We are using a 12-word scheme BIP-39 mnenemonic key generating scheme that creates an entropy of 128-bit that is then used to generate a seed that in turn derives a private key for the user. It chooses randomly 12 words out of 2048.

There are $2048^{12} = 5.444518 \cdot 10^{39}$ combinations that form the entropy for the seed.

This scheme allows duplicate words. Some users are irritated by that and write emails to support and I wonder how much entropy would get lost by only allowing unique words.

That would be $\frac{2048!}{(2048-12)!} = 5.271538 \cdot 10^{39}$ variations.

In conclusion the latter solution has only $\frac{5.271538 \cdot 10^{39}}{5.444518 \cdot 10^{39}} \approx 96.8\% $ the number of possible seeds than the non-unique one.

Is that mathematicallly correct and is that a neglectible hit on security given the increase in user friendliness?


There is no impact on security.

The seed combinations can have more entropy than the 128-bit key you feed into it. Assuming the function you use to convert the 128-bit key into the 12-word seed is injective, then you won't even be able to reach all possible seeds with the keyspace you have, since $2048^{12} \gg 2^{128}$.

The entropy in 12 random words picked from a set of 2048 is $\log_2(2048^{12}) = 132$ bits. If you only allow unique words, it is $\log_2(\frac{2048!}{(2048-12)!}) \approx 131.95$ bits. These are greater than 128.

  • $\begingroup$ Technically its 132 Bits, as there is a 4 bit checksum. $\endgroup$
    – shredding
    Nov 8 '18 at 7:09
  • 1
    $\begingroup$ @shredding It may be 132 bits in length, but the entropy is still 128 bits. $\endgroup$
    – forest
    Nov 8 '18 at 7:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.