<p>For the purposes of this answer, I'll assume we're only talking about mnemonics which can be <em>generated</em> by Electrum 2.x, and not ones that are simply accepted by Electrum 2.x for restore (the latter number is infinite).</p>

<hr>

<blockquote>
  <ol>
  <li>What is the percentage of 12 words Electrum 2.x seeds (relative to 13 word seeds)?</li>
  </ol>
</blockquote>

<p>Electrum 2.x seeds <em>by default</em> encode 136 bits of data. Any leading zero bits are ignored during encoding, so the resulting mnemonic length varies.</p>

<p>Each word encodes log<sub>2</sub>(word_list_length) bits of data, so for most* Electrum 2.x word lists, that's log<sub>2</sub>(2048) = 11 bits per word.</p>

<p>Therefore 13 and 12-word long mnemonics can encode up to 143 and 132 bits of data respectively. In order for a 136-bit seed to be encoded into 132 bits (12 words), at least the first 4 bits must be zero, which happens with probability 1 in 2<sup>4</sup>, so <strong>1 in 16</strong> random mnemonics will be of length 12 <em>or fewer</em>.</p>

<p>Likewise, for an 11-word mnemonic, encoding 136 bits into 121 bits requires that 15 leading bits must be zero, so 1 in 2<sup>15</sup> or <strong>1 in 32768</strong> will be of length 11 <em>or fewer</em>.</p>

<p>Finally, if you need an exact answer, it would be <sup>1</sup>/<sub>16</sub> - <sup>1</sup>/<sub>32768</sub> = <sup>2048</sup>/<sub>32768</sub> - <sup>1</sup>/<sub>32768</sub> = <strong>2047 in 32768</strong> will be of length 12 <em>exactly</em>.</p>

<p><sub>* For the Portuguese word list, it's log<sub>2</sub>(1626) ≈ 10.67 bits per word</sub></p>

<hr>

<blockquote>
  <ol start="2">
  <li>What is the percentage of Electrum 2.x (12 word) seeds which do not meet the BIP39 standard?</li>
  </ol>
</blockquote>

<p>12-word long BIP-39 mnemonics have <a href="https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#generating-the-mnemonic" rel="nofollow">4 bits of checksum</a>, so 1 in 2<sup>4</sup> generated 12-word Electrum 2.x mnemonics will happen to be valid BIP-39 ones, and <strong>15 in 16</strong> Electrum ones will be invalid for BIP-39.</p>

<hr>

<blockquote>
  <p>If all <em>12 word Electrum 2.x</em> seeds were filtered such that they <strong>are not</strong> BIP39 compatible, what is the decrease in entropy going to be?</p>
</blockquote>

<p>I'm interpreting this as asking: If valid Electrum 2.x mnemonics were required to be invalid BIP-39 ones, by how much would this decrease their entropy?</p>

<p>Wolfram|Alpha says very small: about <a href="http://www.wolframalpha.com/input/?i=solve++%282%5En+-+1%29+%2F+2%5En+%3D+2047%2F32768+%C3%97+1%2F16++for+n" rel="nofollow">0.0056</a> bits based on this input:</p>

