Is spitting a BIP39 seed phrase in half meaningly less secure than splitting the entropy in half?

Question

One way to create a distribution, 2-of-3 backup of your seed phrase ABC is to store the following in three separate places:

• AB
• BC
• CA

Any two of these lists is sufficient to reconstructed the entire seed phrase. Seed Phrase Raid-5 is a nice improvement on this technique. In the example given above, an attacker who uncovers one of the three records (say, AB) already has 2/3 of the full seed phrase. The innovation of Raid 5 is to divide your seed phrase into only two pieces and compute X = A ^ B (XOR). Then if you lose either A or B (but not both) and still have X, you can get the lost piece back with a simple XOR.

The easy way to generate A and B for this purpose is simply to chop your 24 word seed phrase in half, and this makes recovery the original full seed phrase a trivial concatenation if you have both A and B. However:

1. Neither A, B, nor X will in general have a valid checksum (if you care)
2. A and is completely random, while the entire checksum for the 24 word phrase gets put into B (since the checksum is in the last word of the original seed phrase)

My question is, does #2 matter? It's only 8 non-random bits in B, yet cryptology seems full of examples where little cracks like this end up having big implications.

It might be tempting to say that we are simply stuck no matter what the answer, but there is an alternative: to compute the 256 bit entropy from the original seed phrase and divide it into two 128 bits pieces, e1 and e2. Then we let:

• A = mnemonic(e1)
• B = mnemonic(e2)
• X = mnemonic(e1 ^ e2)

Now A and B both contain 128 random bits, B contains no checksum information about A, and as a bonus A, B, and X are all valid 12 word seed phrases. However, the mnemonics A and B can no longer be used to reconstruct the original seed phrase via simple concatenation. You have to convert them to entropy and concatenate the entropy instead.

For example, https://github.com/julianbuettner/seed-phrase-raid-5 considers the seed phrase patient wall rural drink sleep school scatter twin sibling jeans panda frog believe bright major bonus autumn initial regular soul weird baby ecology average. If we simply XOR on by word basis, we get X = remember turkey desk foil setup rebel input cave direct grit sunny fancy. However, if we can the more complicated approach of cutting the entropy in half we get

• A = patient wall rural drink sleep school scatter twin sibling jeans panda fruit (note this differs from the original starting in the final word, where the checksum information lies)
• B = mule fade anchor cover rail strong win hollow test much love abstract. Note this looks nothing like the second half of our original seed phrase
• X = core polar remove income knock blood depth maple blouse trade brand friend

The second approach is more complicated and cannot be carried out on paper. Does it offer a meaingful security advantage over the first?

Answer 1

Disclaimer: I'm not a "security expert". You should neither trust me nor anyone else claiming they are one. Sticking to established standards and not rolling your own crypto will always be the safer option and I would personally recommend just that (e.g. a standard 2/3 multi-sig).

On your first question: I see no reason why the checksum in B would be a security compromise here. The checksum itself depends on the full entropy and knowing it does not reveal information about A. There are some other things to consider though.

Knowing the checksum would make guessing the "other half" easier or at least not as hard if we look at complexity per guess. Normally, the known-plaintext is whether an address contains balance and/or has been used, which requires a full derivation from mnemonic down to standard paths (i.e. lots of operations). If the checksum is known, the known-plaintext is the checksum itself, only requiring a quick check to see if there's a match.

However, if the attacker obtains B the search space is much bigger, requiring in the order of 2¹³² guesses since there are only 124 of 256 entropy bits in B. The advantage of less complexity per guess would be completely negligible.

Furthermore, the attacker has no way of knowing which backup they obtained in the first place. There is no way of statistically determining whether the last 8 bit are checksum or not. This will leave them with an average search space in the order of 2¹²⁸. They're also left with the risk of having obtained Backup X, which would require a different approach thus further complicating things.

Summarizing the scenarios:

1. If the attacker, for whatever reason, knows that backup B contains the checksum and which of the three backups they obtained:

   • Attacker obtains A: 124 bit of information missing. This is the weak point of the strategy, but is of no benefit to the attacker as long as they can't be sure about it.
   • Attacker obtains B: 132 bit of information missing.
   • Attacker obtains X: 128 bit of information missing.

2. If the attacker does not know which backup contains the checksum (which is most likely the case):

   • On average 128 bit of information missing.

Any of these scenarios provide sufficient security (i.e. time to move your funds) should one backup get compromised. I would not recommend going down the rabbit hole of your alternative proposal as, in my personal opinion, its complexity and additional risks (e.g. not being able to carry out on paper) outweigh any advantages gained.

Please let me know if I got something wrong!

---

_{I don't want to go off topic, but always like to remind people that their relatives/heirs may need to recover without any knowledge in the future. You should document and/or communicate your backup strategy in some way or another. This is less of an issue with standard methods as others can help more easily.}