I didn't really understand in what way the plausible deniability is broken in BIP39 when using same mnemonics with different optional passwords.

So let's check/proove by example to see if I got this right, to see if the plausible deniability of BIP39 is really broken:

Via "http://bip32jp.github.io/english/" and "https://dcpos.github.io/bip39/" I created the following HD wallets:

HD Wallet 1 (let's assume this is what the "Ninjas" found out):

• Mnemonics: secret blame broken hundred bid express effort snow bike category wonder wrist
• Optional password: (i.e. no password at all!)

The first five addresses and key pairs are:

HD Wallet 2 (let's assume that the "Ninjas" found this out, too):

• Mnemonics: secret blame broken hundred bid express effort snow bike category wonder wrist (same as above)
• Optional password: simpletestpw

The first five addresses and key pairs are:


Now let's assume that there EXISTS a third HD-Wallet with the same mnemonics but yet another, more complicated, password (>>50 quasi-random alpha-numerical characters).
The Ninjas don't know this password and the victim is denying its existence, although the first 5 keys of that HD wallet have already been used in the blockchain, such that their pub keys are published.

The question: Can the "Ninja-attackers" find out that I lied when denying the existence of that wallet?

So I am asking gmaxwell or any other "advocatus attackeris":

Which of the following sequences of 5 public keys is the one that belongs to a HD wallet generated with:

• Mnemonics: secret blame broken hundred bid express effort snow bike category wonder wrist (same as above!)
• Optional password:

Out of the following 10 lists (A-J) below...

• Exactly one list is generated from a BIP39 HD wallet generated with the same mnemonics as above, plus a complicated password. The question is: Which one? (out of A-J)
• At least 3 lists are generated from other BIP39 HD Wallets with different mnemonics and with or without optional password.
• At least 3 lists are just random independently generated "standalone" keys.

Option A:

Option B:

Option C:

Option D:

Option E:

Option F:

Option G:

Option H:

Option I:

Option J:


Now I am very curious: Can you tell, which of the public key sequences A-J above is derived from the same mnemonics HD wallet as above (plus a different password)?

If yes, you have proven by example that the plausible deniability of "BIP39+password" is in fact attackable.

Otherwise, it yet needs to be proven - or I completely missed something.