Something to note: the whole "96 of 128 bits" thing drastically reduces entropy. By my count it's only got ~27.2 (!) bits of entropy, as in, if you have one num

Something to note: the whole "96 of 128 bits" thing drastically reduces entropy. By my count it's only got ~27.2 (!) bits of entropy, as in, if you have one number in the database it's take ~2^26.2 tries on average to get a valid one. There are n choose k bitstrings with exactly k bits set to the correct value. Hence, there are sum(n=96 to 128 of 128 choose n) length-128 bitstrings with at least 96 bits set to the correct value. There are 2^128 length-128 bitstrings. Hence, your chance of randomly generating a bitstring with at least 96 bits set correctly from a length-128 bitstring is sum(n=96 to 128 of 128 choose n) / 2^(128), which works out to ~1 / 2^(27.2). If I did the math correctly, that is.