MIME-Version: 1.0
References: <3D3BFE9C-CFF3-49FF-840F-063B52C69A42@voskuil.org>
 <164256450-0ee6752f92c0be297952fc72b59076df@pmq5v.m5r2.onet>
 <CA+XQW1iKVRmEnyP-CGM2Fo4qHi3SQHUfjEmKftDdju-uxHViJg@mail.gmail.com>
 <CAH+Axy4X+uQG5Vw0Efiz6AtNyK=++h-jDeZL1ZxpVJus8BVKeA@mail.gmail.com>
In-Reply-To: <CAH+Axy4X+uQG5Vw0Efiz6AtNyK=++h-jDeZL1ZxpVJus8BVKeA@mail.gmail.com>
From: Zac Greenwood <zachgrw@gmail.com>
Date: Sat, 9 Jul 2022 22:31:22 +0200
Message-ID: <CAJ4-pEA7WJpbExcsgdPWVNuZLrbDDhVYr37g6_6NSf7t41eB4w@mail.gmail.com>
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>, 
 James MacWhyte <macwhyte@gmail.com>
Content-Type: multipart/alternative; boundary="0000000000005f76c105e3653451"
Subject: Re: [bitcoin-dev] No Order Mnemonic
Precedence: list

--0000000000005f76c105e3653451
Content-Type: text/plain; charset="UTF-8"

Sorting a seed alphabetically reduces entropy by ~29 bits.

A 12-word seed has (12, 12) permutations or 479 million, which is ln(469m)
/ ln(2) ~= 29 bits of entropy. Sorting removes this entropy entirely,
reducing the seed entropy from 128 to 99 bits.

Zac


On Fri, 8 Jul 2022 at 16:09, James MacWhyte via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

>
> What do you do if the "first" word (of 12), happens to be the last word in
>> the list alphabetically?
>>
>
> That couldn't happen. If one word is the very last from the wordlist, it
> would end up at the end of your mnemonic once you rearrange your 12 words
> alphabetically.
>
> However!
>
> (@vjudeu) Choosing 11 random words and then sorting them alphabetically
> before assigning a checksum would reduce entropy considerably. If you think
> about it, to bruteforce the entire keyspace one would only need to come up
> with every possible combination of 11 words + 1 checksum. I'm not the best
> at napkin math, but I think that leaves you with around 10 trillion
> combinations, which would only take a couple months to exhaust with
> hardware that can do 1 million guesses per second.
>
>
> James
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

--0000000000005f76c105e3653451
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">Sorting a seed alphabetically reduces entropy by ~29 bits=
.</div><div dir=3D"auto"><br></div><div dir=3D"auto">A 12-word seed has (12=
, 12) permutations or 479 million, which is ln(469m) / ln(2) ~=3D 29 bits o=
f entropy. Sorting removes this entropy entirely, reducing the seed entropy=
 from 128 to 99 bits.</div><div dir=3D"auto"><br></div><div dir=3D"auto">Za=
c</div><div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_=
attr"><br></div><div dir=3D"ltr" class=3D"gmail_attr">On Fri, 8 Jul 2022 at=
 16:09, James MacWhyte via bitcoin-dev &lt;<a href=3D"mailto:bitcoin-dev@li=
sts.linuxfoundation.org">bitcoin-dev@lists.linuxfoundation.org</a>&gt; wrot=
e:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0=
.8ex;border-left-width:1px;border-left-style:solid;padding-left:1ex;border-=
left-color:rgb(204,204,204)"><div dir=3D"ltr"><div dir=3D"ltr"><br></div><d=
iv class=3D"gmail_quote"><blockquote class=3D"gmail_quote" style=3D"margin:=
0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;padding-lef=
t:1ex;border-left-color:rgb(204,204,204)"><div dir=3D"auto">What do you do =
if the &quot;first&quot; word (of 12), happens to be the last word in the l=
ist alphabetically?</div></blockquote><div><br></div><div>That couldn&#39;t=
 happen. If one word is the very last from the wordlist, it would end up at=
 the end of your mnemonic=C2=A0once you rearrange your 12 words alphabetica=
lly.<br><br>However!=C2=A0</div><div><br>(@vjudeu) Choosing 11 random words=
 and then sorting them alphabetically before assigning=C2=A0a checksum woul=
d reduce entropy considerably. If you think about it, to bruteforce the ent=
ire keyspace one would only need to come up with every possible combination=
 of 11 words=C2=A0+ 1 checksum. I&#39;m not the best at napkin math, but I =
think that leaves you with around=C2=A010 trillion combinations, which woul=
d only take a couple months to exhaust with hardware that can do 1 million =
guesses per second.</div></div></div><div dir=3D"ltr"><div class=3D"gmail_q=
uote"><div><br></div><div><br></div><div>James</div></div></div>
_______________________________________________<br>
bitcoin-dev mailing list<br>
<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" target=3D"_blank">=
bitcoin-dev@lists.linuxfoundation.org</a><br>
<a href=3D"https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" =
rel=3D"noreferrer" target=3D"_blank">https://lists.linuxfoundation.org/mail=
man/listinfo/bitcoin-dev</a><br>
</blockquote></div></div>

--0000000000005f76c105e3653451--