<pre><code>solve  (2^n - 1) / 2^n = 2047/32768 × 1/16  for n
</code></pre>

CC BY-SA 3.0
2015-06-16T23:46:51.203Z
Wow! Fantastic work! I'll see what @ThomasV thinks of this for differentiating BIP39 and Electrum 2.x: seems a good consideration. Also, I did notice Portuguese strays back to Electrum 1.x word list size myself and wondered, what on earth is going on?
Wizard Of Ozzie
CC BY-SA 3.0
2015-06-17T00:11:00.567Z
@WizardOfOzzie Thanks! IIUC, Monero Core borrowed Electrum 1.x's seed generation method and original English word list, and then added new word lists all of the same size as Electrum 1.x's list, and later Electrum 2.x borrowed (back) one of the new word lists which had no BIP-39 equivalent. Since Electrum 2.x can work with word lists of any positive size, I assume ThomasV saw no reason to create a Portuguese word list of BIP-39 size.
Christopher Gurnee
CC BY-SA 3.0
2015-06-17T00:24:49.937Z
I checked the Electrum 2.x word lists yesterday and they match BIP39 exactly for Japanese, English and Spanish. When you say Electrum 2.x "borrowed back" a non-BIP39 wordlist, are you referring to Portuguese?
Wizard Of Ozzie
CC BY-SA 3.0
2015-06-17T00:55:15.567Z
@WizardOfOzzie Right, I meant that they used Monero's word lists for Portuguese which had no corresponding BIP-39 list. I've no idea what the plans are, if any, for Chinese, and I've no idea if the BIP-39 French word list will be used, or the [partially completed Electrum 2.x one](https://github.com/spesmilo/electrum/issues/1109).
Christopher Gurnee
CC BY-SA 3.0
2015-06-17T01:50:04.357Z
yeah, the BIP39 French wordlist has real issues, sharing 100 words with English; https://github.com/simcity4242/pybitcointools/blob/master/bitcoin/mnemonic.py#L44
Wizard Of Ozzie
CC BY-SA 3.0
2015-06-17T03:14:19.487Z
@WizardOfOzzie We're getting a bit off-topic here ;) ... but I actually disagreed with you in the [GitHub PR here](https://github.com/bitcoin/bips/pull/152#issuecomment-111184317), FWIW.
Christopher Gurnee
CC BY-SA 3.0
2015-06-16T21:26:20.483Z
2015-06-16T21:26:20.483Z
Christopher Gurnee
<p>Electrum 2.0 seeds (mnemonic phrases) are <a href="https://github.com/spesmilo/electrum/blob/master/lib/mnemonic.py%23L149" rel="nofollow">created with a checksum based algorithm</a> (such that the <code>hmac_sha512</code> starts with <code>01</code>. It's usually a 13 word seed, but can be 12 in some circumstances.</p>

<p>If all <em>12 word Electrum 2.x</em> seeds were filtered such that they <strong>are not</strong> <a href="https://github.com/simcity4242/pybitcointools/blob/master/bitcoin/mnemonic.py%23L109" rel="nofollow">BIP39 compatible</a>, what is the decrease in entropy going to be?</p>

<p>=> The question pertains to <a href="https://github.com/simcity4242/pybitcointools/" rel="nofollow">this Python code</a></p>

<p>I guess the problem can be summed up as:</p>

<ol>
<li>What is the percentage of 12 words Electrum 2.x seeds (relative to 13 word seeds)?</li>
<li>What is the percentage of Electrum 2.x (12 word) seeds which do not meet the BIP39 standard? (The last word decides the checksum)</li>
</ol>

<electrum><cryptography><mnemonic-seed>
Ramifications of creating Electrum 2.x seeds which are not BIP39
Wizard Of Ozzie
# Ramifications of creating Electrum 2.x seeds which are not BIP39

(Asked by: username_0 on 2015-06-16)

Electrum 2.0 seeds (mnemonic phrases) are [created with a checksum based algorithm](https://github.com/spesmilo/electrum/blob/master/lib/mnemonic.py%23L149) (such that the `hmac_sha512` starts with `01`. It's usually a 13 word seed, but can be 12 in some circumstances.

If all *12 word Electrum 2.x* seeds were filtered such that they **are not** [BIP39 compatible](https://github.com/simcity4242/pybitcointools/blob/master/bitcoin/mnemonic.py%23L109), what is the decrease in entropy going to be?

=> The question pertains to [this Python code](https://github.com/simcity4242/pybitcointools/)

I guess the problem can be summed up as:

1. What is the percentage of 12 words Electrum 2.x seeds (relative to 13 word seeds)?
2. What is the percentage of Electrum 2.x (12 word) seeds which do not meet the BIP39 standard? (The last word decides the checksum)

**Tags:** electrum, cryptography, mnemonic-seed


---

## 1 answers

### Answer by username_1 on 2015-06-16. Score: 2 | Accepted answer

For the purposes of this answer, I'll assume we're only talking about mnemonics which can be *generated* by Electrum 2.x, and not ones that are simply accepted by Electrum 2.x for restore (the latter number is infinite).

