Attack vector difference when not allowing repetitions in BIP-39

Question

We are using a 12-word scheme BIP-39 mnenemonic key generating scheme that creates an entropy of 128-bit that is then used to generate a seed that in turn derives a private key for the user. It chooses randomly 12 words out of 2048.

There are $2048^{12} = 5.444518 \cdot 10^{39}$ combinations that form the entropy for the seed.

This scheme allows duplicate words. Some users are irritated by that and write emails to support and I wonder how much entropy would get lost by only allowing unique words.

That would be $\frac{2048!}{(2048-12)!} = 5.271538 \cdot 10^{39}$ variations.

In conclusion the latter solution has only $\frac{5.271538 \cdot 10^{39}}{5.444518 \cdot 10^{39}} \approx 96.8\% $ the number of possible seeds than the non-unique one.

Is that mathematicallly correct and is that a neglectible hit on security given the increase in user friendliness?

Answer 1

There is no impact on security.

The seed combinations can have more entropy than the 128-bit key you feed into it. Assuming the function you use to convert the 128-bit key into the 12-word seed is injective, then you won't even be able to reach all possible seeds with the keyspace you have, since $2048^{12} \gg 2^{128}$.

The entropy in 12 random words picked from a set of 2048 is $\log_2(2048^{12}) = 132$ bits. If you only allow unique words, it is $\log_2(\frac{2048!}{(2048-12)!}) \approx 131.95$ bits. These are greater than 128.