Let's say I've got some securely-generated random data I want to encode as words, 32 bits of it. My wordlist is 2048 words, so each word encodes 11 bits of information. I write a routine to pack these 32 bits into the lower 11 bits of 3 16-bit types and zero the upper 5 bits of each. For the last one, I pack in the remaining 10 bits of random data and zero the top 6 instead. I then look each of these up in my wordlist array to get my words. I'd like to use these words.

Here's my question: does what I'm doing reduce the amount of secure randomness I'm encoding in these words? I'd be looking the final word up in a list that's effectively half the size, because the 11th bit is always zero, so is there some "loss of randomness" here? I know this is a little confusing, but I'd appreciate some guidance. I suspect there might be some existing guidance on this, but I'm not sure what to search for to find it and none of my googling has yielded results.

Edit: To clarify, my intuitive guess is that this won't pose a problem, but I'm not comfortable going with that. The closest I've come to rationalizing this is that $2^{11} \times 2^{11} \times 2^{10} = 2^{32}$.


One way to think about this is that you are defining an encoding, and that this is just a change in representation. You are representing a 32-bit value as 3 words, and importantly this is a reversible process. Since it's a bijective mapping, there's as much entropy in the output as there is in the input.

Really, what you're doing is not fundamentally different from representing the 32-bit value in 9 base 10 digits. It's true that there is notable bias in the leading digit, but the important thing is that the full range is covered and it's invertible.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.