Post
Topic
Board Wallet software
Re: 24 word seed question : is splitting it in half dangerous?
by
elliptic joe
on 08/04/2024, 14:25:34 UTC
In both instances, you still need to bruteforce 12 words to get the actual seed phrase... So, you're working with a 2028^12 search space... which is 5444517870735015415413993718908291383296.
I don't think we can call it the same. If the total words are 12 and you are missing all 12 then the search space is 2128. But if the total words are 24 and you have 12 then you still have half of the entropy and depending on which half it could be a lot simpler. For example if you have the second half of the words then the bulk of the search space is suddenly reduced by roughly 94% because of the checksum.

I think this is incorrect.

When someone knows the last 12 words of the 24th sentence, they know 132 bits. But since 8 bits are for the checksum, they gain only 124 bits of information. So, there are still 256 - 124 = 132 bits left to attack. Now, the brute attacker knows the checksum, so we need to understand how many combinations among the 2^132 generate the same checksum: those that don't can be immediately discarded. The combinations that yield the same CS are about 2^124 (2^132 / 2^8).
For an unknown 12-word phrase, the search space is 2^128. So, the former is slightly less secure, but negligibly so.