# Attack vector difference when not allowing repetitions in BIP-39

We are using a 12-word scheme BIP-39 mnenemonic key generating scheme that creates an entropy of 128-bit that is then used to generate a seed that in turn derives a private key for the user. It chooses randomly 12 words out of 2048.

There are $$2048^{12} = 5.444518 \cdot 10^{39}$$ combinations that form the entropy for the seed.

This scheme allows duplicate words. Some users are irritated by that and write emails to support and I wonder how much entropy would get lost by only allowing unique words.

That would be $$\frac{2048!}{(2048-12)!} = 5.271538 \cdot 10^{39}$$ variations.

In conclusion the latter solution has only $$\frac{5.271538 \cdot 10^{39}}{5.444518 \cdot 10^{39}} \approx 96.8\%$$ the number of possible seeds than the non-unique one.

Is that mathematicallly correct and is that a neglectible hit on security given the increase in user friendliness?

The seed combinations can have more entropy than the 128-bit key you feed into it. Assuming the function you use to convert the 128-bit key into the 12-word seed is injective, then you won't even be able to reach all possible seeds with the keyspace you have, since $$2048^{12} \gg 2^{128}$$.
The entropy in 12 random words picked from a set of 2048 is $$\log_2(2048^{12}) = 132$$ bits. If you only allow unique words, it is $$\log_2(\frac{2048!}{(2048-12)!}) \approx 131.95$$ bits. These are greater than 128.