Please help me understand how you generate a Private key + Chaincode from entropy.

As I understand it, you generate entropy which should be random and can vary from 128 - 256 bits of data. You could use a coin or dice for this purpose.

Then you generate the checksum; in the case of 12 words it will be 4 bits, therefore 132 bits in total. Next, you take 132 bits and run it through PBKDF2 with HMAC-SHA512 2048 times with a string "mnemonic" + optional passphrase.

You receive 512 bits of data, called the Seed. Afterwards, you put the 512 bit seed through HMAC-SHA512 with "Bitcoin seed" and you receive 512 bits of data which is split into the private key and the chain code.

The part I don't understand is that some sources say you put the Seed which can be 128, 256 or 512 bits in length through the HMAC-SHA512 to get the private key and the chaincode. How is it possible if the Seed should be 512 bits in length?

In the picture below, it is named Root Seed. Mastering Bitcoin

My understanding is that it works like this. The first picture is from Mastering Bitcoin, the other from learnmeabitcoin.com

enter image description here

1 Answer 1


HMAC-SHA512 is a function that can take arbitrary length input and always produce 512 bit output. So the seed that is the input to the function can be 192, 256, or 512 bits (or really any other length) and the result will always be 512 bits.

It should be noted that there are different methods for producing the seed, and what you are looking at is the combination of 2 different specifications. The first part that produces the seed to be HMAC'd is BIP 39. The second part which does the HMAC-SHA512 is BIP 32.

BIP 39 specifies that the result is always a 512 bit seed which is then fed into BIP 32. BIP 32 specifies that it can take input seeds of 192, 256, or 512 bits that it HMACs to get the master private key and chaincode.

Although BIP 39 is specified for usage with BIP 32, BIP 32 does not require BIP 39. BIP 32 can and is used without BIP 39. For example, Bitcoin Core uses BIP 32 to derive its keys from a seed. However this seed is generated randomly and directly given to BIP 32 without doing anything related to BIP 39. Bitcoin Core also uses a 256 bit seed.

  • That's right but, from my understanding it goes like this 1. Generate entropy, convert to 12 word mnemonic sentence 2. Put mnemonic sentence with string "mnemonic" and passphrase through BKDF2 with HMAC-SHA512 2048 times, you get 512 bit SEED. 3. Put SEED through HMAC-SHA512 with string "Bitcoin seed" and you get 512 bit key which you split. Concern is that in the book it says 128,256,512 bit SEED, which should be 512 Oct 26, 2023 at 2:45
  • @Bob - the point Andrew is making is that the input to the HMAC-SHA512 function can be any length - the output is always 512 bits regardless of the length of the input.
    – Hannah Vernon
    Oct 26, 2023 at 2:52
  • Yeah, I understand it, I added another picture for you to understand where I am coming from Oct 26, 2023 at 2:58
  • @BobNakamoto I think maybe you're confused about why there can be other sized seeds? If so, I've updated my answer to address that.
    – Ava Chow
    Oct 26, 2023 at 3:00
  • So does that mean that I can either generate an entropy, convert it to mnemonic, feed into bip-39 (which is pbkdf2 2048 times), get 512 bits and then put it through bip-32 (which is just hmac sha512) and get 512 bit key and code. Or i can just put anything through bip-32 straight away without any seed and still get valid key and code? but its better to do it with both bip 32 and 39 for better security? Oct 26, 2023 at 3:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.