iancoleman / bip39

A web tool for converting BIP39 mnemonic codes
https://iancoleman.io/bip39/
MIT License
3.57k stars 1.45k forks source link

Warn user when using "n Words" for mnemonic length, but Total Bits < what word count implies #179

Closed leafcutterant closed 6 years ago

leafcutterant commented 6 years ago

I appreciate the ability to generate standard word-length menmonics from any amount of total bits of entropy. However, I can easily imagine a beginner but curious user choosing to use their own entropy, choosing the "12 Words" mnemonic length (because they probably got used to that most mnemonics are 12 words long, and they haven't ever encountered "raw entropy"), but supplying less than 128 bits of entropy and generating a weak mnemonic that looks great on the surface. As you have said elsewhere, the "n Words" option breaks the implied relationship between entropy length, word count and mnemonic strength.

The same goes for anyone who for some reason thinks they can generate a stronger mnemonic from a certain entropy just by choosing a longer mnemonic length.

To this end, I propose displaying a warning whenever the "n Words" option selected and the supplied entropy's Total Bits are lesser than what is implied by the mnemonic' length, that is, n*32/3.

iancoleman commented 6 years ago

Good idea. There are a lot of warnings about entropy and I do take care not to create warning fatigue, but this seems like something that can be shown only when required so would be useful. Thanks for the suggestion, I'll hopefully incorporate this feature into the next release.

iancoleman commented 6 years ago

See https://github.com/iancoleman/bip39/commit/645945a00fe588064d33dca49f75f27e08b8f11e - Warn when using weak entropy and strong mnemonic

This is part of release 0.3.5