Make that 256 pennies and you won’t regret it if 128 bits of entropy gets cracked a decade or two from now.
tl;dr: Network transition to post-quantum signature schemes will be required regardless of the chosen seed length.
I'd be willing to add 256-bit to airgap-coinflip if there's enough demand for it:
https://github.com/ghscuuo/airgap-coinflip
Thanks for making me ask my llm to dive a little deeper for me into the bit lengths!:
THE BOTTOM LINE: Current funds are safe. The 10-20 year quantum threat is a risk-management assumption, not a consensus timeline (physics constraints are massive). Bitcoin will require a post-quantum network upgrade long before these threats operationalize.
CONTEXT: Thread discusses manual BIP39 seed generation via physical coin flips (pennies) to eliminate PRNG hardware/software trust assumptions.
CLASSICAL BRUTE FORCE:
• 128-bit (12 words): Requires energy exceeding current planetary output. Classically secure indefinitely.
• 256-bit (24 words): Requires more energy than the sun will produce in its lifetime.
QUANTUM THREAT: Grover's Algorithm (Hashing/Symmetric)
• Theoretically halves cryptographic strength, but practically carries massive quantum gate-depth overhead. 128-bit offline seeds remain practically secure.
• 256-bit seeds completely harden the offline BIP39/BIP32 derivation pathways against theoretical quantum arrays.
QUANTUM THREAT: Shor's Algorithm (Asymmetric/ECC)
• Shor's algorithm breaks the Elliptic Curve Cryptography (secp256k1) used in Bitcoin signatures.
• If a public key is exposed on-chain (e.g., via spending from an address), seed length offers zero protection against Shor's deriving the private key.
CONCLUSION: 256 coin flips hardens offline storage against Grover's, but cannot fix the underlying ECC vulnerability of a spent transaction. Network transition to post-quantum signature schemes will be required regardless of the chosen seed length.
I'd be willing to add 256-bit to airgap-coinflip if there's enough demand for it:
https://github.com/ghscuuo/airgap-coinflip
Thanks for making me ask my llm to dive a little deeper for me into the bit lengths!:
THE BOTTOM LINE: Current funds are safe. The 10-20 year quantum threat is a risk-management assumption, not a consensus timeline (physics constraints are massive). Bitcoin will require a post-quantum network upgrade long before these threats operationalize.
CONTEXT: Thread discusses manual BIP39 seed generation via physical coin flips (pennies) to eliminate PRNG hardware/software trust assumptions.
CLASSICAL BRUTE FORCE:
• 128-bit (12 words): Requires energy exceeding current planetary output. Classically secure indefinitely.
• 256-bit (24 words): Requires more energy than the sun will produce in its lifetime.
QUANTUM THREAT: Grover's Algorithm (Hashing/Symmetric)
• Theoretically halves cryptographic strength, but practically carries massive quantum gate-depth overhead. 128-bit offline seeds remain practically secure.
• 256-bit seeds completely harden the offline BIP39/BIP32 derivation pathways against theoretical quantum arrays.
QUANTUM THREAT: Shor's Algorithm (Asymmetric/ECC)
• Shor's algorithm breaks the Elliptic Curve Cryptography (secp256k1) used in Bitcoin signatures.
• If a public key is exposed on-chain (e.g., via spending from an address), seed length offers zero protection against Shor's deriving the private key.
CONCLUSION: 256 coin flips hardens offline storage against Grover's, but cannot fix the underlying ECC vulnerability of a spent transaction. Network transition to post-quantum signature schemes will be required regardless of the chosen seed length.
1