Maybe I've misunderstood, but it reads to me like you're saying that a 12-word seed offers equivalent security (~128 bits) to that of the individual addresses generated from it, and that therefore, longer seeds are overkill.
In Elliptic Curves the key's security is half the key size and since bitcoin key sizes are 256 bit that makes the security 128 bits.
[...]Maybe I'm being less clear than I think I am, or the point I'm making is more confusing than I think it is, because I'm not sure why you're explaining that. I mean, my critique of Charles-Tim's quote depends on me already knowing that, doesn't it? My point was that seeds that offer higher security levels than the individual keys they generate are useful because they're protecting multiple keys.
Isn't that reasoning a little shaky? I mean, the seed is used to generate a unique sequence of addresses [1], no? Putting aside the increased hassle of longer seeds, isn't it desirable for it to be harder to recover the sequence than it is to brute-force a single address?
No because security is defined by the weakest link not the strongest.
[...]Yep, when you're combining cryptographic primitives, that's exactly right. But, in this case there's a causal relationship that makes things a little more subtle.
If you had, let's say, a 64-bit seed that you deterministically generated 256-bit private keys from, then the security of the latter is confined by the entropy of the former. But that confinement doesn't work the same way in the opposite direction. I'm flipping two things at once here, so keep your wits about you, but in the reverse situation, with a 256-bit seed being used to generate 64-bit private keys (with the top 192 bits set to 0, for example) the smaller 64-bit private keys don't reduce the security of the seed all the way down to their level.
In some sense, the seed "contains" the private keys that it generates, and viewed through that lens, the following example amounts to a very similar thing, even if it looks unrelated at first glance:
Imagine you have a file, listing the locations of secret military bases encoded as 64-bit coordinates (32-bit longitude, 32-bit latitude). Even though this file contains only a sequence of (sensitive) 64-bit values, that shouldn't decide what security level is chosen to protect its contents. It wouldn't make sense to argue that encrypting it with anything more than a 64-bit key is technically unnecessary.
