The security in bits of a 12-word mnemonic that has a valid checksum as per BIP39 is not 132 bits, but rather 128 bits, as the last 4 bits are determined based on the first 128 bits - the initial "entropy".
- Even though the range of 2^132 of all possible mnemonics is 16 times
larger than 2^128 (where
(2^128)*16 = 2^132)
, the checksum cannot
be predicted unless an attacker can break SHA256, as the checksum is
computed based on the hash digest of the leading 128 bits formatted
as a byte array.
So the idea with the checksum was to slow an attacker from searching through all possible 12-word mnemonics of which there are 2^132 of them, even though the number of valid ones is 2^128 in terms of a valid checksum (as if reducing the strength from 12 words to 11.6363636364 words, since the checksum completes part of the last word), as an attacker would have to run the SHA256 algorithm each time which will slow their brute-force search.
- Therefore, while 2048^12 = 2^132, the checksum means that the range
of checksum-valid mnemonics is 2048^11.6363636364 == 2^128.
In summary, I think a mnemonic with a valid checksum would be more safe than one without a checksum, on the basis that it's probably less likely for SHA256 to be cracked anytime soon which would otherwise speed a potential brute-force search of all mnemonics.
- This means an attacker still needs to search in the range of 2^132
in order to find one of the 2^128 valid ones (i.e. there is no way
to only search the range of valid ones, unless SHA256 is broken).
Note: If you wanted to square your security (i.e. raise it to the power of 2), a 24-word mnemonic which represents 264 bits (minus an 8-bit checksum) would be the square of two 12-word mnemonics in terms of bit security as 2^128*2^128 == 2^256.
Such a huge leap in security could help protect a user later from Grover's algorithm running on a fast-enough quantum computer which could perform such an n-time brute-force search in the "square of n-time", compared classical computers requiring n-time.
[Grover's algorithm][1] could brute-force a 128-bit symmetric cryptographic key in roughly 2^64 iterations or a 256-bit key in roughly 2^128 iterations.
[excerpt from: https://en.wikipedia.org/wiki/Grover%27s_algorithm]
In other words, a 12-word mnemonic would have its security reduced to 64 bits (considered unsafe) in terms of classical computer security, while a 24-word mnemonic would only reduce to 128 bits in the same scenario.