way a recitable word list is not.
Why a baseline perturbation in the app-canonical fractal? The bare
mathematics-canonical Burning Ship has a thin tail region that produces
degenerate, hard-to-recognise leaf areas. Always applying a fixed baseline
value of p — even in the "canonical" stage-1 case — excludes
that tail so that every leaf area the user might memorize is navigable and
memorable. This is why the app renders an app-canonical fractal rather than
the raw mathematical set.
Why a binary (not n-ary) bisection? A strictly binary split makes each fractal a regular binary area tree, so one entropy bit maps to one left/right descent and the entropy-to-location mapping is an exact bijection. The weighted-median split with contraction additionally carves out a discarded area at every step, giving a checksum-like effect: most mis-recalled coordinates fall into discarded areas and are rejected instead of silently decoding to the wrong key.
Why two stages? Splitting entropy across a canonical fractal and a KDF-perturbed personal fractal means the second landscape cannot even be rendered until the slow KDF over the first stage has run. This binds the computational gate to the recall itself: a coerced user cannot shortcut the delay, and an attacker who records the screen learns nothing about stage 2 before the KDF completes.
Why fixed-point I4F60 arithmetic? The mapping from entropy to locations must be a stable bijection across every platform and every future re-derivation. Floating point is not portable at the bit level; a fixed-point format with explicitly specified rounding makes the encoding reproducible forever, which is mandatory for a memory-only backup.
Why re-encode through BIP-0039? Deriving the seed from the raw entropy via the BIP-0039 word encoding and PBKDF2 makes the seed a function of the entropy alone. This guarantees that the security analysis of BIP-0039 and BIP-0032 carries over unchanged, that the same entropy can be backed up as a BIP-0039 or Formosa (BIP-0450) mnemonic, and that a Great Wall user and a plain BIP-0039 wallet derive identical keys from the same entropy.
Why a tunable KDF instead of a fixed cost? Coercion-resistance is a function of how slow recovery is for everyone, including the legitimate user under duress. The right cost depends on the user's personal threat model, so the runtime is a user-calibrated parameter, not a protocol constant. The optional time-lock puzzle adds a per-session, outsourceable delay that can be aligned to spaced-repetition review intervals without weakening custody.
Why MuSig2 for the heir branch? Requiring a 2-of-2 of a testator per-epoch share and an heir share — each independently protected by its owner's tacit knowledge and KDF — means no single coerced party can move inherited funds, closing the "kill the testator then rob the heir" attack.
Great Wall does not change BIP-0039 or BIP-0032; it only specifies an alternative way to obtain the entropy that feeds them. Any entropy produced by a Great Wall recall is an ordinary BIP-0039 entropy and can be exported as a BIP-0039 or Formosa (BIP-0450) mnemonic at any time. Wallets that do not implement Great Wall are unaffected and continue to operate exactly as before; they simply cannot perform fractal recall, but can spend from a seed exported from Great Wall as a standard mnemonic.
- The bijection between entropy and fractal locations — and therefore the I4F60 arithmetic, the baseline value of
pin the app-canonical fractal, the weighted-median and contraction heuristics, and the bisection ordering — MUST be specified and frozen; any change silently invalidates existing secrets. - The discarded-area "checksum-like" effect is a usability aid that rejects many mis-recalls early; it is NOT a cryptographic integrity check and does not replace the BIP-0039 checksum, which is still computed and verified on the raw entropy.
- The KDF runtime is the dominant security parameter against both brute force and coercion and MUST be chosen deliberately; the optional time-lock puzzle MUST NOT exceed it.
- Perturbation parameters and the master secret MUST remain ephemeral and MUST NOT be persisted or displayed.
- RSW time-lock security relies on the hardness of factoring; a break (e.g. by a large quantum computer) requires migrating the inheritance gating from off-chain decryption to an on-chain relative timelock (OP_CHECKSEQUENCEVERIFY), preserving the dead-man's-switch and MuSig2 semantics.
- Tacit recall must be maintained by regular spaced-repetition practice; loss of practice can cause permanent loss of funds, the same risk profile as losing a written seed.
A reference fractal encoder (great-wall-core) and accompanying
documentation are available from