What is a mnemonic frequency analysis and why do I only need 4 letters of my seed words?

Question

Cryptosteel only allows to store the first 4 letters of each word of my mnemonic seed, the FAQ tells me why:

[...] you only need to assemble the first 4 letters of each word. Those 4 letters are unique and sufficient to recover the sentence and the entire bitcoin wallet. We did a frequency analysis and determined the minimum set of letters that are needed to create the Cryptosteel.

What is a mnemonic frequency analysis? Why do I only need the first 4 letters?

I am only using a mnemonic seed in the Greenbits Android wallet by GreenAddress. However, it uses 24 or 27 word phases and not 12. I tried to recover my seed from only the first 4 letters, but the wallet complains that some of them are no real words.

I'm assuming GreenAddress is using something different to BIP39 seeds and the first 4 letter rule does not apply to all seeds, is that correct?

Answer 1

There are multiple questions being asked here.

Firstly, some background info. BIP39 is a standard that includes word lists.

The English one can be found at https://github.com/bitcoin/bips/blob/master/bip-0039/english.txt

What is a mnemonic frequency analysis?

This is a fancy way of them saying that they figured out the minimum number of letters they need to store to uniquely identify what word from the word list you meant.

I'll do an analysis of a tiny word list (these words are in BIP39) right here as an example.

Imagine this is my word list:

abandon, ability, crane, crash.

It only has 4 words in the whole list, so the analysis is pretty simple.

Now, the longest words are "abandon" and "ability" at 7 each.

Noticing this, I could say at this point, that as long as I know up to the first 7 letters of any word in the word list, I can tell you what word it is in the list. This isn't very impressive though as I'm handing you back the same words you give me.

Alternatively, I could start from the lower end and see that simply knowing whether the first letter is a or c, I can already tell you which half of the word list your word is in.

The 2nd letter gives me no extra information as it will either be ab or cr - these are the only options.

The 3rd letter allows me to distinguish between abandon and ability but tells me nothing about words starting with cra.

The 4th letter, however, allows me to fully and uniquely differentiate every word in my word list.

1-letter frequencies

• a = 2
• c = 2

2-letter frequencies

• ab = 2
• cr = 2

3-letter frequencies

• aba = 1
• abi = 1
• cra = 2

4-letter frequencies

• aban = 1
• abil = 1
• cran = 1
• cras = 1

Related xkcd: https://what-if.xkcd.com/34/

Why do I only need the first 4 letters?

Because the analysis that cryptosteel did on the full BIP39 wordlist (not just my toy 4-word-long list) also had the same result - no more than 4 letters were needed to retrieve any unique word from the list.

I am only using a mnemonic seed in the Greenbits Android wallet by GreenAddress. However, it uses 24 or 27 word phases and not 12. I tried to recover my seed from only the first 4 letters, but the wallet complains that some of them are no real words. I'm assuming GreenAddress is using something different to BIP39 seeds and the first 4 letter rule does not apply to all seeds, is that correct?

It is correct that the "first 4 letter" rule does not apply to all seeds. It is specific to the word list used in BIP39, so it would apply to seeds using the same word list, and likely seeds using a very similar list, but not at all to totally different lists. Additionally, not all the BIP39 word lists are in English so the "first 4 letter" rule may not apply to other languages in BIP39 (could be interesting to research).

Without having prior knowledge of the details of GreenAddress, you haven't provided enough information for us to know what GreenAddress is doing with its seed.

We can't know just from the length of the word phrase (12, 24 or 27) whether GreenAddress implements BIP39. Their FAQ mentions BIP32 (HD wallets) but not BIP39 (the specific wordlist for the seed), so that's also inconclusive.

Assuming that they do support BIP39, the error message you are seeing is still reasonable. It would just mean the software is programmed to only accept a 100% match against a word from the word list, not partial matches, even if that partial match would be unique.

Some wallets will autocomplete the BIP39 word for you as you type to work around this problem (or accept the 4 letter version of the word), but you can always do the lookup by hand for any BIP39 compatible wallet that doesn't make it easy for you.

For example, if your cryptosteel has the letters enve stored in it, you can refer to the word list I linked above to find the word envelope.

Answer 2

To add to the previous answer, I have analysed the BIP39 wordlist for spanish for example, and 4 letters is not enough to uniquely identify each word, there are different words which their 4 first letters are the same.