Validation for a seed collision

Question

Came across this post while researching, and it claims:

This mnemonic: weary weapon unseen like like like like like like like like like and this one: sister glide dude near muse sent like like like like like like both produce the same binary seed (which is this in hex: 0x1003ca7a7000000000000000000000000) and they both produce the same address list (starting with 17A2fgCpcKEbg7CbfiJwAb8sjdEzUWD2y2)

4/1000 number comes from this: (# of mnemonic permutations / # of binary seeds) - 1 == (1626^12 / 2^128) - 1 == about 4/1000. So about 4 in 1000 mnemonics correspond to two binary seeds / two address lists.

Can someone explain/verify the reality of this? Is this true? Applicable to only 12-words mnemonic or to all? Or not valid at all?

When I went ahead and tried to use the 12-word mnemonic provided, I found out that "weary" is not even a word in BIP39 English wordlist, but words are not chosen on the basis of security but rather to reduce human error in reading and transcribing the words. Does the claim hold up? And after reading tons of information on the subject, this is the first and only source that I have seen mentioned mnemonic -> seed collision.

Answer 1

The post (which, note, is dated December 2014) is not referring to BIP39 or any variant, but instead to a particular obsolete and non-standard mnemonic algorithm used by the Electrum client prior to August 2014. (The author mentions Electrum further down in the post.) Here is the code; their wordlist does indeed include weary.

You can see their decode algorithm. Each group of 3 words decodes to a hex string which is normally 8 digits but may in some cases be 9 (the computation of x may produce a value as large as (n-1) * n*(n-1) * n*n*(n-1), where n = 1626, and this number exceeds 2^32). These hex strings are then concatenated to form the seed to be used. Modifying the code to insert spaces between the strings makes it clear what is happening:

$ python mnemonic.py weary weapon unseen like like like like like like like like like
1003ca7a7 00000000 00000000 00000000 
$ python mnemonic.py sister glide dude near muse sent like like like like like like
1003ca7a 70000000 00000000 00000000 

So the first phrase yields a seed which is the same as for the second but with an extra zero on the end. I presume that elsewhere in the code, the seed is truncated to 32 hex digits before being used, possibly here though I have not traced where that is called. If so then the values actually used will be the same.

To be clear, this is not a collision in any cryptographic hash function, and has no particular security implications except that it makes the entropy of the seed phrase very slightly less than it might otherwise appear. It is also not relevant to any seed algorithm in any other software or in any recent version of Electrum.

Answer 2

Let's start from looking at electrum's wordlist (same as BIP39 english). From your example words:

weary
unseen
dude
muse
sent

don't exist in this wordlist. There are dune, museum, wear and sentence. Unseen isn't close to any of the words. If the author of the post provide mnemonic in the form of number it may be possible to calculate, from seed there is no way of getting the mnemonic (it's a HMAC function) and confirming his claim.