<p>Because you don't need to actually crack the seed phrase but rather find a private key from public key, it holds that 12 words generated just as randomly is as secure as 24 words. They will both produce a 128bit secret key which means they are just as secure as each-other regardless of the permutations of the seed words.
Credit to Pieter for the fix.</p>

CC BY-SA 4.0
2023-02-25T06:00:52.130Z
In fact, cryptographically speaking, there is no benefit to private keys having more than 128 bits of entropy, as long as there is no pattern in them (e.g. don't use just 128 bit numbers as private keys, that's broken, but using the *hash* of 128 bit numbers appears to be just fine). The reason for suggesting more is just defense in depth.
Pieter Wuille
CC BY-SA 4.0
2023-02-25T18:25:57.703Z
This makes sense, my main point was that guessing 24 permutations of words should be more difficult than 12 but I guess it is not an effective increase in difficulty? How many more bits do 24 word phrases have compared to 12 word?
Poseidon
CC BY-SA 4.0
2023-02-25T19:28:08.363Z
24 words = 256 bits, 12 words = 128 bits. But finding a private key given the public key already costs only 2^128 operations (using e.g. Pollard's rho algorithm, not using brute force of course). So if an attacker can just attack the private key keys that come out directly, there is no reason to try to find the seed.
Pieter Wuille
CC BY-SA 4.0
2023-02-25T19:30:54.693Z
Very interesting, so theoretically the only way to make it tougher to crack would be to increase the private-key size which ends up increasing the size of the overall elliptic curve scheme?
Poseidon
CC BY-SA 4.0
2023-02-26T09:45:41.473Z
@PieterWuille 
So if I understand it correctly, everything above 128 bit is useless ?Does this include also additional passphrase ? My understand is that it does ?
Let say that it is possible to finding a private key given the public key (Pollard's rho algorithm) how is this related to HD wallets ? My understanding is that still you would not get master seed but just for this address. Is it correct ? I am using terminology from https://github.com/bitcoin/bips/blob/master/bip-0032/derivation.png
Just trying to wrap my head around it.
WebOrCode
CC BY-SA 4.0
2023-04-28T01:34:21.950Z
I think that the password would not add extra entropy in the case of Pollard's rho algorithm, HD wallets prevent a trivial attack that can reveal a parent private key given one of its child public private key pairs. So if an attacker theoretically attacked one HD key it would not allow them to reveal its parent which would mean probably revealing all child keys as well. But in general I don't think its feasible to attack 128 bit keys with pollard's rho in the current state of computing limitations. I believe there is some people attempting to do this at large power costs on btc talk forum.
Poseidon
CC BY-SA 4.0
2023-02-25T03:58:39.627Z
2023-07-10T22:27:50.963Z
2023-07-10T22:27:50.963Z
Poseidon
<p>I do not have reference, but I have heard that there is no use in using more than 12 word for mnemonic, because ECDSA secp256k1 only has <a href="https://cryptobook.nakov.com/asymmetric-key-ciphers/elliptic-curve-cryptography-ecc" rel="nofollow noreferrer">128 bit strength</a>.</p>
<p>Is this correct?<br />
If it is, then does additional passphrase add anything?<br />
Also considering that Taproot added <a href="https://en.wikipedia.org/wiki/Schnorr_signature" rel="nofollow noreferrer">Schnorr signatures</a>, what is its bit security and how to understand it in all of it?</p>

<security><mnemonic-seed>
12 or 24 words for mnemonic?
WebOrCode
# 12 or 24 words for mnemonic?

(Asked by: username_0 on 2023-02-24)

I do not have reference, but I have heard that there is no use in using more than 12 word for mnemonic, because ECDSA secp256k1 only has [128 bit strength](https://cryptobook.nakov.com/asymmetric-key-ciphers/elliptic-curve-cryptography-ecc).

Is this correct?  
If it is, then does additional passphrase add anything?  
Also considering that Taproot added [Schnorr signatures](https://en.wikipedia.org/wiki/Schnorr_signature), what is its bit security and how to understand it in all of it?

**Tags:** security, mnemonic-seed


---

## 1 answers

### Answer by username_1 on 2023-02-25. Score: 1

Because you don't need to actually crack the seed phrase but rather find a private key from public key, it holds that 12 words generated just as randomly is as secure as 24 words. They will both produce a 128bit secret key which means they are just as secure as each-other regardless of the permutations of the seed words.
Credit to username_2 for the fix.

> **Comments:**
> **username_2**: In fact, cryptographically speaking, there is no benefit to private keys having more than 128 bits of entropy, as long as there is no pattern in them (e.g. don't use just 128 bit numbers as private keys, that's broken, but using the *hash* of 128 bit numbers appears to be just fine). The reason for suggesting more is just defense in depth.  
> **username_1**: This makes sense, my main point was that guessing 24 permutations of words should be more difficult than 12 but I guess it is not an effective increase in difficulty? How many more bits do 24 word phrases have compared to 12 word?  
> **username_2**: 24 words = 256 bits, 12 words = 128 bits. But finding a private key given the public key already costs only 2^128 operations (using e.g. Pollard's rho algorithm, not using brute force of course). So if an attacker can just attack the private key keys that come out directly, there is no reason to try to find the seed.  
> **username_1**: Very interesting, so theoretically the only way to make it tougher to crack would be to increase the private-key size which ends up increasing the size of the overall elliptic curve scheme?  
> **username_0**: @username_2  So if I understand it correctly, everything above 128 bit is useless ?Does this include also additional passphrase ? My understand is that it does ? Let say that it is possible to finding a private key given the public key (Pollard's rho algorithm) how is this related to HD wallets ? My understanding is that still you would not get master seed but just for this address. Is it correct ? I am using terminology from https://github.com/bitcoin/bips/blob/master/bip-0032/derivation.png Just trying to wrap my head around it.  
> **username_1**: I think that the password would not add extra entropy in the case of Pollard's rho algorithm, HD wallets prevent a trivial attack that can reveal a parent private key given one of its child public private key pairs. So if an attacker theoretically attacked one HD key it would not allow them to reveal its parent which would mean probably revealing all child keys as well. But in general I don't think its feasible to attack 128 bit keys with pollard's rho in the current state of computing limitations. I believe there is some people attempting to do this at large power costs on btc talk forum.  

---

