Since this wallet has been around long before the latest RNG in Linux kernel version 5.17, is there really any effective difference in the entropy between seeds generated on a 10yr old Linux OS versus the latest version? Wouldn't they both have 132 bits?
The entropy size being 132 bits is not related to the RNG. It is because of how the code is written and how the Electrum mnemonic algorithm works.
Basically with a word-list containing 2048 items, each word represent 11 bits from 000_00000000 to 111_11111111). So 12 words represents 12*11=132 bits. Keep in mind that we only need 128 bits for them to be secure. There are two algorithms:
- In BIP-39 the purpose of checksum is to ensure integrity of the input and is used as padding. So we produce 128 bits of entropy then compute its hash (checksum) and add 4 bits of that to the end of the entropy to get 132 bits total. Then split those bits into 12x 11-bit limbs, each representing a word.
- In Electrum the purpose of checksum is to determine the wallet type and is not used for padding. So in order to have 12 words we need to actually produce 132 bits of entropy. Then we convert those bits into the mnemonic (ie. 12 words) and compute hmac (checksum) of it to determine the wallet type.
Does adding extra words (even up to 24) still result in the same 132 bits as simply using the 12 words?
Your mnemonic will still be 12 words, the extra words you add as "passphrase" is an additional entropy you are adding on top of it.
Did earlier versions of Electrum create seeds with less than 132 bits?
I'm not quite sure how the "old" algorithm[1] works (I think it used 128 bits) but after the old algorithm in early 1.x version, the "new" algorithm hasn't changed and has been using 132 bits by
default.
[1]
https://github.com/spesmilo/electrum/blob/master/electrum/old_mnemonic.py
