user1743: I know that you can create a Mnemonic + PW to encode a seed to derive keys. What I want is to encrypt an existing mnemonic with a password that generates the same seed as the unencrypted mnemonic.
Background is, that I have an existing seed sentence that I want to encrypt into an new mnemonic without changing the underlying entorpy.So I can replace my existing paper copy with an encrypted one.
Is this possible already? Or any reasons why it does not make sense at all?
Update
I came up with an proposal implementation:
https://github.com/Niondir/go-bip39/blob/master/encyrption_test.go
It uses SHA256(pw) to generate the key for an AES-CTR with an empty IV to encrypt the entropy that is derived from the mnemonic. I'm open for discussion of the parameters and ciphers, but this might not be the best place for that discussion.

user131437: First things first. There are 3 values in play;

The entropy
The mnemonic phrase
The seed

The entropy is just random data.
The mnemonic is the same random data, but mapped to a wordlist plus a checksum.
The seed is derived from the mnemonic and a password.
A mnemonic can be converted back to the entropy that was used to create it.
But it is the seed that is used to generate your wallet addresses.
When using a different password you are not actually encrypting the mnemonic but just changing the derived seed. The password is used as the salt to pbkdf2.
It is impossible to find the mnemonic+password for a given seed, and therefor it is impossible to find the mnemonic for a given seed and password.
It is what pbkdf2 was explicitly designed for.

1743: <p>I know that you can create a Mnemonic + PW to encode a seed to derive keys. What I want is to encrypt an existing mnemonic with a password that generates the same seed as the unencrypted mnemonic.</p>
<p>Background is, that I have an existing seed sentence that I want to encrypt into an new mnemonic without changing the underlying entorpy.So I can replace my existing paper copy with an encrypted one.</p>
<p>Is this possible already? Or any reasons why it does not make sense at all?</p>
<p><strong>Update</strong><br />
I came up with an proposal implementation:<br />
<a href="https://github.com/Niondir/go-bip39/blob/master/encyrption_test.go" rel="nofollow noreferrer">https://github.com/Niondir/go-bip39/blob/master/encyrption_test.go</a></p>
<p>It uses SHA256(pw) to generate the key for an AES-CTR with an empty IV to encrypt the entropy that is derived from the mnemonic. I'm open for discussion of the parameters and ciphers, but this might not be the best place for that discussion.</p>
 131437: <p>First things first. There are 3 values in play;</p>
<ol>
<li>The entropy</li>
<li>The mnemonic phrase</li>
<li>The seed</li>
</ol>
<p>The entropy is just random data.
The mnemonic is the same random data, but mapped to a wordlist plus a checksum.
The seed is derived from the mnemonic and a password.</p>
<p>A mnemonic can be converted back to the entropy that was used to create it.
But it is the seed that is used to generate your wallet addresses.</p>
<p>When using a different password you are not actually encrypting the mnemonic but just changing the derived seed. The password is used as the salt to pbkdf2.</p>
<p>It is impossible to find the mnemonic+password for a given seed, and therefor it is impossible to find the mnemonic for a given seed and password.
It is what pbkdf2 was explicitly designed for.</p>
