SLIP39 generated seed phrase not recognized by Safe 3

Security
1

For testing purposes, I’ve tried to generate shamir backups with trezor’s python tool on github.

To be precise, I created 2 groups. One group with 3 of 5 and one group with 1 of 1. Only one group is required for the recovery.

The exact command used was:

shamir create -s 256 -t 1 -g 3 5 -g 1 1 -S <some secret> custom

Then I tried to recover by typing the 1 of 1 seed phrase into the safe 3. It keeps saying that the seed phrase is incorrect.

Is it that 1 of 1 portions are not supported by the hardware at the moment? Also, given that the extendable flag was added to the SLIP39 standard only a few days ago, can we also assume that it’s not supported on Safe 3 at the moment?

2

it’s the extendable flag.

it’s going to get added to the Safe 3 firmware in a month or so. If you absolutely need this to work right now for whatever reason, you can pass -X to the shamir command to produce a non-extendable share set

1 Like
3

Got it, thanks.

Also, on the safe 3 currently it’s not possible to generate backup shares with multiple groups (like the one I described above). Will it be possible to do so in the upcoming firmware update? If not, how do you recommend we securely generate such shares?

4

works perfectly fine on mine.

trezorctl device setup -b advanced

2 Likes
5

Is the new firmware (v2.7.2) supporting the extendable flag already? Or do we have to wait for the next minor release?

6

yeah, it should be there

7

Yup it’s working now!

Currently is there a way to perform the “Create multi-share backup” functionality which is accessible via the trezor suite, using trezorctl? i.e. enter the current seed, and then generate another group of shares.

I’ve been trying but can’t find anyway to do it via trezorctl.

8

it’s a flag to trezorctl device recover