My thread about the security of 12 vs 24 word mnemonic phrases surfaced some good discussion and some confusion. To clarify it further it’s important to understand the answers to:
What is a seed?
How’s it different from a private key?
Let me further break it down for you 👇
What is a seed?
How’s it different from a private key?
Let me further break it down for you 👇
A seed is a set of random data that is used as the starting point for wallets to generate an endless supply of public and private keys for you.
If someone has your seed they can use it to generate the private keys for ALL of the addresses you use and ever will use.
If someone has your seed they can use it to generate the private keys for ALL of the addresses you use and ever will use.
The mnemonic phrase is used as an easy way to remember and/or write down your seed.
So if someone gets your mnemonic phrase they can use it to get your seed and eventually all of your private keys.
So if someone gets your mnemonic phrase they can use it to get your seed and eventually all of your private keys.
It will take an attacker who is brute forcing your mnemonic exponentially longer to brute force a 24 word seed over a 12 word seed.
A 24 word mnemonic is more secure than a 12 word mnemonic if the attack you are worried about is someone brute forcing your seed.
A 24 word mnemonic is more secure than a 12 word mnemonic if the attack you are worried about is someone brute forcing your seed.
The seed is used by your wallet to generate ALL of your private and public keys.
The way the cryptography behind these keys work is that it’s practically impossible to get the private key for any one public key.
It takes roughly 2^128 operations. This is unfathomably large.
The way the cryptography behind these keys work is that it’s practically impossible to get the private key for any one public key.
It takes roughly 2^128 operations. This is unfathomably large.
So when someone says that you don’t really gain any “security” when using more than a 12 word mnemonic the idea is that no matter how many words you use for your seed it always takes 2^128 operations to get a private key from a public key.
Okay so as long as you don’t expose your public keys then your 24 word mnemonic is more secure, right?
Yes that would be true.
However, you generally expose your public key anytime you spend Bitcoin. This is why avoiding address reuse is so important.
Yes that would be true.
However, you generally expose your public key anytime you spend Bitcoin. This is why avoiding address reuse is so important.
However, millions of coins are already in addresses where the owner reused them and the public keys are exposed.
Also, you expose a public key when using taproot addresses.
If you have no use for taproot and never reuse addresses then your 24 word mnemonic adds security.
Also, you expose a public key when using taproot addresses.
If you have no use for taproot and never reuse addresses then your 24 word mnemonic adds security.
It’s important to understand that to perform 2^128 operations is for all intents and purposes impossible.
A 12 word mnemonic is more than enough to prevent the ability for someone to brute force it.
I’ll go into the specifics in a future thread.
A 12 word mnemonic is more than enough to prevent the ability for someone to brute force it.
I’ll go into the specifics in a future thread.
I hope this helped you understand the difference between a seed and a private key and how the security of brute forcing a seed is different from finding the private key for a public key.
Proper usage of Bitcoin is important in maintaining security and privacy. Educate yourself!
Proper usage of Bitcoin is important in maintaining security and privacy. Educate yourself!
• • •
Missing some Tweet in this thread? You can try to
force a refresh
