Monero Stack Exchange is a question and answer site for developers and users of the secure, private and untraceable cryptocurrency Monero. It only takes a minute to sign up.
Sign up to join this community
How many possible unique Monero wallets and seeds exist?
If the number of possible seeds is greater than the number of possible wallets, does that mean that more than one seed could control the spend key for the same wallet?
How does the above answer compare to Bitcoin
How many possible unique Monero wallets and seeds exist?
To understand the number of possibilities, we must first look into how are monero wallets and seed mnemonics created. I think this pretty much covers everything there is to know about it.
To answer your question, number of possible wallets is:
Default wallet generation method
The private spendkey defines the wallet since private viewkey is generated deterministically from spendkey. Number of possible wallets is then equal to number of possible spendkeys, which is:
l = 2^252 + 27742317777372353535851937790883648493.
The private spend key is just a number between 0 and l-1. The public key is obtained by multiplying the elliptic curve basepoint G with that number. An interesting property is that multiplying with some number greater than l will result in the same public key as if you multiplied with some number from the above range, ie
B = b * G = (b+l) * G,
where B is the public spendkey, and b the private spendkey.
Once the private spend key is determined, it's encoded into human-friendly 25-word seed mnemonic.
That's why using numbers above l as private keys is pointless, but possible.
Non-deterministic wallet generation method
You can actually create a wallet by independently generating both the spendkey and viewkey. In that case, number of possible wallets is l^2.
If the number of possible seeds is greater than the number of possible wallets, does that mean that more than one seed could control the spend key for the same wallet?
Seed mnemonic
Seed mnemonic uses a dictionary of 1626 words. To be able to represent any private spendkey, we need enough words so that the resulting number of combinations is bigger than the number of possible spendkeys. This is achieved with 24 words, and the number of possible combinations is 1626^24 which is bigger than l. If a bigger number is represented by the words, that just means you'll "wrap around" as above and it will decode to some private spendkey in the range between 0 to l-1.
That means that there are some wallet combinations which can be represented by exactly 2 seed mnemonic combinations. The wallet software will give you only the "lower" mnemonic.
How does the above answer compare to Bitcoin
It's relevant to highlight the fundamental difference in the way the addresses work.
With Monero, your address can be thought of as a recipe. The recipient takes the recipe, adds his own secret ingredient ("sender's random data" AKA TX private key) and creates an one-time public key (AKA output) which will actually hold the funds and be recorded to the blockchain. It's one-directional, so nobody can work out which recipe was used since the special ingredient is randomness. The number of possible one-time keys is also equal to l so any individual output is as secure as the wallet itself. This method is referred to as "stealth addresses".
With Bitcoin, the address itself is what's recorded to the blockchain and what holds the funds. Unlike Monero, the standard address is a hash of the address public key. When spending, the user must publish both the address public key and the signature produced using the private key. Verification is done by checking the signature against the address public key, and hashing the address public key and checking it against the input address.
Number of possible keys is exactly:
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141,
which is slightly less than 2^256. The above number has the same meaning as l in case of monero and is the order of the basepoint but for Bitcon's elliptic curve (secp256k1).
Address is obtained by hashing the public key first with SHA256 and then with RIPEMD160. Number of possible Bitcoin addresses is thus 2^160.
Interestingly, there can be multiple Bitcoin private keys which are able to spend from some Bitcoin address.
Also, if I understand the sources well, one public key can have 2 different valid addresses depending on whether the uncompressed or compressed one was hashed to obtain the address.
More details about Bitcoin addresses can be found here:
https://bitcoin.stackexchange.com/questions/1389/how-are-public-private-keys-in-an-address-created
