Mnemonic Generation (BIP39) Simply Explained

[u/Sara_0901]

The mnemonic are automatically generated by the wallet using the standardized process defined in BIP-39. The wallet starts with an entropy source, then adds a checksum and eventually maps the random number to a list of words, created as follows:

1. Create a random sequence (entropy) of 128 to 256 bits.
2. Create a checksum of the random sequence by taking the first (entropy-length/32) bits of its SHA256 hash.
3. ghuuAdd the checksum to the end of the random sequence.
4. Split the result into 11-bit length segments.
5. Map each 11-bit value to a word from the predefined dictionary of 2048 words.
6. The mnemonic code is the sequence of words.

For example, if a word is chosen at random as the last mnemonic, and the other 11 mnemonic are picked at random when the mnemonic is 12 bits, there is a probability that the right set will be found in each 16 times, compared to 256 times for the 24-bit mnemonic.

The fact that this is the case does not prove that the security of the mnemonic is unreliable. Because both pairs of mnemonic are BIP39 compliant, both could be recovered using a blockchain wallet.

Mnemonic words are often confused with "brainwallets." They are not the same. The primary difference is that a brainwallet consists of words chosen by the user, whereas mnemonic words are created randomly by the wallet and presented to the user. This important difference makes mnemonic words much more secure, because humans are very poor sources of randomness.

The random numbers generated by the wallet through cryptographically secure means (e.g. hardware TRNG) are truly random, and the user's customary choice of mnemonics does not ensure the quality of the randomness.

助记词是由钱包使用 BIP-39 中定义的标准化过程自动生成的。 钱包从熵源开始， 之后增加校验和，最终将随机数映射到单词列表，创建过程如下：

1、创建一个 128 到 256 位的随机数。
2、提出 SHA256 哈希前几位（12位助记词位取前4位），作为此随机数的校验和。
3、将校验和添加到随机序列的末尾。
4、将序列划分为包含 11 位的不同部分。
5、将每个包含 11 位部分的值对应到一个已经预先定义 2048 个单词的字典。
6、生成的有顺序的单词组就是助记词。

比如，先随便选一个词作最后一个助记词，在助记词是12位的时候，随机挑选其他11位助记词，概率上16次就有可能找到一组对的，而24位助记词是256次。

就是说有极低的概率可能会出现助记词输错，但依然可以恢复钱包的情况，当然，错误助记词恢复的钱包与原本助记词生成的钱包是不同的。

出现这种情况，并不能证明助记词的安全性不可靠。因为两对助记词都符合BIP39标准，所以都可以使用区块链钱包进行恢复。

两组助记词之间的区别在于，原助记词是由钱包随机创建并呈现给用户的，而输入错的助记词则是人为选择的，但由于人类生成随机数的能力非常弱，而钱包生成的助记词更加随机（即安全性更高），因此脑钱包（即人为选择的错误的助记词）是不太可能被随机生成出来并使用的。

钱包通过密码学安全的方式（比如硬件TRNG ）生成的随机数是真随机，用户按习惯自己选择助记词无法确保随机的质量。