How (un)safe is it to use non-random seed words?

Question

Suppose someone chooses to use a seed (mnemonic) that is easy to memorise, like true kid true kid true kid true kid true kid true kid - using a passphrase, of course.

The benefit is clear: he'd only have to memorise 2 words and the passphrase (and he already memorises his current passphrase). If the person forgets what were the 2 words, he can still easily brute force it, provided he remembers the passphrase and that there were 2 alternating words.

Now, how unsafe/safe is that? I can't really imagine there's someone trying to brute force passphrases of simplistic seeds out of nowhere. If my math is right, 2 alternating words mean 2048 * 2047 * 3 possible combinations (1st word, 2nd word and 12/18/24 length).

Considering a relatively short 8 alphanumeric character passphrase, the number of possibilities is 2048 * 2047 * 3 * 36⁸ = 3,54 × 10¹⁹, which is a huge number. For comparison, it cost this guy ~425 USD and 30 hours to brute force 1 trillion seeds, and not only he knew there was a prize, but also had an address to look for.

Are the any flaws in these thoughts? Any pattern in the seed inner workings that could shorten the brute force job?

Edit: if you can, please specify a theoretical scenario in which an attacker could attempt to steal funds.

Answer 1

There is a lot to unwrap here. I'll go over the points that need addressing, most important first:

Don't try to invent your own cryptographic scheme

If you read the manual to your wallet, it most certainly says to generate a random mnemonic, and explains why you might (and might not) want to use a passphrase. The manufacturer/developer knows very well why they tell you this, and unless you are an expert (and probably even if you are), deviating from these instructions means your security will range from suboptimal to nonexistent.

Security level

3,54 × 10¹⁹ works out to be just under 2⁶⁵, which means you're only getting 65 bits of security at best. A 12-word seed phrase has 128 bits of security, which is the same as the security level of the Bitcoin protocol itself. If your scheme doesn't achieve at least that, your security level is degraded, and 65 bits is low enough to be breakable in practice with enough computing power.

Brainwallets

65 bits of security assumes that the 8-character passphrase was generated randomly, i.e. something like by7rkf0a, 2xp5u7wf or 63tf3sv5. But that's not what most people would like to use as a passphrase. In a more realistic scenario they'd use e.g. a fairly common word (assume top 10,000 English words) and three random digits, reducing the security level to just 47 bits, which could be brute forced in a reasonable amount of time on a regular PC.

A wallet generated from a human input is called a brainwallet, and much has been said and written on why brainwallets are bad. If you want to learn more, this 2013 BitcoinTalk post by Greg Maxwell is an excellent starting point.

Checksum

Small detail: the last word of a 12-word seed phrase contains checksum information. It just so happens that "true kid" repeated six times is a valid seed phrase, but this only works with around 1 out of 16 pairs of words.

Answer 2

Very bad idea. Relying on a number that 'seems quite large to me' is insecure.

There were several recent cases of brute forcing vanity addresses, or mnemonics that were generated using a insecure pseudo random generator with a random 32 bit seed (resulting in 2^32 possible results).

If passphrase is human-generated, it has less entropy than you compute. If it is proper random, why not go with the regular BIP39 scheme?