<p>The secp256k1 curve provides 128 bits of security, so as long as your source of entropy is good (indinsintguishable from uniformly random), anything over 128 bits gives you no benefit at all. I don't know which CSPRNGs were used back in the day and how they were seeded, but the fact that Satoshi's coins remain untouched to this day would indicate that the keys were in fact generated securely.</p>
<p>Side note, 24-word mnemonics aren't more secure that 12-word mnemonics either. As far as I'm aware, the reason for their existence is that you can safely type them into an untrusted device in a random order (as determined by a connected hardware wallet which itself has limited input capabilities). There are about 2<sup>79</sup> permutations of 24 words, which is a markedly lower security level than 128 bits, but still out of reach in the foreseeable future for all but the most dedicated attackers, and can be further improved by typing in a few words not part of the original mnemonic. Compare that with 12 words which only have 479,001,600 (about 2<sup>29</sup>) permutations, trivially crackable on any modern PC.</p>

CC BY-SA 4.0
2023-04-28T01:28:20.237Z
This is correct, 24 word would only be more difficult to crack if you actually had to crack the words. The attack is to find a private key given a public key, and the public key as you suggested provides 128bit security on the 256k curve. https://bitcoin.stackexchange.com/questions/110145/using-more-than-a-12-word-mnemonic-phrase https://bitcoin.stackexchange.com/questions/117348/12-or-24-words-for-menomonic/117366#117366
Poseidon
CC BY-SA 4.0
2023-05-01T22:13:59.533Z
Thanks for this answer. I don't really understand it thoug. It sounds like you could rather just go with 12 words. I thought it had something to do with anyone knowing your public key, having it easier to get to your private key (brute force, but with less tries). Why 2<sup>79</sup>? I understand 2048<sup>24</sup> (BIP 39).
codepleb
CC BY-SA 4.0
2023-05-01T22:45:32.333Z
24! ≈ 2^79 (the number of permutations of 24 words).
Vojtěch Strnad
CC BY-SA 4.0
2023-05-04T08:59:30.257Z
Why `24!`? You can have words twice in a BIP39 seed phrase.
codepleb
CC BY-SA 4.0
2024-01-03T16:13:48.047Z
Yes, for a seed phrase with repeated words the number of distinct permutations of its words will be lower.
Vojtěch Strnad
CC BY-SA 4.0
2023-04-28T00:53:37.973Z
2023-05-01T14:24:10.663Z
2023-05-01T14:24:10.663Z
Vojtěch Strnad
<p>I read that back then, you had entropies of 128 bit instead of 256. Like 12 vs 24 word mnemonic seed phrases. Are their wallets easier to brute force than other ones?</p>

<security><private-key><mnemonic-seed><satoshi-nakamoto>
Are satoshis private keys easier to find than modern ones (given proper security in both cases)?
codepleb
# Are satoshis private keys easier to find than modern ones (given proper security in both cases)?

(Asked by: username_0 on 2023-04-27)

I read that back then, you had entropies of 128 bit instead of 256. Like 12 vs 24 word mnemonic seed phrases. Are their wallets easier to brute force than other ones?

**Tags:** security, private-key, mnemonic-seed, satoshi-nakamoto


---

## 1 answers

### Answer by username_1 on 2023-04-28. Score: 3

The secp256k1 curve provides 128 bits of security, so as long as your source of entropy is good (indinsintguishable from uniformly random), anything over 128 bits gives you no benefit at all. I don't know which CSPRNGs were used back in the day and how they were seeded, but the fact that Satoshi's coins remain untouched to this day would indicate that the keys were in fact generated securely.

Side note, 24-word mnemonics aren't more secure that 12-word mnemonics either. As far as I'm aware, the reason for their existence is that you can safely type them into an untrusted device in a random order (as determined by a connected hardware wallet which itself has limited input capabilities). There are about 279 permutations of 24 words, which is a markedly lower security level than 128 bits, but still out of reach in the foreseeable future for all but the most dedicated attackers, and can be further improved by typing in a few words not part of the original mnemonic. Compare that with 12 words which only have 479,001,600 (about 229) permutations, trivially crackable on any modern PC.

> **Comments:**
> **username_2**: This is correct, 24 word would only be more difficult to crack if you actually had to crack the words. The attack is to find a private key given a public key, and the public key as you suggested provides 128bit security on the 256k curve. https://bitcoin.stackexchange.com/questions/110145/using-more-than-a-12-word-mnemonic-phrase https://bitcoin.stackexchange.com/questions/117348/12-or-24-words-for-menomonic/117366#117366  
> **username_0**: Thanks for this answer. I don't really understand it thoug. It sounds like you could rather just go with 12 words. I thought it had something to do with anyone knowing your public key, having it easier to get to your private key (brute force, but with less tries). Why 2<sup>79</sup>? I understand 2048<sup>24</sup> (BIP 39).  
> **username_1**: 24! ≈ 2^79 (the number of permutations of 24 words).  
> **username_0**: Why `24!`? You can have words twice in a BIP39 seed phrase.  
> **username_1**: Yes, for a seed phrase with repeated words the number of distinct permutations of its words will be lower.  

---

