Why my manually generated mnemonic seed phrase is not recognised by metamask or trust wallet

Question

I created a random entropy using this code

func randomNumGenerator() []byte {

    n := 16
    randomByte := make([]byte, n)
    _, err := rand.Read(randomByte)
    if err != nil {
        panic(err)
    }

    return randomByte
}

And created a checksum

func checkSum(entropy *string) {

    data := *entropy
    checkSumLength := len(*entropy) / 32

    //Sha256 of entropy
    hash := sha256.Sum256([]byte(data))
    // hexFormat := hex.EncodeToString(hash[:])

    bitHash := byteToBit(hash[:])
    *entropy = *entropy + bitHash[0:checkSumLength]

}

And added that to the end of the entropy and divided that entropy into 11 bits equal parts and matched it with the 2048 word list and I got words

"sustain resemble shift future stone merge antique denial devote century clay chalk"

But when I use this words in trust wallet it's showing invalid seed phrase

Can anyone explain me why? I followed all BIP39 procedures correctly in my code

Answer 1

I can refer you to this implementation, method mnemonic_from_data() (from wallet-core/trezor): https://github.com/trustwallet/wallet-core/blob/master/trezor-crypto/crypto/bip39.c#L70

I haven't fully analyzed your code snippet, but most likely the checksum byte is incorrect. It is the first byte of the Sha256 hash, appended to the end.

Note that depending on the mnemonic length, some bits at the end of the mnemonic are unused, as follows:

12-words: 12*11=132 bits used, 17*8=136 bits stored, last 4 bits unused
15-words: 15*11=165     /      21*8=168,                  3 unused
18-words: 18*11=198     /      25*8=200,                  2 unused
21-words: 21*11=231     /      29*8=232,                  1 usused
24-words: 24*11=264     /      33*8=264,                  all used

Since the unused bits don't matter, simplest is to just copy the first byte of the hash, without zeroing the unused bits (note that at checking one has to mask the bits).

The correct checksum for the example you provided is:

'sustain resemble shift future stone merge antique denial devote century clay celery'
entropy: 'daf6eb172f4d6516c279d33cc4aca89280'

original (invalid):

'sustain resemble shift future stone merge antique denial devote century clay chalk' 
entropy: 'daf6eb172f4d6516c279d33cc4aca892f0'

(Note: SHA256(daf6eb172f4d6516c279d33cc4aca892) = 8e51c3...71, its first byte is '8e', but only the 4 first (high) bits are needed, hence the '80' in the last byte. '8e' would work as well.)