2

From Mastering Bitcoin: "From a security perspective, the amount of entropy actually used for the production of HD wallets is roughly 128 bits, which equals 12 words. Providing more than 12 words produces additional entropy which is unnecessary, and this unused entropy is not used for the derivation of the seed in the way that one might intially suspect."

  1. Why roughly 128 bits, and not exactly?
  2. Why the additional entropy provided by using more than 12 words is not used?
Improve this question

1 Answer 1

Reset to default
3

Why roughly 128 bits, and not exactly?

Reading BIP39, 12 words seems to imply exactly 128 bits of entropy.

Why the additional entropy provided by using more than 12 words is not used?

This is nonsense; it is used in exactly same way as the first 12 words. It's probably trying to say that more than 12 words does not meaningfully increase security, but in a very confused way.

Improve this answer
2
  • Why doesn't it meaningfully increase security? Doesn't each bit we add double the difficulty of finding the original number?
    – Rony Tesler
    Oct 12, 2021 at 19:40
  • 3
    256-bit ECDSA only has 128 bits of security, so nothing can exceed that. It doesn't matter if an attacker can't find your seed, if they can just find a private key instead.
    – Pieter Wuille
    Oct 12, 2021 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.