I've followed the bip32 and bip39 specifications for generating the 512-bit seed, however I didn't understand how to generate the xpriv from this. I've used the left 256 bits for the private key and right 256 bits for the chain code, however my private key bytes and chaincode differs from the test vector:

Using 512-bit seed: "d71de856f81a8acc65e6fc851a38d4d7ec216fd0796d0a6827a3ad6ed5511a30fa280f12eb2e47ed2ac03b5c462a0358d18d69fe4f985ec81778c1b370b652a8"

Desired Master Private Key bytes: "2fd0c70b975d9a38f84fba956ed795075fe43a85a45336143fe855551f1356db"
Desired Chaincode: "51fd417898af090d1a4dc040f4427a7e6a4ad5fd4024ace7f068a167861e8655"
Desired Xpriv: "xprv9s21ZrQH143K2shfP28KM3nr5Ap1SXjz8gc2rAqqMEynmjt6o1qboCDpxckqXavCwdnYds6yBHZGKHv7ef2eTXy461PXUjBFQg6PrwY4Gzq"

How do I obtain these values using the left 256 bits for the pk, and the right 256 bits for the chaincode?


  • Which test vectors exactly does this test case come from? Commented Dec 3, 2021 at 20:00
  • github.com/trezor/python-mnemonic/blob/master/vectors.json (test 3) I obtained the seed and words from the entropy, then derived the chaincode and seed using Nbitcoin
    – Chiru
    Commented Dec 3, 2021 at 20:10
  • My question was basically, how to use the seed to get the master key bytes and chaincode, sorry if it wasn't very clear
    – Chiru
    Commented Dec 3, 2021 at 20:12
  • You're aware that according to BIP32, you need to use HMAC-SHA512 on the seed to compute the master key (see this section: github.com/bitcoin/bips/blob/master/…) Commented Dec 3, 2021 at 20:14
  • I used HMAC-SHA512 to derive the seed from the entropy, you're saying I would need to do it again?
    – Chiru
    Commented Dec 3, 2021 at 20:16

1 Answer 1


There are two separate processes:

  • BIP39 specifies how to go from a phrase/mnemonic to a seed, using 2048 iterations of HMAC-SHA512.
  • BIP32 specifies how to go from a seed to a master key (using another single HMAC-SHA512) and then how to derive child keys from that master key.

Perhaps you were missing that the master key is distinct from the seed, and that computing the xprv from the seed thus involves yet another HMAC-SHA512 step?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.