3

Is a 24 words seed more secure than 12 words in terms of brute forcing the private key?

From the following answer I read that a private key is always "just" 128bit even when derived from 24 words. So it doesn't matter is that correct?

Using more than a 12 word mnemonic phrase

here it says "ECDSA secp256k1 only have 128 bit strength" but the question linked is about if passphrase improves security.

12 or 24 words for menomonic?

Or is it recommended to use 24 words over 12 words in regards to brute forcing?

0

3 Answers 3

1

Regardless of whether you have a passphrase or not 12 words is just as secure as 24 words because the resulting public key will still require 2^128 iterations to compute its private key using the most efficient algorithm. That is relevant because the most efficient algorithm to crack secp256k1 keys "Pollard's rho algorithm" does not try to guess your password or seed words but instead tries to reverse a public key to its private key.

It should probably be noted that properly generated Bitcoin keys cant be cracked efficiently with modern hardware even with Pollards rho, improperly generated or purposefully weaker keys may be cracked

So no it is not recommended to use 24 words it is completely optional, it may theoretically help against attacks in which someone guesses / brute-forces your seed phrase (assuming your seed phrase was generated in a securely random fashion) but brute-force is still highly inefficient compared to Pollard's rho algorithm. This is more or less covered here:

12 or 24 words for mnemonic?.

In fact, cryptographically speaking, there is no benefit to private keys having more than 128 bits of entropy, as long as there is no pattern in them (e.g. don't use just 128 bit numbers as private keys, that's broken, but using the hash of 128 bit numbers appears to be just fine). The reason for suggesting more is just defense in depth. – Pieter Wuille Feb 25 at 6:00

24 words = 256 bits, 12 words = 128 bits. But finding a private key given the public key already costs only 2^128 operations (using e.g. Pollard's rho algorithm, not using brute force of course). So if an attacker can just attack the private key keys that come out directly, there is no reason to try to find the seed. – Pieter Wuille Feb 25 at 19:28

9
  • 1
    @drivenuts yes thanks, sorry I typed it pretty fast
    – Poseidon
    Commented Jun 7, 2023 at 4:59
  • 2
    @Poseidon Entropy is the wrong term. 24-word based private/public keys do have 256 bits of entropy, but it still only takes on the order of 2^128 iterations to compute the private key from a public key. Commented Jun 7, 2023 at 11:23
  • 2
    @drivenuts It is indeed often the case that the master public key is not revealed, so it is true that a hypothetical 2^128 attacker can break individual keys (because those get their pubkey revealed), without being able to break the master key. I'm not sure how much that distinction matters, but it is correct. Commented Jun 7, 2023 at 11:25
  • 1
    @PieterWuille Thank you I edited the post to include your correction.
    – Poseidon
    Commented Jun 7, 2023 at 17:30
  • 1
    @drivenuts If you never spend from your master public key (which is normal as far as I know) then yes, the input entropy is what is important for the master public key. However there are still child keys which are commonly spent from in which case Pollards rho becomes relevant to those keys. If it is an HD wallet an attack on a child key would not reveal its parent key but if it was not HD then it would be trivial to reveal from an attacked child key. Brute forcing 12 or 24 word seed phrases when picked in a securely random fashion is incredibly unlikely / inefficient.
    – Poseidon
    Commented Jun 7, 2023 at 17:44
1

Both a 12 and 24 word seed should be secure.

2048^12 = 5.44x10^39 and 2048^24 = 2.96x10^79 are both insanely high numbers of possibilities that will protect you from brute force attempts. Note given the checksum these numbers are smaller, but very high none the less.

The amount of starting entropy is going to be larger with a 24 word seed, but yes they will result in the same sized keys.

Given a sufficiently random process or wallet software, both a 12 or 24 word seed will be safe.

2
  • yes both are safe, but I explicitly want to know if 24 is safer. You say: "they will result in the same sized keys" does that mean they are equally safe in terms of brute-forcing the private key? github.com/bitcoin/bips/blob/master/… says: "the produced keys are only 256 bits long, and offer about half of that in terms of security." Does it matter if the "starting entropy" is higher if it is reduced later to 128bit anyway?
    – drivenuts
    Commented Jun 7, 2023 at 4:28
  • and in my first link Pieter Wullie writes: "a private key is always just 128bit even when derived from 24 words." so is it the same security regardless of starting entropy?
    – drivenuts
    Commented Jun 7, 2023 at 4:39
-3

In terms of brute-forcing the private key, both a 12-word seed phrase and a 24-word seed phrase offer the same level of security if they are generated using a strong random number generator.

The reason for this is that the private key derived from the seed phrase is essentially a 256-bit number in the case of the Bitcoin protocol (specifically, the secp256k1 elliptic curve used in Bitcoin). The seed phrase is used to deterministically generate the private key, but the private key itself has a fixed length of 256 bits.

When using a 12-word seed phrase, the seed phrase is used to generate the private key through a series of cryptographic operations. Similarly, when using a 24-word seed phrase, the same process is followed to generate the private key.

The extra words in a 24-word seed phrase are used to provide additional entropy and increase the number of possible seed phrases. This helps in protecting against the possibility of collisions (two different seed phrases generating the same private key), but it does not directly impact the security of the private key itself.

In summary, the security of the private key is determined by the length and randomness of the underlying bits used to generate it, rather than the number of words in the seed phrase. Both a 12-word seed phrase and a 24-word seed phrase can provide strong security if generated properly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.