Why are the seeds different when going from seed to mnemonic and back using bx?

Question

From an example in the documentation:

$ bx seed | bx mnemonic-new | bx mnemonic-to-seed | bx hd-new

655a1ed2d4fef69bb314198c7327f23c grab special regret prepare urge evidence slush lobster midnight odor wish ketchup 57bae342ae8e69eb63f17ef993a90a59159e0f78114b602bf0ebabfec0e5d086e883c31975bf03f8a47a32853452623094d1303fd0549745db457145e5756582 xprv9s21ZrQH143K43CUCgNp5SmXzg2axQx2P4WupA2zEnKpFM19QfqfdqfpJR3yfzAXZnsHeUaQhWQMwyuqL8DbdeLeCbdMoKNn6pCY4RUn2pK

In Mastering Bitcoin, the example given here shows it going back to the seed that was originally created; this was done using an older version of bx though. Can someone explain how the seeds from line 1 and line 3 in the example are encoded/related?

Answer 1

They adopted bip39 where the seed mnemonic is run through a key derivation function to derive the seed. This is an irreversible step.

Answer 2

Fundamental flaw here, multiple meanings of the word "seed"even within discussion of just BIP39.

The "entropy" is a better term for the BIP39 starting point. Then the endpoint of the process should be "BIP39 numeric seed".

"Convert the entropy to a BIP39 mnemonic. Use that mnemonic plus a (technically optional but no) passphrase as the inputs to produce the BIP39 numeric seed. End of BIP39. "

is how I would tell the story.

Now, looking at this from *Mastering Bitcoin *

The seed can be encoded using the mnemonic-encode command:

$ bx hd-mnemonic < seed > words adore repeat vision worst especially veil inch woman cast recall dwell appreciate

The seed can then be decoded using the mnemonic-decode command:

$ bx mnemonic-decode < words eb68ee9f3df6bd4441a9feadec179ff1

Andreas Antonopoulos is here clearly using "seed" to refer to the entropy. The process described does not involve hashing, or cryptographic "encoding", it's just a change in representation, like going from binary to hex.

Except for the N/32 checksum getting added.

Which means an input entropy of 256 bits is entirely reversible, but the last 8 bits to get to 264 (24 words x 11 bits) is the result of the checksum process.

What the other answers here are referring to is not the "entropy seed" but the output, the "BIP39 numeric seed" which is indeed a one way derivation process.

I believe the bx mnemonic-decode command may have gotten removed simply because it is useless, or at least I cannot think of a use case.

I do not think it stopped working in the transition to BIP39. EDIT The entropy to mnemonic "conversion" is reversed by many tools - see https://iancoleman.app

Answer 3

A note for those reading this in the future: "bx seed" is completely insecure and will result in your money being stolen. See CVE-2023-39910, aka the "Milk Sad" issue:

The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet private keys generated from "bx seed" entropy output and steal funds. (Affected users need to move funds to a secure new cryptocurrency wallet.)

Answer 4

I asked the same questions regarding the example in Mastering Bitcoin and here is the answer:

The old mnemonic-decode (electrum v1 mnemonics I believe) was dropped from libbitcoin before version3 and replaced with BIP-39 mnemonics. libbitcoin version4 also adds in electrum v2 mnemonics. Unlike electrum v1 mnemonics (which are symmetric), BIP-39 is asymmetric --https://github.com/libbitcoin/libbitcoin-explorer/issues/366