Bitcoin Mnemonic Backup via Threshold XOR (n-of-m): A pen-and-paper adaptation of the Kurihara scheme to BIP39

Backing up a BIP39 mnemonic forces a trade-off between the fragility of a single copy and the operational complexity of multisig or software-based threshold schemes (Shamir, SLIP-39, Codex32), the latter relying on finite-field arithmetic. We adapt the ideal threshold XOR secret-sharing scheme of Kurihara, Kiyomoto, Fukushima and Tanaka (2008) to BIP39 mnemonics, yielding an n-of-m pen-and-paper backup in which every operation — generation and reconstruction — reduces to XORs of hexadecimal strings, with no modular arithmetic, no finite field, and no mandatory software. Any n of the m shares reconstruct the seed, while strictly fewer than n reveal nothing (perfect, information-theoretic confidentiality up to the threshold). Each share is exactly the size of the secret and re-encodes to a valid BIP39 mnemonic, providing plausible deniability. We share only the entropy and let the BIP39 checksum act as a safeguard; we give concrete parameters for 12 and 24-word mnemonics (2-of-3 and 3-of-5), detail the reconstruction by Gaussian elimination over GF(2) including the regeneration of a lost share, restate the scheme’s two security theorems with explicit verifications for the central configuration, and provide ready-to-print templates and a reference implementation.