4

I do not have reference, but I have heard that there is no use in using more than 12 word for mnemonic, because ECDSA secp256k1 only has 128 bit strength.

Is this correct?
If it is, then does additional passphrase add anything?
Also considering that Taproot added Schnorr signatures, what is its bit security and how to understand it in all of it?

Improve this question

1 Answer 1

Reset to default
1

Because you don't need to actually crack the seed phrase but rather find a private key from public key, it holds that 12 words generated just as randomly is as secure as 24 words. They will both produce a 128bit secret key which means they are just as secure as each-other regardless of the permutations of the seed words. Credit to Pieter for the fix.

Improve this answer
6
  • 2
    In fact, cryptographically speaking, there is no benefit to private keys having more than 128 bits of entropy, as long as there is no pattern in them (e.g. don't use just 128 bit numbers as private keys, that's broken, but using the hash of 128 bit numbers appears to be just fine). The reason for suggesting more is just defense in depth.
    – Pieter Wuille
    Commented Feb 25, 2023 at 6:00
  • This makes sense, my main point was that guessing 24 permutations of words should be more difficult than 12 but I guess it is not an effective increase in difficulty? How many more bits do 24 word phrases have compared to 12 word?
    – Poseidon
    Commented Feb 25, 2023 at 18:25
  • 2
    24 words = 256 bits, 12 words = 128 bits. But finding a private key given the public key already costs only 2^128 operations (using e.g. Pollard's rho algorithm, not using brute force of course). So if an attacker can just attack the private key keys that come out directly, there is no reason to try to find the seed.
    – Pieter Wuille
    Commented Feb 25, 2023 at 19:28
  • 1
    @PieterWuille So if I understand it correctly, everything above 128 bit is useless ?Does this include also additional passphrase ? My understand is that it does ? Let say that it is possible to finding a private key given the public key (Pollard's rho algorithm) how is this related to HD wallets ? My understanding is that still you would not get master seed but just for this address. Is it correct ? I am using terminology from github.com/bitcoin/bips/blob/master/bip-0032/derivation.png Just trying to wrap my head around it.
    – WebOrCode
    Commented Feb 26, 2023 at 9:45
  • 1
    I think that the password would not add extra entropy in the case of Pollard's rho algorithm, HD wallets prevent a trivial attack that can reveal a parent private key given one of its child public private key pairs. So if an attacker theoretically attacked one HD key it would not allow them to reveal its parent which would mean probably revealing all child keys as well. But in general I don't think its feasible to attack 128 bit keys with pollard's rho in the current state of computing limitations. I believe there is some people attempting to do this at large power costs on btc talk forum.
    – Poseidon
    Commented Apr 28, 2023 at 1:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.