18

Is there a specific reason to why BIP39 isn't added to Bitcoin Core? Seems very trivial to add and am confused to why it isn't there.

Improve this question
10
  • 1
    Good question. I thought there might be a github issue suggesting this, which might contain some explanation, but I couldn't find one.
    – Nate Eldredge
    Jun 7, 2019 at 20:49
  • 3
    @NateEldredge It is discussed in github.com/bitcoin/bitcoin/pull/6265
    – Raghav Sood
    Jun 8, 2019 at 0:42
  • @RaghavSood: Thanks. As far as I can tell, the summary seems to be "people might be tempted to make up their own mnemonic phrases, instead of randomly generating them, and that would be bad because they'd be susceptible to brute force".
    – Nate Eldredge
    Jun 8, 2019 at 2:07
  • BIPs 32/39/44 is already native to other Bitcoin frameworks, e.g., github.com/libbitcoin/libbitcoin-explorer/wiki/….
    – skaht
    Jun 8, 2019 at 2:31
  • 1
    @NateEldredge I got the same feeling from it, but the discussion is quite old, and possibly involves some misunderstanding - BIP39 in its current form already includes checksums, and it would generally be quite hard to create an insecure mnemonic, barring bad raw entropy (which would affect the current BIP32 seed in Bitcoin Core equally, since it would be the same entropy)
    – Raghav Sood
    Jun 8, 2019 at 4:15

1 Answer 1

Reset to default
18

BIP 39 is not in Bitcoin Core largely for implementation reasons and because BIP 39 is not as secure as it could be.

The structure of Bitcoin Core's wallet doesn't really allow for BIP 39 to be implemented. The current structure doesn't allow for 512 bit seeds as BIP 39 specifies, and adding it would require some significant changes to the wallet code. Implementing BIP 39 would also require implementation of PBKDF2, although that isn't very hard.

Also, more generally, many Bitcoin Core contributors don't consider BIP 39 to be secure. It uses PBKDF2 which is generally regarded to be a fairly weak KDF so it isn't considered to be good for the secure storage of all of your Bitcoin. Some software (such as Electrum) used BIP 39 in the past but have switched to using their own mnemonic algorithm because of this weakness in BIP 39.

BIP 39 mnemonics have some other issues as well such as version numbering (or rather lack of) and the use of a fixed wordlist. Electrum has documented their reasons for why they don't support BIP 39, and those reasons are the same for Bitcoin Core.

Improve this answer
12
  • does bitcoin core use 256 bit seed in the wallet? And is this direct entropy that is used as seed or entropy is passed through some algorithm to arrive at the seed in Bitcoin Core?
    – Ugam Kamat
    Jun 8, 2019 at 9:37
  • Besides PBKDF2, what would be the main reason for its weak security? Suppose if some other hash function that outputs 512 bit numbers is used. Would it be secure then?
    – kcalvinalvin
    Jun 8, 2019 at 10:51
  • 1
    @Ugam Kamat yes, Bitcoin Core uses 256 bit seeds. It piggy backs off of the normal private key generation code.
    – Ava Chow ♦
    Jun 8, 2019 at 15:05
  • @K Calvin if another hash function were used, it may be more secure. However, as I've just edited, there are a few other issues with BIP 39.
    – Ava Chow ♦
    Jun 8, 2019 at 15:06
  • Worth noting that Electrum seed words are invertible while BIP 39 seed words are not due to the impact of one way hashes. Additionally, BIP 39 spoken language specific seed words (no internationalization of entropy is supported) can drive the synthesis of Electrum seed word but not the other way around because of BIP 39's one way hashing, i.e. Monero hardware wallets are doing this.
    – skaht
    Jun 9, 2019 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.