<p>Checksum in BIP-39 is mainly used for <em>padding</em> which may be the reason why smaller size checksums are used.<br>
Each BIP-39 word represents 11-bits and in order to divide the entropy of an arbitrary size (which is normally a multiple of 8-bit such as 128, 160, 256,...) to 11-bit chunks it has to be padded first. For example in case of a 128-bit entropy 4-bits <em>padding</em> is needed (128+4=132%11=0) and that pad is the checksum.<br>
BIP-39 authors may not have thought about recovery cases but if a bigger checksum were to be chosen it has to pad the total length to a multiple of 11. In case of 128 bits it needs to be 15-bits (128+15=143%11=0) or 26-bits, 37-bits,... </p>

CC BY-SA 4.0
2020-03-13T13:40:36.417Z
Why pad to 11 bits? Why use a wordlist of 2048 words specifically (i.e. why not 4096 words)?
inersha
CC BY-SA 4.0
2020-03-13T13:55:20.923Z
11-bits is because of the total number of words (2048=2^11). 2048 is chosen to have the resulting security of nearly as equal as a private key. Minimum is 12 words, that is 2048^12 = 2^132 combinations, considering 4 bits is checksum that would give it 128-bits of security which is equal to a 256-bit bitcoin private key's security (half the length).
Coding Enthusiast
CC BY-SA 4.0
2020-03-13T14:05:43.413Z
So 2048 words was the optimal number, and the size of the checksum was determined so that the entropy+checksum would be divisible by 11? I'm curious why 2048 would be preferable over say, 4096 words (padding to 12 bits per word would achieve this).
inersha
CC BY-SA 4.0
2020-03-13T13:30:38.617Z
2020-03-13T13:30:38.617Z
Coding Enthusiast
<p>In the BIP39 specification, you add 1 bit of checksum for every 32 bits of entropy you generate.</p>

<p>Therefore, with a common entropy size of 128 bits, you are only adding 4 bits of checksum. This means that if you were to write down the words in the mnemonic sentence in the wrong order (or write down an incorrect word from the wordlist), there is a 1 in 16 (<code>0b1111</code>) chance that a tool for validating your mnemonic will tell you that you have written down a valid mnemonic.</p>

<p>Is this too short to make checksums for mnemonic sentences reliable?</p>

<p>Alternatively, you could instead add 4 bits of checksum for every 32 bits, which would mean a mnemonic from 128 bits of entropy will have a 1 in 65535 (1 in <code>0b1111111111111111</code>) chance of being valid if written down incorrectly. This would require a wordlist of 4096 words (12 bits per word) to accommodate the checksum and keep the mnemonic sentence the same length, but it seems that it would be much more reliable.</p>

<p>Is there a reason why BIP39 chose to use such small checksums?</p>

<mnemonic-seed><checksum>
Is the checksum used in BIP39 mnemonic sentences too short?
inersha
# Is the checksum used in BIP39 mnemonic sentences too short?

(Asked by: username_0 on 2020-03-13)

In the BIP39 specification, you add 1 bit of checksum for every 32 bits of entropy you generate.

Therefore, with a common entropy size of 128 bits, you are only adding 4 bits of checksum. This means that if you were to write down the words in the mnemonic sentence in the wrong order (or write down an incorrect word from the wordlist), there is a 1 in 16 (`0b1111`) chance that a tool for validating your mnemonic will tell you that you have written down a valid mnemonic.

Is this too short to make checksums for mnemonic sentences reliable?

Alternatively, you could instead add 4 bits of checksum for every 32 bits, which would mean a mnemonic from 128 bits of entropy will have a 1 in 65535 (1 in `0b1111111111111111`) chance of being valid if written down incorrectly. This would require a wordlist of 4096 words (12 bits per word) to accommodate the checksum and keep the mnemonic sentence the same length, but it seems that it would be much more reliable.

Is there a reason why BIP39 chose to use such small checksums?

**Tags:** mnemonic-seed, checksum


---

## 1 answers

### Answer by username_1 on 2020-03-13. Score: 0

Checksum in BIP-39 is mainly used for *padding* which may be the reason why smaller size checksums are used.  
Each BIP-39 word represents 11-bits and in order to divide the entropy of an arbitrary size (which is normally a multiple of 8-bit such as 128, 160, 256,...) to 11-bit chunks it has to be padded first. For example in case of a 128-bit entropy 4-bits *padding* is needed (128+4=132%11=0) and that pad is the checksum.  
BIP-39 authors may not have thought about recovery cases but if a bigger checksum were to be chosen it has to pad the total length to a multiple of 11. In case of 128 bits it needs to be 15-bits (128+15=143%11=0) or 26-bits, 37-bits,...

> **Comments:**
> **username_0**: Why pad to 11 bits? Why use a wordlist of 2048 words specifically (i.e. why not 4096 words)?  
> **username_1**: 11-bits is because of the total number of words (2048=2^11). 2048 is chosen to have the resulting security of nearly as equal as a private key. Minimum is 12 words, that is 2048^12 = 2^132 combinations, considering 4 bits is checksum that would give it 128-bits of security which is equal to a 256-bit bitcoin private key's security (half the length).  
> **username_0**: So 2048 words was the optimal number, and the size of the checksum was determined so that the entropy+checksum would be divisible by 11? I'm curious why 2048 would be preferable over say, 4096 words (padding to 12 bits per word would achieve this).  

---

