我們從密碼學角度來聊聊助記詞。

隨著區(qū)塊鏈錢包的發(fā)展和分層確定性（HD）錢包技術的普及，越來越多的用戶開始熟悉了一個叫“助記詞”的概念，很多人都已經(jīng)習慣了從一開始使用一個錢包的時候，就先抄好單詞認真保管，并且他們對于助記詞的重要性也有了很深刻的理解。

說到助記詞，有人可能會問了，為什么有些錢包是12個單詞，另一些則是24個單詞的助記詞呢？是不是單詞越多就越安全呢？

其實，與大部分人的直覺相反，從密碼學的角度上講，12單詞的安全強度和24個單詞是一樣的，12個單詞已經(jīng)足夠安全，增加單詞數(shù)并不能提高安全級別。

雖然按照比特幣BIP32/44/39規(guī)范，從 2048個單詞詞庫中選擇24個助記詞的概率空間>2^256，而選擇 12 個助記詞的概率空間>2^128，從概率空間上看起來24個助記詞的安全強度好像是要高很多，但本文將從密碼學的角度給你澄清這一事實，即“12個助記詞和24個助記詞的密碼學安全強度是一樣的”。

首先我們需要理解一個很著名的數(shù)學理論，叫“生日悖論”（Birthday Paradox）。

問大家一個問題，假設一個班級里有 23 個人，問這個班里有兩個生日相同的人的概率有多大？直覺上，大家可能會覺得概率很低，幾乎不可能，一年有 365 天呢，兩個人同一天生的概率得是多小啊。但數(shù)學往往就是反直覺的，其真實概率要大于 50%，如果是 30 個人的班級，概率則會大于 70%， 60 個人則大于 99% ，也就是幾乎肯定有兩個人生日相同，你敢信不？

這就是著名的“生日悖論”

生日悖論這一簡單的概率理論對于密碼學的影響是巨大的，因為基于這一理論產(chǎn)生了一種名為“生日攻擊”的密碼學攻擊手段，基于這一攻擊手段，所有的哈希函數(shù)（Hash）的密碼學安全強度都會降低到其概率空間位數(shù)的1/2，即 2^n 概率空間的密碼學安全強度為 2^(n/2)，如果是 2^256，則其安全強度為 2^128。

好了，在進一步講述生日攻擊之前，我們還要做點科普，學習幾個密碼學基本概念：

• 原像攻擊：我們都知道哈希函數(shù)是不可逆的，y=hash(x)，知道y，我們是無法得到x的。如果有一種攻擊方式能使得您得到x，那這種攻擊方式就叫做原像攻擊；
• 次原像攻擊：如果有一種攻擊方式能讓你找到另一個x’，使得 hash(x’) 也等于 y，即y=hash(x)=hash(x’)，這種找到了另一個x’的攻擊方式叫做次原像攻擊；
• 碰撞攻擊：碰撞攻擊的意思是，雖然我們找不到原像，也找不到次原像，但通過一定范圍內(nèi)的計算，能夠找到一對兒碰撞hash(z)=hash(z’)，就像雖然一年有365天，但每23個人就有50%的概率出現(xiàn)一次生日的碰撞，這使得我們不需要遍歷365次，而只需隨機抽取23個數(shù)就有50%的可能性找到一對兒碰撞，這就是碰撞攻擊；

對原像攻擊、次原像攻擊和碰撞攻擊有了基本的理解了之后，您就應該能明白，原像或次原像攻擊都很難，因為幾乎要遍歷整個概率空間，如果算法沒有漏洞的話，對于 2^256 的概率空間，您就需要遍歷幾乎 2^256 次才有希望找到一個原像或者次原像。而對于碰撞攻擊來說，您只需要遍歷 2^128 次，就能找到一對兒碰撞。

那對于密碼學簽名的碰撞攻擊又該如何進行呢？

我們假設你要對一個消息m做密碼學簽名，攻擊者知道m(xù)是正確的消息，并且準備了一份偽造的消息m’，毫無疑問，hash(m)<>hash(m’)，拿著m’是騙不了你的。

現(xiàn)在，攻擊者準備了大量的稍做修改的m，又準備了大量的稍做修改的m’，這里所提到的“稍作修改”并不影響m的正確性和m’的偽造性。

然后，攻擊者再從大量的m和大量的m’中找到一對兒hash(m)=hash(m’)，其難度是2(n/2)，也就是說，對于2256的概率空間，攻擊者需要準備2128份正確消息m和2128份偽造消息m’，從中就能找到一對兒碰撞hash(m)=hash(m’)。

