BIP 39: If I mix my 24 seed phrase with another 24 words, will the checksum property allow an attacker to retrieve the original seed phrase?

Question

Assume that I have a 24-word passphrase that I want to store securely but online by mixing it with another 24 words in a manner only I know. Does the checksum property somehow help an attacker to significantly speed up the process of guessing the right 24-word phrase in a reasonable time?

I would guess no because the attacker still needs to try an absurd number of combinations being somewhere in the vicinity of

$$ \binom{48}{24} \cdot 24! \approx 2 \cdot 10^{37}. $$

Edit: For clarifaction, I add a minimal example which led me to the above question. Let us consider the following simple passphrase system:

1. Choose 3 distinct words from all words which can be set together by 3 letters (abc, god, ced, ....)
2. The fourth word must fulfil that it contains the first letters of the three first words (that is meant to be a very simplified checksum condition)

Let us say I have the passphrase (ago, bro, sis, abs) and mix it with another passphrase (gro, lab, for, glf) to

(ago, glf, for, sis, abs, gro, lab, bro)

Now it is way faster to scan this sequence and check for which quadruple rule 2. applies to obtain the two possible valid pass phrases than just trying all $$ \binom{8}{4}\cdot 4! = 1680 $$ combinations.

Answer 1

The proposed method requires 24 additional random BIP-39 words. The additional words together with the real 24-word passphrase are permutated in a word manner. The result has $2\cdot 10^{37}$ combinations that have $\approx 2^{124}$ bits of security. 8-word passphrase are already had more security than this $\approx 2^{139}$[1]

If a random permutation is used to scramble the words there is another problem with the bit size of the permutation that one has to store. If we consider that each of the 48 words can be represented with 8 bits then one needs $48\cdot 6 = 288$ bits to store. This is already larger than the bits size of the AES-256 that we hard to memorize it so we use BIP-39 or DiceWire to keep our keys secure depending on the length of the key 128 or 256.

I want to find a way to memorize a 24 word passphrase with the least effort possible and without using any encryption. So my suggestion was to just store 48 words in which the passphrase is hidden in a way I can remember. For example, I could just permute the words such that all the even positions recover my passphrase. For an attacker who doesn't know my system this would look like a random permutation. Can this attacker derive from these 48 words my passphrase?

Your least effort possible way to memorize is not unique to you. Actually, this means that you are using less entropy for your permutation. The attackers, by knowing or with a clever thought, will first try this least effort permutations as done in the least effort passwords like 1234.

I will not consider your example even possible position or others, the above paragraph should be enough ( how do you recover the order of the even permutations).

Your idea

1. Has less entropy than the 24-word passphrase 256 vs 124
2. An attacker can recover your weak permutations if you are the target and they know your system and you!
3. Humans are bad at random number generation [2] and you are shifting a secure system to your randomness that already shows the weakness.

If you already consider storing them consider using password managers so that you only need to store one really good BIP-39 or Dicewire and the rest of the passwords can be generated uniform randomly .