Is the Ledger Implementation of BIP39 Generation Not Following the Spec?

Question

According to the BIP39 spec, invalid checksums should be displayed by software.

However, Ledger's BIP39 generation tool (which looks like a copy of Ian's tool), will not show an error for invalid checksums.

Example phrases to test with:

Correctly Generated Recovery Phrase: square cactus nurse pond share rescue prepare bottom suffer speed will tomorrow

another "valid phrase" (different but invalid checksum): square cactus nurse pond share rescue prepare bottom suffer speed will account

another "valid phrase" (different but invalid checksum): square cactus nurse pond share rescue prepare bottom suffer speed will acoustic

For a 12 word phrase, if you split the 2048 wordlist into 16 word blocks, every 1 word out of the 16-word block will not produce an invalid mnemonic (or checksum) error.

My two questions:

1. Is this going against the BIP39 spec?
2. Why does this code allow for 1 out of every 16 words of a block to be deemed as "valid"?

Answer 1

Those are valid mnemonics with valid checksums. In the bip39 spec is the following:

The following table describes the relation between the initial entropy length (ENT), the checksum length (CS) and the length of the generated mnemonic sentence (MS) in words.

CS = ENT / 32

MS = (ENT + CS) / 11

| ENT | CS | ENT+CS | MS | +-------+----+--------+------+ | 128 | 4 | 132 | 12 | | 160 | 5 | 165 | 15 | | 192 | 6 | 198 | 18 | | 224 | 7 | 231 | 21 | | 256 | 8 | 264 | 24 |

As per the top row, 12 word mnemonics have 128 bits of entropy and 4 bits of checksum. That means any random 12 word mnemonic has a 1 in 16 chance to have a valid checksum.

The "blocking" of the valid final words instead of a totally random distribution is because the checksum bits are appended to the end of the entropy bits. So for every first 128 bits, there is exactly one valid final four bits. Bits are mapped to words by just counting down the alphabetically-sorted word list for each 11-bit chunk. So the first 128 bits determine the first eleven words and which "block" of the wordlist you are considering, and then within that block only one word corresponds to the correct checksum.