最后，攻擊者拿碰撞到的m讓你做密碼學簽名，并將m替換為m’，攻擊成功。

好了，現(xiàn)在大家應該基本上理解了生日悖論和生日攻擊的基本原理了，對于密碼學貨幣來說，2256的概率空間其密碼學安全強度為2128，12個單詞的助記詞的概率空間也是2^128，增加助記詞的概率空間并不能提高密碼學安全強度，對于錢包助記詞來說，12個單詞和24個單詞一樣安全的。

24個助記詞更安全

理論上 24 個助記詞的更難以破解，但是實際使用中無論 12 個還是 24 個都是安全。

12 個助記詞的概率空間 > 2^128,換成數(shù)字就是: 340282366920938463463374607431768211456

24 個單詞的概率空間 > 2^256，換成數(shù)字就是已經(jīng)超出計算機范圍了，2 的 256 次方也就是 8 個 2^32 次方相乘。

2^256 = 2^32 * 2^32 * 2^32 * 2^32 * 2^32 * 2^32 * 2^32 * 2^32

精確計算現(xiàn)在計算機還做不到，我們一般采取估算：2 的 32 次方約等于 40 億。40 億連續(xù)相乘 8 次。

40 億 * 40 億 * 40 億 * 40 億 * 40 億 * 40 億 * 40 億 * 40 億

最終的數(shù)是:1.1579208923732e+77，如果說破解 2^128 是在地球中尋找一粒沙子，那么 2^256 就相當于在我們所認知的宇宙中尋找一粒沙子。

從密碼學上來說肯定是單詞越多越安全，因為更多的數(shù)字擁有更多的排列組合。24 個單詞的排列組合是完全碾壓 12 個單詞組合的，完全不在一個數(shù)量級上。但是從實際角度出發(fā)，到這個量級的概率，加密本身已經(jīng)不存在安全問題了，無論 12 個，還是 24 個，或者 240 個，你腦袋都記不住，只可能寫下來，或者記錄下來。也就是說這時候的危險是來自你助記詞儲存是否安全了，已經(jīng)不是 12 個單詞的安全問題了；

如果你的記錄丟了，或者被木馬病毒竊取了了，別說你是 24 個單詞，你就是 240 個單詞也是白搭.所以從實際場景來說，我們通常認為 12 個單詞和 24 個單詞安全性是一樣的。考慮到未來幾十年的科技發(fā)展，我更認為 24 個助記詞是更讓人放心的，也體現(xiàn)了你對錢包安全方面的態(tài)度。要搞就搞最安全的，哪怕只是理論上的更加安全。

為什么助記詞鋼板每個單詞只給了4個字母的空位（后附完整BIP-39助記詞表）

通常沒買過助記詞板或者初次拿到助記詞板的朋友會有這樣的疑問。

我們所提到的助記詞，一般分為12個、18個和24個，其中，大部分軟件錢包一般會生成12個助記詞，而大部分硬件錢包會生成24個助記詞。在使用區(qū)塊鏈錢包的過程中，助記詞是管理資產(chǎn)的核心，也就是說，誰擁有助記詞，誰才是這個錢包賬戶的真正擁有者。

為了保護好這個核心部分，很多人選擇使用助記詞鋼板，當然也有人選擇記在紙上或者存在其他任何覺得保險的地方。如果你用過軟件錢包或者硬件錢包，你就會發(fā)現(xiàn)或者應該知道如下事實：

1、所有接觸到的助記詞的前四位都是不同的，這也是助記詞鋼板只給了4個空位的最根本原因；

2、助記詞的總數(shù)是有限的，根據(jù)BIP-39，這個數(shù)量是2048個，每一個單詞都對應一個唯一的編號，比如Abandon是0001， Ability是0002，Able是0003，以此類推，單詞表詳見附件。

3、有些錢包軟件在用助記詞導入賬戶的時候，往往只需輸入3個或者4個字母，就會出現(xiàn)幾個單詞的備選項，在這些備選項里，一定有你要輸入的單詞。

4、同一套助記詞導入到不同的錢包，得到的以太坊的地址往往是相同的，但BTC的地址卻不太相同。就比如用Ledger錢包生成的助記詞導入到OKX WEB3錢包里面，原有的BTC資產(chǎn)很難直接出現(xiàn)在OKX錢包里面，因為所用的導出規(guī)則不同。所以如果Ledger的錢包故障了，想導出里面的資產(chǎn)，最穩(wěn)妥的方法還是買一個新的Ledger錢包，同理換做其他品牌的硬件錢包也是一樣。

