Should the BIP 39 mnemonic sentence checksum be eliminated from the standard? Does it do more harm than good?

Question

Should the BIP 39 checksum be eliminated from the standard? Should the BIP39 checksum be made optional to improve security?

Answer 1

No, I don't think the checksum should be removed or made optional. It doesn't do more harm that good.

Bip39 is a simple way to copy computer-generated randomness from the computer onto, eg a piece of paper. This Bip39 mnemonic sentence can then be used to restore your wallet, should you lose your computer. The checksum provides some degree of certainty on the correctness of the mnemonic you enter.

However, lately, people have begun to explore how to create their own randomness when creating a new wallet. This can be done with dice, coin-flips, etc. You might want to do this for example if you don't trust that the computer's random-number generator is doing its job well.

Since most wallets offer a way to restore a wallet using bip39 mnemonic sentences, people are trying to use that feature as a way to create new wallets from manually generated randomness. This is where the problem lies.

Actually, it's stated in the Motivation section of bip39:

This guide is meant to be a way to transport computer-generated randomness with a human-readable transcription. It's not a way to process user-created sentences (also known as brainwallets) into a wallet seed.

So we're actually using bip39 in a non-intended way, and that's why it's so awkward. The solution to this is not to modify bip39, but to acknowledge that we're doing it wrong.

Instead of entering manual randomness into a computer through bip39, we should invent other means of transferring the manual randomness into the computer. Some wallets already offer this. For example, ColdCard lets you input dice rolls one by one until you think you have enough randomness and then the device will provide you with a bip39 mnemonic sentence for you to backup on paper. That's one way to do it.

As you may have noticed, since writing about this on Twitter (cited in Michael Folksons's answer), Mastodon, and Reddit, I've changed my mind about this. I no longer think that making bip39 checksum optional is the solution. The solution is to not use bip39 to input randomness into a computer. The purpose of BIP39 is to transfer computer-generated randomness to a human, not the other way around.

Answer 2

Not having a checksum means that users would be able to easily pick their own mnemonic seed phrase in a non-random way, and that presents a really huge security risk to those users!

While it would also enable easier provable physical entropy gathering methods, this enabling of extremely poor entropy seed phrases could likely be of huge detriment to naive users. See for example, the brain flayer project, which can crack brain wallets with astonishing efficiency. To be clear: users that put funds in a wallet generated from a low-entropy seed are at a greatly increased risk of having all funds stolen.

Not having to trust software to produce the checksum is a rather small gain, considering that the user is still going to have to trust software to produce keypairs and bitcoin addresses from the mnemonic seed phrase already. Calculating keypairs or payment addresses by hand is pretty obviously untenable, and without these keys / addresses, the wallet is of no real use.

So considering the extremely large risk to naive users, and the extremely small gain in having less software-dependance, it is likely a bad idea to consider removing checksums from the BIP39 standard.

Answer 3

Kalle Rosenbaum argued for this on Twitter.

The checksum is between 4 (for 12 words) and 8 (24 words) bits. This is a very weak checksum. For 12 words, this would mean 1/16 probability of failure to detect a mistyped sequence of VALID words!

The words themselves are a much stronger checksum. Any misspelled word has a much higher probability to be detected due to word missing in wordlist; It's unlikely to misspell a word so that it becomes another valid word.

When does the checksum help you? It's not when you write down the mnemonic on paper. The paper/pencil doesn't check the checksum.

The checksum could help when you want to recover the wallet. If the checksum is wrong AND all words exist in the wordlist, it will help you realize there's something wrong with it.

But you'll also realize there's something wrong with it if there are no transactions or bitcoin in your "recovered" wallet, or that you don't recognize the addresses generated in it. The checksum, at best, only helps you realize it earlier.

The checksum also has a major turnoff: It's hard to generate a mnemonic without a computer. You can roll dice to generate 128 bits of entropy, but then you need to put those bits into a computer to calculate the checksum, "the final word".

This "final word" step is a security risk. If you're a novice, it's very hard to do the final word generation in a secure way. This risk is far worse than the dubious benefit explained above.

If wallets would accept mnemonics without checksum you could create a mnemonic with ONLY dice and a wordlist and give it to a hardware wallet or airgapped computer and be done with it. You don't have to setup a secure environment to generate a nearly useless checksum.

Exactly how BIP39 could be modified to make checksum optional is another question, but it's doable.