In the BIP39 specification, you add 1 bit of checksum for every 32 bits of entropy you generate.

Therefore, with a common entropy size of 128 bits, you are only adding 4 bits of checksum. This means that if you were to write down the words in the mnemonic sentence in the wrong order (or write down an incorrect word from the wordlist), there is a 1 in 16 (0b1111) chance that a tool for validating your mnemonic will tell you that you have written down a valid mnemonic.

Is this too short to make checksums for mnemonic sentences reliable?

Alternatively, you could instead add 4 bits of checksum for every 32 bits, which would mean a mnemonic from 128 bits of entropy will have a 1 in 65535 (1 in 0b1111111111111111) chance of being valid if written down incorrectly. This would require a wordlist of 4096 words (12 bits per word) to accommodate the checksum and keep the mnemonic sentence the same length, but it seems that it would be much more reliable.

Is there a reason why BIP39 chose to use such small checksums?


Checksum in BIP-39 is mainly used for padding which may be the reason why smaller size checksums are used.
Each BIP-39 word represents 11-bits and in order to divide the entropy of an arbitrary size (which is normally a multiple of 8-bit such as 128, 160, 256,...) to 11-bit chunks it has to be padded first. For example in case of a 128-bit entropy 4-bits padding is needed (128+4=132%11=0) and that pad is the checksum.
BIP-39 authors may not have thought about recovery cases but if a bigger checksum were to be chosen it has to pad the total length to a multiple of 11. In case of 128 bits it needs to be 15-bits (128+15=143%11=0) or 26-bits, 37-bits,...

  • Why pad to 11 bits? Why use a wordlist of 2048 words specifically (i.e. why not 4096 words)?
    – inersha
    Mar 13 '20 at 13:40
  • 11-bits is because of the total number of words (2048=2^11). 2048 is chosen to have the resulting security of nearly as equal as a private key. Minimum is 12 words, that is 2048^12 = 2^132 combinations, considering 4 bits is checksum that would give it 128-bits of security which is equal to a 256-bit bitcoin private key's security (half the length). Mar 13 '20 at 13:55
  • So 2048 words was the optimal number, and the size of the checksum was determined so that the entropy+checksum would be divisible by 11? I'm curious why 2048 would be preferable over say, 4096 words (padding to 12 bits per word would achieve this).
    – inersha
    Mar 13 '20 at 14:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.