5、相比于軟件錢包，硬件錢包往往還有一個Passphrase的功能，就是在第24個助記詞之外，你可以自定義一個助記詞，然后會生成一個完全不同的賬戶來，也就是說，別人即使知道了你的24個助記詞，因為不知道你的Passphrase，他還是拿不走你的資產(chǎn)。

最后，再強調(diào)一遍，千萬別隨便告訴別人你的助記詞，誰擁有助記詞，誰就擁有這個賬戶的管理權限。

附件：BIP-39完整版助記詞表
abandon ability able about above absent absorb abstract absurd abuse access accident account accuse achieve acid acoustic acquire across act action actor actress actual adapt add addict address adjust admit adult advance advice aerobic affair afford afraid again age agent agree ahead aim air airport aisle alarm album alcohol alert alien all alley allow almost alone alpha already also alter always amateur amazing among amount amused analyst anchor ancient anger angle angry animal ankle announce annual another answer antenna antique anxiety any apart apology appear apple approve april arch arctic area arena argue arm armed armor army around arrange arrest arrive arrow art artefact artist artwork ask aspect assault asset assist assume asthma athlete atom attack attend attitude attract auction audit august aunt author auto autumn average avocado avoid awake aware away awesome awful awkward axis baby bachelor bacon badge bag balance balcony ball bamboo banana banner bar barely bargain barrel base basic basket battle beach bean beauty because become beef before begin behave behind believe below belt bench benefit best betray better between beyond bicycle bid bike bind biology bird birth bitter black blade blame blanket blast bleak bless blind blood blossom blouse blue blur blush board boat body boil bomb bone bonus book boost border boring borrow boss bottom bounce box boy bracket brain brand brass brave bread breeze brick bridge brief bright bring brisk broccoli broken bronze broom brother brown brush bubble buddy budget buffalo build bulb bulk bullet bundle bunker burden burger burst bus business busy butter buyer buzz cabbage cabin cable cactus cage cake call calm camera camp can canal cancel candy cannon canoe canvas canyon capable capital captain car carbon card cargo carpet carry cart case cash casino castle casual cat catalog catch category cattle caught cause caution cave ceiling celery cement census century cereal certain chair chalk champion change chaos chapter charge chase chat cheap check cheese chef cherry chest chicken chief child chimney choice choose chronic chuckle chunk churn cigar cinnamon circle citizen city civil claim clap clarify claw clay clean clerk clever click client cliff climb clinic clip clock clog close cloth cloud clown club clump cluster clutch coach coast coconut code coffee coil coin collect color column combine come comfort comic common company concert conduct confirm congress connect consider control convince cook cool copper copy coral core corn correct cost cotton couch country couple course cousin cover coyote crack cradle craft cram crane crash crater crawl crazy cream credit creek crew cricket crime crisp critic crop cross crouch crowd crucial cruel cruise crumble crunch crush cry crystal cube culture cup cupboard curious current curtain curve cushion custom cute cycle dad damage damp dance danger daring dash daughter dawn day deal debate debris decade december decide decline decorate decrease deer defense define defy degree delay deliver demand demise denial dentist deny depart depend deposit depth deputy derive describe desert design desk despair destroy detail detect develop device devote diagram dial diamond diary dice diesel diet differ digital dignity dilemma dinner dinosaur direct dirt disagree discover disease dish dismiss disorder display distance divert divide divorce dizzy doctor document dog doll dolphin domain donate donkey donor door dose double dove draft dragon drama drastic draw dream dress drift drill drink drip drive drop drum dry duck dumb dune during dust dutch duty dwarf dynamic eager eagle early earn earth easily east easy echo ecology economy edge edit educate effort egg eight either elbow elder electric elegant element elephant elevator elite else embark embody embrace emerge emotion employ empower empty enable enact end endless endorse enemy energy enforce engage engine enhance enjoy enlist enough enrich enroll ensure enter entire entry envelope episode equal equip era erase erode erosion error erupt escape essay essence estate eternal ethics evidence evil evoke evolve exact example excess exchange excite exclude excuse execute exercise exhaust exhibit exile exist exit exotic expand expect expire explain expose express extend extra eye eyebrow fabric face faculty fade faint faith fall false fame family famous fan fancy fantasy farm fashion fat fatal father fatigue fault favorite feature february federal fee feed feel female fence festival fetch fever few fiber fiction field figure file film filter final find