---

> 1. What is the percentage of 12 words Electrum 2.x seeds (relative to 13 word seeds)?

Electrum 2.x seeds *by default* encode 136 bits of data. Any leading zero bits are ignored during encoding, so the resulting mnemonic length varies.

Each word encodes log2(word\_list\_length) bits of data, so for most\* Electrum 2.x word lists, that's log2(2048) = 11 bits per word.

Therefore 13 and 12-word long mnemonics can encode up to 143 and 132 bits of data respectively. In order for a 136-bit seed to be encoded into 132 bits (12 words), at least the first 4 bits must be zero, which happens with probability 1 in 24, so **1 in 16** random mnemonics will be of length 12 *or fewer*.

Likewise, for an 11-word mnemonic, encoding 136 bits into 121 bits requires that 15 leading bits must be zero, so 1 in 215 or **1 in 32768** will be of length 11 *or fewer*.

Finally, if you need an exact answer, it would be 1/16 - 1/32768 = 2048/32768 - 1/32768 = **2047 in 32768** will be of length 12 *exactly*.

\* For the Portuguese word list, it's log2(1626) ≈ 10.67 bits per word

---

> 2. What is the percentage of Electrum 2.x (12 word) seeds which do not meet the BIP39 standard?

12-word long BIP-39 mnemonics have [4 bits of checksum](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#generating-the-mnemonic), so 1 in 24 generated 12-word Electrum 2.x mnemonics will happen to be valid BIP-39 ones, and **15 in 16** Electrum ones will be invalid for BIP-39.

---

> If all *12 word Electrum 2.x* seeds were filtered such that they **are not** BIP39 compatible, what is the decrease in entropy going to be?

I'm interpreting this as asking: If valid Electrum 2.x mnemonics were required to be invalid BIP-39 ones, by how much would this decrease their entropy?

Wolfram|Alpha says very small: about [0.0056](http://www.wolframalpha.com/input/?i=solve++%282%5En+-+1%29+%2F+2%5En+%3D+2047%2F32768+%C3%97+1%2F16++for+n) bits based on this input:

```
solve  (2^n - 1) / 2^n = 2047/32768 × 1/16  for n

```

> **Comments:**
> **username_0**: Wow! Fantastic work! I'll see what @ThomasV thinks of this for differentiating BIP39 and Electrum 2.x: seems a good consideration. Also, I did notice Portuguese strays back to Electrum 1.x word list size myself and wondered, what on earth is going on?  
> **username_1**: @username_0 Thanks! IIUC, Monero Core borrowed Electrum 1.x's seed generation method and original English word list, and then added new word lists all of the same size as Electrum 1.x's list, and later Electrum 2.x borrowed (back) one of the new word lists which had no BIP-39 equivalent. Since Electrum 2.x can work with word lists of any positive size, I assume ThomasV saw no reason to create a Portuguese word list of BIP-39 size.  
> **username_0**: I checked the Electrum 2.x word lists yesterday and they match BIP39 exactly for Japanese, English and Spanish. When you say Electrum 2.x "borrowed back" a non-BIP39 wordlist, are you referring to Portuguese?  
> **username_1**: @username_0 Right, I meant that they used Monero's word lists for Portuguese which had no corresponding BIP-39 list. I've no idea what the plans are, if any, for Chinese, and I've no idea if the BIP-39 French word list will be used, or the [partially completed Electrum 2.x one](https://github.com/spesmilo/electrum/issues/1109).  
> **username_0**: yeah, the BIP39 French wordlist has real issues, sharing 100 words with English; https://github.com/simcity4242/pybitcointools/blob/master/bitcoin/mnemonic.py#L44  
> **username_1**: @username_0 We're getting a bit off-topic here ;) ... but I actually disagreed with you in the [GitHub PR here](https://github.com/bitcoin/bips/pull/152#issuecomment-111184317), FWIW.  

---

