When looking through Monero's source code I was intrigued by the choice of the Mnemonic's 25th word which is defined as follow:

words += (' ' + words_store[create_checksum_index(words_store, language->get_unique_prefix_length())]);

Which calls:

return result.checksum() % crypto::ElectrumWords::seed_length;

In short, a modulo of 24 is applied on the CRC32 result which then represents the index of a word in the current Mnemonic Seed.

Why was the choice made to reduce CRC32's effect by applying a modulo 24 (and pick a word from the Mnemonic Seed) rather than a modulo 1626 (and pick a word from the dictionary)?

  • AFAIK, there is no good reason. However, by chance, it just happens doing it this way makes the seed easily recordable on a cryptosteel, by writing one of the 24 first words upside down if it matches the checsum word. I don't believe that was intended though.
    – user36303
    Commented Jan 6, 2018 at 14:28
  • Which makes me wonder if using a 1626 modulo would have allowed us to detect which word is wrong based on the initial role of a CRC32.
    – Maxithi
    Commented Jan 6, 2018 at 15:01
  • You could do that with error correction codes, not CRCs directly.
    – user36303
    Commented Jan 7, 2018 at 11:41

1 Answer 1


Why was the choice made to reduce CRC32's effect...?

Well it doesn't actually reduce the intended effect in this use-case. It's purpose is to quickly detect if a wrong set of words was entered, nothing more.

Also, as @user36303 commented above regarding cryptosteel, a nice side effect is you can reduce the seed words from 25 to 24 words by simply writing the word that happens to also be the checksum upside-down.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.