fine finger finish fire firm first fiscal fish fit fitness fix flag flame flash flat flavor flee flight flip float flock floor flower fluid flush fly foam focus fog foil fold follow food foot force forest forget fork fortune forum forward fossil foster found fox fragile frame frequent fresh friend fringe frog front frost frown frozen fruit fuel fun funny furnace fury future gadget gain galaxy gallery game gap garage garbage garden garlic garment gas gasp gate gather gauge gaze general genius genre gentle genuine gesture ghost giant gift giggle ginger giraffe girl give glad glance glare glass glide glimpse globe gloom glory glove glow glue goat goddess gold good goose gorilla gospel gossip govern gown grab grace grain grant grape grass gravity great green grid grief grit grocery group grow grunt guard guess guide guilt guitar gun gym habit hair half hammer hamster hand happy harbor hard harsh harvest hat have hawk hazard head health heart heavy hedgehog height hello helmet help hen hero hidden high hill hint hip hire history hobby hockey hold hole holiday hollow home honey hood hope horn horror horse hospital host hotel hour hover hub huge human humble humor hundred hungry hunt hurdle hurry hurt husband hybrid ice icon idea identify idle ignore ill illegal illness image imitate immense immune impact impose improve impulse inch include income increase index indicate indoor industry infant inflict inform inhale inherit initial inject injury inmate inner innocent input inquiry insane insect inside inspire install intact interest into invest invite involve iron island isolate issue item ivory jacket jaguar jar jazz jealous jeans jelly jewel job join joke journey joy judge juice jump jungle junior junk just kangaroo keen keep ketchup key kick kid kidney kind kingdom kiss kit kitchen kite kitten kiwi knee knife knock know lab label labor ladder lady lake lamp language laptop large later latin laugh laundry lava law lawn lawsuit layer lazy leader leaf learn leave lecture left leg legal legend leisure lemon lend length lens leopard lesson letter level liar liberty library license life lift light like limb limit link lion liquid list little live lizard load loan lobster local lock logic lonely long loop lottery loud lounge love loyal lucky luggage lumber lunar lunch luxury lyrics machine mad magic magnet maid mail main major make mammal man manage mandate mango mansion manual maple marble march margin marine market marriage mask mass master match material math matrix matter maximum maze meadow mean measure meat mechanic medal media melody melt member memory mention menu mercy merge merit merry mesh message metal method middle midnight milk million mimic mind minimum minor minute miracle mirror misery miss mistake mix mixed mixture mobile model modify mom moment monitor monkey monster month moon moral more morning mosquito mother motion motor mountain mouse move movie much muffin mule multiply muscle museum mushroom music must mutual myself mystery myth naive name napkin narrow nasty nation nature near neck need negative neglect neither nephew nerve nest net network neutral never news next nice night noble noise nominee noodle normal north nose notable note nothing notice novel now nuclear number nurse nut oak obey object oblige obscure observe obtain obvious occur ocean october odor off offer office often oil okay old olive olympic omit once one onion online only open opera opinion oppose option orange orbit orchard order ordinary organ orient original orphan ostrich other outdoor outer output outside oval oven over own owner oxygen oyster ozone pact paddle page pair palace palm panda panel panic panther paper parade parent park parrot party pass patch path patient patrol pattern pause pave payment peace peanut pear peasant pelican pen penalty pencil people pepper perfect permit person pet phone photo phrase physical piano picnic picture piece pig pigeon pill pilot pink pioneer pipe pistol pitch pizza place planet plastic plate play please pledge pluck plug plunge poem poet point polar pole police pond pony pool popular portion position possible post potato pottery poverty powder power practice praise predict prefer prepare present pretty prevent price pride primary print priority prison private prize problem process produce profit program project promote proof property prosper protect proud provide public pudding pull pulp pulse pumpkin punch pupil puppy purchase purity purpose purse push put puzzle pyramid quality quantum quarter question quick quit quiz quote rabbit raccoon race rack radar radio rail rain raise rally ramp ranch random range rapid rare rate rather raven raw razor ready real reason rebel rebuild recall receive recipe record recycle reduce reflect reform refuse