# BIP 39: If I mix my 24 seed phrase with another 24 words, will the checksum property allow an attacker to retrieve the original seed phrase?

Assume that I have a 24-word passphrase that I want to store securely but online by mixing it with another 24 words in a manner only I know. Does the checksum property somehow help an attacker to significantly speed up the process of guessing the right 24-word phrase in a reasonable time?

I would guess no because the attacker still needs to try an absurd number of combinations being somewhere in the vicinity of

$$\binom{48}{24} \cdot 24! \approx 2 \cdot 10^{37}.$$

Edit: For clarifaction, I add a minimal example which led me to the above question. Let us consider the following simple passphrase system:

1. Choose 3 distinct words from all words which can be set together by 3 letters (abc, god, ced, ....)
2. The fourth word must fulfil that it contains the first letters of the three first words (that is meant to be a very simplified checksum condition)

Let us say I have the passphrase (ago, bro, sis, abs) and mix it with another passphrase (gro, lab, for, glf) to

(ago, glf, for, sis, abs, gro, lab, bro)

Now it is way faster to scan this sequence and check for which quadruple rule 2. applies to obtain the two possible valid pass phrases than just trying all $$\binom{8}{4}\cdot 4! = 1680$$ combinations.

• Welcome to Cryptography.SE. What is exactly your question? What do you mean by mixing? Why do you want to store your password online? You need another password to recover that from a possibly encrypted version. May 12, 2021 at 13:25
• By mixing I mean: I take my ordered 24 words and some other 24 words and permutate them to obtain an ordered sequence of 48 words. Then I only store this 48 word sequence. If checksums wouldn't exist (i.e. the 24 word pass phrase would just be drawn uniformly at random from all such combinations), then there were 2*10^37 combinations making it practically impossible to brute force my initial pass phrase. My question is, if the fact that the last word in any valid pass phrase being restricted due to the checksum property makes it significantly easier to derive my pass phrase. May 12, 2021 at 14:38
• What is the manner of the mixing then? May 12, 2021 at 14:42
• Let's say I choose a permutation of {1,...,48} uniformly at random and permute the 48 words in exactly that way. May 12, 2021 at 14:52
• First of all, thank you very much for your effort! I think I have to formulate more clearly what I want to say :-): I want to find a way to memorize a 24 word passphrase with the least effort possible and without using any encryption. So my suggestion was to just store 48 words in which the passphrase is hidden in a way I can remember. For example, I could just permute the words such that all the even positions recover my passphrase. For an attacker who doesn't know my system this would look like a random permutation. Can this attacker derive from these 48 words my passphrase? May 12, 2021 at 15:29

The proposed method requires 24 additional random BIP-39 words. The additional words together with the real 24-word passphrase are permutated in a word manner. The result has $$2\cdot 10^{37}$$ combinations that have $$\approx 2^{124}$$ bits of security. 8-word passphrase are already had more security than this $$\approx 2^{139}$$[1]

If a random permutation is used to scramble the words there is another problem with the bit size of the permutation that one has to store. If we consider that each of the 48 words can be represented with 8 bits then one needs $$48\cdot 6 = 288$$ bits to store. This is already larger than the bits size of the AES-256 that we hard to memorize it so we use BIP-39 or DiceWire to keep our keys secure depending on the length of the key 128 or 256.

I want to find a way to memorize a 24 word passphrase with the least effort possible and without using any encryption. So my suggestion was to just store 48 words in which the passphrase is hidden in a way I can remember. For example, I could just permute the words such that all the even positions recover my passphrase. For an attacker who doesn't know my system this would look like a random permutation. Can this attacker derive from these 48 words my passphrase?

Your least effort possible way to memorize is not unique to you. Actually, this means that you are using less entropy for your permutation. The attackers, by knowing or with a clever thought, will first try this least effort permutations as done in the least effort passwords like 1234.

I will not consider your example even possible position or others, the above paragraph should be enough ( how do you recover the order of the even permutations).