One way to create a distribution, 2-of-3 backup of your seed phrase ABC is to store the following in three separate places:

• AB
• BC
• CA

Any two of these lists is sufficient to reconstructed the entire seed phrase. Seed Phrase Raid-5 is a nice improvement on this technique. In the example given above, an attacker who uncovers one of the three records (say, AB) already has 2/3 of the full seed phrase. The innovation of Raid 5 is to divide your seed phrase into only two pieces and compute X = A ^ B (XOR). Then if you lose either A or B (but not both) and still have X, you can get the lost piece back with a simple XOR.

The easy way to generate A and B for this purpose is simply to chop your 24 word seed phrase in half, and this makes recovery the original full seed phrase a trivial concatenation if you have both A and B. However:

1. Neither A, B, nor X will in general have a valid checksum (if you care)
2. A and is completely random, while the entire checksum for the 24 word phrase gets put into B (since the checksum is in the last word of the original seed phrase)

My question is, does #2 matter? It's only 8 non-random bits in B, yet cryptology seems full of examples where little cracks like this end up having big implications.

It might be tempting to say that we are simply stuck no matter what the answer, but there is an alternative: to compute the 256 bit entropy from the original seed phrase and divide it into two 128 bits pieces, e1 and e2. Then we let:

• A = mnemonic(e1)
• B = mnemonic(e2)
• X = mnemonic(e1 ^ e2)

Now A and B both contain 128 random bits, B contains no checksum information about A, and as a bonus A, B, and X are all valid 12 word seed phrases. However, the mnemonics A and B can no longer be used to reconstruct the original seed phrase via simple concatenation. You have to convert them to entropy and concatenate the entropy instead.

For example, https://github.com/julianbuettner/seed-phrase-raid-5 considers the seed phrase patient wall rural drink sleep school scatter twin sibling jeans panda frog believe bright major bonus autumn initial regular soul weird baby ecology average. If we simply XOR on by word basis, we get X = remember turkey desk foil setup rebel input cave direct grit sunny fancy. However, if we can the more complicated approach of cutting the entropy in half we get

• A = patient wall rural drink sleep school scatter twin sibling jeans panda fruit (note this differs from the original starting in the final word, where the checksum information lies)
• B = mule fade anchor cover rail strong win hollow test much love abstract. Note this looks nothing like the second half of our original seed phrase
• X = core polar remove income knock blood depth maple blouse trade brand friend

The second approach is more complicated and cannot be carried out on paper. Does it offer a meaingful security advantage over the first?