Risks involved choosing my own seed mnemonic?

The BIP39 word list consists of 2048 words.

For a regular, 24 word mnemonic, you have: 2048^23 ways to arrange the non checksummed words. At 1 trillion combinations per second, this would take you ≈ 3.3×10^46 times the age of the universe to compute, even before you bother checking the checksum options.

Now, let's say that out of these 2048 words, 500 are food items (this is an illustrative example, I haven't actually counted them). Now, your combinations are some combination of 22 items (possibly repeating) from those 500, plus a random word from the 2048.

This evaluates as 500^22 * 2048 * 21. At 1 trillion combinations per second, this would take you ≈ 2.4×10^46 times the age of the universe to compute. While this is still an extremely large number, it is still nearly 30% less than the initial case, which is a non-trivial loss of entropy.

Moreover, if an attacker is able to discover even a few words from your mnemonic (maybe a friend peaked at it while visiting, or you entered a fragment into a scammy wallet before catching on, or any number of other scenarios), your possible combinations go down extremely fast. Even a perceived small loss of entropy can mean the difference between being brute forceable after 6 known words and being brute forceable after 19 known words.

In 2019, with access to reliable entropy generation in nearly every device, it is simply not worth it to attempt to come up with convoluted schemes.

Raghav Sood

Posted 2019-10-29T12:09:38.153

Reputation: 10 897

I get the reduction in entropy, but in the 'food items' example, obviously an already extreme example, but even in that case, the attacker would have to have the knowledge that I've chosen food items, which they presumably do not, but working on the presumption that that knowledge will never become available, what are the risks? Great answer but still kinda not the answer i was looking for. – Ninjanoel – 2019-10-29T13:40:14.670

2@Ninjanoel The answer is that you simply cannot reason about how secure or insecure it is. You should assume an attacker has knowledge of the process you used to come up with the phrase; not because they certainly will, but because you need to protect against the worst case. You cannot eatimate how random something is you came up with yourself Nobody can; humans are just terrible at this. – Pieter Wuille – 2019-10-29T16:28:01.810

Ahhhh, I know what you saying but huge parts of me still wanna argue!! lol. Like, if I told you my process was the same as rolling a die three times and choosing the word that best "continues the story", so I'm left with a random but human readable "cards against humanity" style story that's easy to remember. Ignoring the risk of someone else seeing my phrase, have I got something that is easier to brute force than computer randomness? Again, I agree with most of your answer – Ninjanoel – 2019-10-29T19:57:53.440

You have something that is absolutely massively easier to guess than brute force. Whether it is so much easier as to make attacking easy I cannot tell you. – Pieter Wuille – 2019-10-31T00:10:43.557

Risks involved choosing my own seed mnemonic?

Answers