waxwing on Nostr: I doubt my idea is possible, sadly. An interesting nuance here: look at how mnemonics ...

I doubt my idea is possible, sadly. An interesting nuance here: look at how mnemonics evolved in btc, which is using the same keys. we decided that a range of possible entropies from 128 bits to 256 bits is reasonable. I believe this is related to the fact that the best attacks on ECDLP are O(sqrt n) so your 256 private key really "only" has 128 bits anyway. So let's say you start with a 128 bit master secret and then you generate a quasi-infinite number of keys from that with HD (BIP32). So, hmm, it's 12 words this way with a 2000 word dictionary (because 10^3 is about 2^10 so 2000 is about 2^11 and if you raise it to a power 12 you get 132>128. But if we reduce the number of words it's (obviously) an exponential loss of entropy. Say you choose 6 words, then you're looking at solving (k)^6 = 2^128 so k has to be ~ 2^21 or like a million words; a dictionary size of even 20K is nowhere near.