<p>The post (which, note, is dated December 2014) is not referring to BIP39 or any variant, but instead to a particular obsolete and non-standard mnemonic algorithm used by the Electrum client prior to August 2014.  (The author mentions Electrum further down in the post.)  <a href="https://github.com/spesmilo/electrum/blob/1.9.8/lib/mnemonic.py" rel="nofollow noreferrer">Here is the code</a>; their wordlist does indeed include <a href="https://github.com/spesmilo/electrum/blob/f92b483942d3f8ee51506e0436d9b524db33a336/lib/mnemonic.py#L1649" rel="nofollow noreferrer"><code>weary</code></a>.</p>
<p>You can see their <a href="https://github.com/spesmilo/electrum/blob/f92b483942d3f8ee51506e0436d9b524db33a336/lib/mnemonic.py#L1670" rel="nofollow noreferrer">decode algorithm</a>.  Each group of 3 words decodes to a hex string which is normally 8 digits but may in some cases be 9 (the computation of <code>x</code> may produce a value as large as <code>(n-1) * n*(n-1) * n*n*(n-1)</code>, where <code>n = 1626</code>, and this number exceeds <code>2^32</code>).  These hex strings are then concatenated to form the seed to be used.  Modifying the code to insert spaces between the strings makes it clear what is happening:</p>
<pre><code>$ python mnemonic.py weary weapon unseen like like like like like like like like like
1003ca7a7 00000000 00000000 00000000 
$ python mnemonic.py sister glide dude near muse sent like like like like like like
1003ca7a 70000000 00000000 00000000 
</code></pre>
<p>So the first phrase yields a seed which is the same as for the second but with an extra zero on the end.  I presume that elsewhere in the code, the seed is truncated to 32 hex digits before being used, possibly <a href="https://github.com/spesmilo/electrum/blob/f92b483942d3f8ee51506e0436d9b524db33a336/lib/bitcoin.py#L570" rel="nofollow noreferrer">here</a> though I have not traced where that is called.  If so then the values actually used will be the same.</p>
<p>To be clear, this is not a collision in any cryptographic hash function, and has no particular security implications except that it makes the entropy of the seed phrase very slightly less than it might otherwise appear.  It is also not relevant to any seed algorithm in any other software or in any recent version of Electrum.</p>

CC BY-SA 4.0
2020-09-25T01:50:16.087Z
2020-09-25T01:56:24.807Z
2020-09-25T01:56:24.807Z
Nate Eldredge
<p>Let's start from looking at electrum's <a href="https://github.com/spesmilo/electrum/blob/master/electrum/wordlist/english.txt" rel="nofollow noreferrer">wordlist</a> (same as BIP39 english). From your example words:</p>
<pre><code>weary
unseen
dude
muse
sent
</code></pre>
<p>don't exist in this wordlist. There are <code>dune, museum, wear and sentence</code>. <code>Unseen</code> isn't close to any of the words. If the author of the post provide mnemonic in the form of number it may be possible to calculate, from seed there is no way of getting the mnemonic (it's a HMAC function) and confirming his claim.</p>

CC BY-SA 4.0
2020-08-25T22:40:15.343Z
Sorry but how does what you said confirm anything? Your answer is more like a comment & it didn't add any new info. I think you misunderstood the question.
Ashfame
CC BY-SA 4.0
2020-08-25T23:03:38.537Z
It's not true (not valid) as these words aren't existing in any mnemonic dictionary I am aware of. Word is just a number representation (abandon = 0, zoo = 2047) that creates a mnemonic.
Tony Sanak
CC BY-SA 4.0
2020-08-26T11:48:46.997Z
Yet that says nothing about the possibility of such a collision, which is the original question. You are stating what I have already stated in the question.
Ashfame
CC BY-SA 4.0
2020-08-25T21:49:09.247Z
2020-08-25T21:49:09.247Z
Tony Sanak
<p>Came across <a href="https://bitcointalk.org/index.php?topic=878614.msg9703390#msg9703390" rel="nofollow noreferrer">this post</a> while researching, and it claims:</p>
<blockquote>
<p>This mnemonic: <code>weary weapon unseen like like like like like like like like like</code> and this one: <code>sister glide dude near muse sent like like like like like like</code> both produce the same binary seed (which is this
in hex: <code>0x1003ca7a7000000000000000000000000</code>) and they both produce
the same address list (starting with
<code>17A2fgCpcKEbg7CbfiJwAb8sjdEzUWD2y2</code>)</p>
<p>4/1000 number comes from this: (# of mnemonic permutations / # of
binary seeds) - 1 == (1626^12 / 2^128) - 1 == about 4/1000. So about 4
in 1000 mnemonics correspond to two binary seeds / two address lists.</p>
</blockquote>
<p>Can someone explain/verify the reality of this? Is this true? Applicable to only 12-words mnemonic or to all? Or not valid at all?</p>
<p>When I went ahead and tried to use the 12-word mnemonic provided, I found out that &quot;weary&quot; is not even a word in BIP39 English wordlist, but words are not chosen on the basis of security but rather to reduce human error in reading and transcribing the words. Does the claim hold up? And after reading tons of information on the subject, this is the first and only source that I have seen mentioned mnemonic -&gt; seed collision.</p>