region regret regular reject relax release relief rely remain remember remind remove render renew rent reopen repair repeat replace report require rescue resemble resist resource response result retire retreat return reunion reveal review reward rhythm rib ribbon rice rich ride ridge rifle right rigid ring riot ripple risk ritual rival river road roast robot robust rocket romance roof rookie room rose rotate rough round route royal rubber rude rug rule run runway rural sad saddle sadness safe sail salad salmon salon salt salute same sample sand satisfy satoshi sauce sausage save say scale scan scare scatter scene scheme school science scissors scorpion scout scrap screen script scrub sea search season seat second secret section security seed seek segment select sell seminar senior sense sentence series service session settle setup seven shadow shaft shallow share shed shell sheriff shield shift shine ship shiver shock shoe shoot shop short shoulder shove shrimp shrug shuffle shy sibling sick side siege sight sign silent silk silly silver similar simple since sing siren sister situate six size skate sketch ski skill skin skirt skull slab slam sleep slender slice slide slight slim slogan slot slow slush small smart smile smoke smooth snack snake snap sniff snow soap soccer social sock soda soft solar soldier solid solution solve someone song soon sorry sort soul sound soup source south space spare spatial spawn speak special speed spell spend sphere spice spider spike spin spirit split spoil sponsor spoon sport spot spray spread spring spy square squeeze squirrel stable stadium staff stage stairs stamp stand start state stay steak steel stem step stereo stick still sting stock stomach stone stool story stove strategy street strike strong struggle student stuff stumble style subject submit subway success such sudden suffer sugar suggest suit summer sun sunny sunset super supply supreme sure surface surge surprise surround survey suspect sustain swallow swamp swap swarm swear sweet swift swim swing switch sword symbol symptom syrup system table tackle tag tail talent talk tank tape target task taste tattoo taxi teach team tell ten tenant tennis tent term test text thank that theme then theory there they thing this thought three thrive throw thumb thunder ticket tide tiger tilt timber time tiny tip tired tissue title toast tobacco today toddler toe together toilet token tomato tomorrow tone tongue tonight tool tooth top topic topple torch tornado tortoise toss total tourist toward tower town toy track trade traffic tragic train transfer trap trash travel tray treat tree trend trial tribe trick trigger trim trip trophy trouble truck true truly trumpet trust truth try tube tuition tumble tuna tunnel turkey turn turtle twelve twenty twice twin twist two type typical ugly umbrella unable unaware uncle uncover under undo unfair unfold unhappy uniform unique unit universe unknown unlock until unusual unveil update upgrade uphold upon upper upset urban urge usage use used useful useless usual utility vacant vacuum vague valid valley valve van vanish vapor various vast vault vehicle velvet vendor venture venue verb verify version very vessel veteran viable vibrant vicious victory video view village vintage violin virtual virus visa visit visual vital vivid vocal voice void volcano volume vote voyage wage wagon wait walk wall walnut want warfare warm warrior wash wasp waste water wave way wealth weapon wear weasel weather web wedding weekend weird welcome west wet whale what wheat wheel when where whip whisper wide width wife wild will win window wine wing wink winner winter wire wisdom wise wish witness wolf woman wonder wood wool word work world worry worth wrap wreck wrestle wrist write wrong yard year yellow you young youth zebra zero zone zoo
There is one very good use of this list. If you have lost your recovery key, and you think you might have it on your computer or in an email somewhere, you can search your computer for these words. If you are able to find any of them, it is worth exploring the document and seeing if you might have used it to write down the other 11. These are the words that we suggest you backup with one of our seed cassette devices. This 12 word phrase or sometimes 24/25 is worth the entire value of your wallet. With a seed phrase, you can setup a new wallet and move millions of dollars in less than a minute.

助記詞12個單詞和24個如何互轉(zhuǎn)

助記詞從12個單詞轉(zhuǎn)換為24個單詞，或者從24個單詞轉(zhuǎn)換為12個單詞，可以通過使用特定的工具或算法來實現(xiàn)。 例如，最近發(fā)布的開源工具"BIP39Colors"就可以實現(xiàn)這種轉(zhuǎn)換。這個工具不僅可以將助記詞轉(zhuǎn)換為一組顏色，還可以實現(xiàn)顏色到助記詞的逆轉(zhuǎn)換。這意味著，通過這個工具，你可以將12個單詞的助記詞擴展為24個單詞，或者反之，將24個單詞的助記詞縮減為12個單詞。這種轉(zhuǎn)換是基于BIP39標準進行的，該標準規(guī)定了如何從一個熵池中生成助記詞，并且要求助記詞必須滿足一定的熵值和校驗和要求，以確保它們的安全性和唯一性。