user131941: Watching this Q&A with andreas he states that a 12 word recovery phrase offers the same amount of security as a 24 word seed phrase as the output is 128 bits either way.
If this is the case, why do wallets use 24 word recovery phrases which adds extra user complexity for no, or a marginal at best, security improvement?

user13866: According to my calculator ...

2128 is around 3.4e+38.
204812 is around 5.4e+39

So I guess Andreas is right (unsurprisingly). A randomly chosen 12 word phrase from a 2048-word dictionary has enough entropy to generate any 128-bit seed.
However, I am not a mathematician nor a cryptographer, so there may well be some other important factors I am unaware of.
The fact that the phrase incorporates a checksum must slightly reduce the number of random bits in the generated seed.

BIP39 says this:

We refer to the initial entropy length as ENT. The allowed size of ENT is 128-256 bits.

So BIP39 allows for much greater entropy.
...

The following table describes the relation between the initial entropy length (ENT), the checksum length (CS), and the length of the generated mnemonic sentence (MS) in words.
CS = ENT / 32
MS = (ENT + CS) / 11




ENT
CS
ENT+CS
MS




128
4
132
12


160
5
165
15


192
6
198
18


224
7
231
21


256
8
264
24




So the checksum is accounted for.
I didn't see much other relevant discusssion of this aspect in the BIP.

131941: <p>Watching <a href="https://www.youtube.com/watch?app=desktop&amp;v=U0T49duRt74&amp;t=841s" rel="nofollow noreferrer">this Q&amp;A with andreas</a> he states that a 12 word recovery phrase offers the same amount of security as a 24 word seed phrase as the output is 128 bits either way.</p>
<p>If this is the case, why do wallets use 24 word recovery phrases which adds extra user complexity for no, or a marginal at best, security improvement?</p>
 13866: <p>According to my calculator ...</p>
<ul>
<li>2<sup>128</sup> is around 3.4e+38.</li>
<li>2048<sup>12</sup> is around 5.4e+39</li>
</ul>
<p>So I guess Andreas is right (unsurprisingly). A randomly chosen 12 word phrase from a 2048-word dictionary has enough entropy to generate any 128-bit seed.</p>
<p>However, I am not a mathematician nor a cryptographer, so there may well be some other important factors I am unaware of.</p>
<p>The fact that the phrase incorporates a checksum must slightly reduce the number of random bits in the generated seed.</p>
<hr />
<p><a href="https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki" rel="nofollow noreferrer">BIP39</a> says this:</p>
<blockquote>
<p>We refer to the initial entropy length as ENT. The allowed size of ENT is 128-256 bits.</p>
</blockquote>
<p>So BIP39 allows for much greater entropy.</p>
<p>...</p>
<blockquote>
<p>The following table describes the relation between the initial entropy length (ENT), the checksum length (CS), and the length of the generated mnemonic sentence (MS) in words.</p>
<p>CS = ENT / 32<br />
MS = (ENT + CS) / 11</p>
<div class="s-table-container">
<table class="s-table">
<thead>
<tr>
<th>ENT</th>
<th>CS</th>
<th>ENT+CS</th>
<th>MS</th>
</tr>
</thead>
<tbody>
<tr>
<td>128</td>
<td>4</td>
<td>132</td>
<td>12</td>
</tr>
<tr>
<td>160</td>
<td>5</td>
<td>165</td>
<td>15</td>
</tr>
<tr>
<td>192</td>
<td>6</td>
<td>198</td>
<td>18</td>
</tr>
<tr>
<td>224</td>
<td>7</td>
<td>231</td>
<td>21</td>
</tr>
<tr>
<td>256</td>
<td>8</td>
<td>264</td>
<td>24</td>
</tr>
</tbody>
</table>
</div></blockquote>
<p>So the checksum is accounted for.</p>
<p>I didn't see much other relevant discusssion of this aspect in the BIP.</p>
