Im referencing https://iancoleman.io/bip39/
I understand how the words are generated ("bip39 mnemonic" at the link). But Im not quite clear on how the words give rise to "bip39 seed" two sections later.
Ive followed a variety of youtubers who demonstrate the calculation in python, but my computations are not coming out the same. Im not sure why. Clearly Im missing something about how certain strings/values are being constructed prior to the sha512.
These pictures are from Mastering bitcoin and were so insightful for me.
How the mnemonic words are generated:
How they are used to generates master seed of your wallet:
From BIP39:
To create a binary seed from the mnemonic, we use the PBKDF2 function with a mnemonic sentence (in UTF-8 NFKD) used as the password and the string "mnemonic" + passphrase (again in UTF-8 NFKD) used as the salt. The iteration count is set to 2048 and HMAC-SHA512 is used as the pseudo-random function. The length of the derived key is 512 bits (= 64 bytes).
If a passphrase is not present, an empty string "" is used instead.
When I try to generate a random mnemonic on https://iancoleman.io/bip39/, the derived BIP39 seed is the same as when I manually calculate it with https://stuff.birkenstab.de/pbkdf2/ using the steps above.
To complement Vojtěch's answer James Chiang explained how the seed is derived from the mnemonic during his TeachBitcoin class in 2019:
When I generate the seed for my HD wallet I do not go back to the secret entropy. I don’t decode my mnemonic word phrase to obtain the entropy. Instead I join all my words into a sentence, I concatenate a string mnemonic, there is an optional passphrase that you can introduce. Then through the password-based key derivation function 2. What is that? That is basically many (2048) rounds of HMAC-SHA512. That takes as an argument the sentence and as a salt, the mnemonic and the passphrase concatenated. The many rounds are equivalent to a length extension. It makes it more expensive to brute force. Adding more rounds is the equivalent to adding key length if you will. Then we finally end up with a 512 bit seed. This is the seed that we use to derive the rest of our wallet.
I made this video to show exactly how it works. Not to teach, but so I could learn myself.
Basically the bip39 passphrase is a standardized way of submitting a big string of lower case characters and spaces for hashing through a PBKDF2 512 algorithm 2048 times. Your passphrase (25th word)is nothing more than customized salt for this otherwise standard input. The resulting 512 bit hash will become your bip39 seed which is used to derive all the private and public keys for your wallet. Watch the video though, a picture is worth 1000 words.