<mnemonic-seed>
Validation for a seed collision
Ashfame
# Validation for a seed collision

(Asked by: username_0 on 2020-07-13)

Came across [this post](https://bitcointalk.org/index.php?topic=878614.msg9703390#msg9703390) while researching, and it claims:

> This mnemonic: `weary weapon unseen like like like like like like like like like` and this one: `sister glide dude near muse sent like like like like like like` both produce the same binary seed (which is this
> in hex: `0x1003ca7a7000000000000000000000000`) and they both produce
> the same address list (starting with
> `17A2fgCpcKEbg7CbfiJwAb8sjdEzUWD2y2`)
>
> 4/1000 number comes from this: (# of mnemonic permutations / # of
> binary seeds) - 1 == (1626^12 / 2^128) - 1 == about 4/1000. So about 4
> in 1000 mnemonics correspond to two binary seeds / two address lists.

Can someone explain/verify the reality of this? Is this true? Applicable to only 12-words mnemonic or to all? Or not valid at all?

When I went ahead and tried to use the 12-word mnemonic provided, I found out that "weary" is not even a word in BIP39 English wordlist, but words are not chosen on the basis of security but rather to reduce human error in reading and transcribing the words. Does the claim hold up? And after reading tons of information on the subject, this is the first and only source that I have seen mentioned mnemonic -> seed collision.

**Tags:** mnemonic-seed


---

## 2 answers

### Answer by username_1 on 2020-09-25. Score: 0 | Accepted answer

The post (which, note, is dated December 2014) is not referring to BIP39 or any variant, but instead to a particular obsolete and non-standard mnemonic algorithm used by the Electrum client prior to August 2014. (The author mentions Electrum further down in the post.) [Here is the code](https://github.com/spesmilo/electrum/blob/1.9.8/lib/mnemonic.py); their wordlist does indeed include [`weary`](https://github.com/spesmilo/electrum/blob/f92b483942d3f8ee51506e0436d9b524db33a336/lib/mnemonic.py#L1649).

You can see their [decode algorithm](https://github.com/spesmilo/electrum/blob/f92b483942d3f8ee51506e0436d9b524db33a336/lib/mnemonic.py#L1670). Each group of 3 words decodes to a hex string which is normally 8 digits but may in some cases be 9 (the computation of `x` may produce a value as large as `(n-1) * n*(n-1) * n*n*(n-1)`, where `n = 1626`, and this number exceeds `2^32`). These hex strings are then concatenated to form the seed to be used. Modifying the code to insert spaces between the strings makes it clear what is happening:

```
$ python mnemonic.py weary weapon unseen like like like like like like like like like
1003ca7a7 00000000 00000000 00000000 
$ python mnemonic.py sister glide dude near muse sent like like like like like like
1003ca7a 70000000 00000000 00000000 

```

So the first phrase yields a seed which is the same as for the second but with an extra zero on the end. I presume that elsewhere in the code, the seed is truncated to 32 hex digits before being used, possibly [here](https://github.com/spesmilo/electrum/blob/f92b483942d3f8ee51506e0436d9b524db33a336/lib/bitcoin.py#L570) though I have not traced where that is called. If so then the values actually used will be the same.

To be clear, this is not a collision in any cryptographic hash function, and has no particular security implications except that it makes the entropy of the seed phrase very slightly less than it might otherwise appear. It is also not relevant to any seed algorithm in any other software or in any recent version of Electrum.


---

### Answer by username_2 on 2020-08-25. Score: 0

Let's start from looking at electrum's [wordlist](https://github.com/spesmilo/electrum/blob/master/electrum/wordlist/english.txt) (same as BIP39 english). From your example words:

```
weary
unseen
dude
muse
sent

```

don't exist in this wordlist. There are `dune, museum, wear and sentence`. `Unseen` isn't close to any of the words. If the author of the post provide mnemonic in the form of number it may be possible to calculate, from seed there is no way of getting the mnemonic (it's a HMAC function) and confirming his claim.

> **Comments:**
> **username_0**: Sorry but how does what you said confirm anything? Your answer is more like a comment & it didn't add any new info. I think you misunderstood the question.  
> **username_2**: It's not true (not valid) as these words aren't existing in any mnemonic dictionary I am aware of. Word is just a number representation (abandon = 0, zoo = 2047) that creates a mnemonic.  
> **username_0**: Yet that says nothing about the possibility of such a collision, which is the original question. You are stating what I have already stated in the question.  

---

