Post
Topic
Board Electrum
Re: How much entropy is lost by searching for a '01' prefix SHA512 output
by
ThomasV
on 04/02/2017, 15:11:33 UTC
Again, you are wrong.

Just imagine for a second that the prefix passed to is_new_seed() is no longer 8 bits long, but 132 bits long.
Imagine, for the sake of the argument, that I have a seed that passes this test; its hashes starts with the 132 bits prefix required by is_new_seed().
That seed, by the way, was generated by 12 words randomly chosen from a 2048 dictionary.

So, is the entropy of the seed now zero?
If I follow your argument, it should be, because is_new_seed() has subtracted 132 bits of entropy.

From my point of view, the entropy is indeed zero, because I know the seed. Just like the entropy of anything I know with 100% certainty.

From your point of view, however, nothing has changed: you still need to enumerate a set of 2^132 candidate seeds in order to find the seed.

I hope this enlightens you.

For the record, I have written a paragraph on the only real issue here, which is how key stretching is affected.
http://docs.electrum.org/en/latest/seedphrase.html#security-implications