Suppose I have a 13 word mnemonic seed from Mymonero.com and 13 grandchildren that I would like to eventually inherit my account.

My grandchildren would be given their seed word in advance but not know the order in which the seeds should be used. My estate attorney would know the proper order for the grandchildren's seed words to be used but not know the seed themselves.

Assuming my attorney can be trusted not to reveal the seed order to my grandchildren how safe am I from funds being spent before my death?

How many combinations of possible mnemonic seed are there if all 13 grandchildren collude to share their words (not knowing the correct order)?

  • 2
    The 13th word is a checksum, btw. Commented Aug 26, 2016 at 0:40
  • 3
    Also, although I'm guessing this question is speculative, a much more secure system would be to split your private keys into 14 pieces using secret sharing scheme. Give one piece to each of your grand children, and one to your attorney. Then, even if any 13 of them collude, it is impossible for them to crack your private key without doing a full brute force (if they can do that, they can steal everyone's Monero). Since you want all of them to be present to get the funds, you can use a XOR sharing scheme, which is very simple. Commented Aug 26, 2016 at 0:43

1 Answer 1


The number of ways to arrange n distinct objects is simply n! (n factorial), so for 13 unique words (I don't believe they're allowed to have repeats repeats are allowed, but the probability of getting a repeat for 12 words selected randomly from 1500 is pretty low, about 5%), you could arrange them in 6227020800 different ways, however the final word is a check sum, and I think this will make a very important difference.

Initially 6 billion sounds like a reasonably huge amount, since I thought they would have to scan the entire chain up to the point when the inheritance was deposited, unless they knew the exact block or range of blocks when the inheritance was deposited or created, that would cut down on the time somewhat. So, if they had no idea when the transaction(s) were made, then I think 6 billion would be reasonably safe, though probably not completely infeasible.

But, because there is a checksum, then I think they just have to try all permutations of each set of 12 words until they find one that produces the correct checksum. I believe this means that they would not have to scan the blockchain. The formula for the number of different ways to arrange x objects from a set of y total objects in y!/(y-x)!, in this case 13!/1! = ~6 billion, so assuming there's no repeats, they may have to do this up to 13 times before they find the correct order of twelve words, which would be ~69 billion permutations to check. I'm not sure, but I don't think arranging the subset of 12 words and performing the checksum for the remaining one 69e9 times would necessarily take very long, depending on your hardware, maybe a few hours, or a few days, or weeks, but probably not secure for decades if your meddling grandchildren were determined to get their hands on your precious moneroj before you intended them to receive it.

  • 3
    They are allowed to repeat.
    – user36303
    Commented Aug 25, 2016 at 23:04
  • 1
    The final word being a checksum makes quite a bit of a difference. It means that you know which word comes last in (unless there is repetition), cutting it down to 12!. Commented Aug 26, 2016 at 0:41
  • Actually, it even worse. One out of 12 of the possibilities you try will be wrong, dividing the number of scans you need to do by 12. This cuts it down to 11! blockchain scans. Commented Aug 26, 2016 at 1:27
  • But if there is a checksum, doesn't that eliminate the need to scan the blockchain at all? If only one combination of 12 out of the 13 words will produce the correct checksum, then you don't need to scan at all right? At least not until you've found a combination that gives a correct checksum, no?
    – jwinterm
    Commented Aug 26, 2016 at 1:36
  • 2
    It cuts down the set of generated addresses to try to about 1/1626 (assuming equiprobable distribution of generated addresses with this scheme, which I'm not sure can be relied upon, but it seems close enough).
    – user36303
    Commented Aug 26, 2016 at 7:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.