<blockquote>
<p>Why roughly 128 bits, and not exactly?</p>
</blockquote>
<p>Reading BIP39, 12 words seems to imply exactly 128 bits of entropy.</p>
<blockquote>
<p>Why the additional entropy provided by using more than 12 words is not used?</p>
</blockquote>
<p>This is nonsense; it is used in exactly same way as the first 12 words. It's probably trying to say that more than 12 words does not meaningfully increase security, but in a very confused way.</p>

CC BY-SA 4.0
2021-10-12T19:40:44.410Z
Why doesn't it meaningfully increase security? Doesn't each bit we add double the difficulty of finding the original number?
Rony Tesler
CC BY-SA 4.0
2021-10-12T19:54:12.007Z
256-bit ECDSA only has 128 bits of security, so nothing can exceed that. It doesn't matter if an attacker can't find your seed, if they can just find a private key instead.
Pieter Wuille
CC BY-SA 4.0
2021-10-12T03:08:10.017Z
2021-10-12T10:29:37.973Z
2021-10-12T10:29:37.973Z
Pieter Wuille
<p>From <a href="https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch05.asciidoc#mnemonic_128_w_pass" rel="nofollow noreferrer">Mastering Bitcoin</a>:
&quot;From a security perspective, the amount of entropy actually used for the production of HD wallets is roughly 128 bits, which equals 12 words. Providing more than 12 words produces additional entropy which is unnecessary, and this <em>unused</em> entropy is not used for the derivation of the seed in the way that one might intially suspect.&quot;</p>
<ol>
<li>Why roughly 128 bits, and not exactly?</li>
<li>Why the additional entropy provided by using more than 12 words is not used?</li>
</ol>

<bip32-hd-wallets><mnemonic-seed><passphrase><mastering-bitcoin>
Using more than a 12 word mnemonic phrase
Rony Tesler
# Using more than a 12 word mnemonic phrase

(Asked by: username_0 on 2021-10-12)

From [Mastering Bitcoin](https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch05.asciidoc#mnemonic_128_w_pass):
"From a security perspective, the amount of entropy actually used for the production of HD wallets is roughly 128 bits, which equals 12 words. Providing more than 12 words produces additional entropy which is unnecessary, and this *unused* entropy is not used for the derivation of the seed in the way that one might intially suspect."

1. Why roughly 128 bits, and not exactly?
2. Why the additional entropy provided by using more than 12 words is not used?

**Tags:** bip32-hd-wallets, mnemonic-seed, passphrase, mastering-bitcoin


---

## 1 answers

### Answer by username_1 on 2021-10-12. Score: 3

> Why roughly 128 bits, and not exactly?

Reading BIP39, 12 words seems to imply exactly 128 bits of entropy.

> Why the additional entropy provided by using more than 12 words is not used?

This is nonsense; it is used in exactly same way as the first 12 words. It's probably trying to say that more than 12 words does not meaningfully increase security, but in a very confused way.

> **Comments:**
> **username_0**: Why doesn't it meaningfully increase security? Doesn't each bit we add double the difficulty of finding the original number?  
> **username_1**: 256-bit ECDSA only has 128 bits of security, so nothing can exceed that. It doesn't matter if an attacker can't find your seed, if they can just find a private key instead.  

---

