Pybitcointools uses the following code for calculating a master private key (BIP32) from a seed:

def bip32_master_key(seed, vbytes=MAINNET_PRIVATE):
    I = hmac.new(from_string_to_bytes("Bitcoin seed"), seed, hashlib.sha512).digest()
    return bip32_serialize((vbytes, 0, b'\x00'*4, 0, I[32:], I[:32]+b'\x01'))

Why - specifically - is the byte string Bitcoin seed used in the HMAC algorithm? When one considers that the byte strings Mnemonic and Electrum are used in HMAC derivations (in BIP39/quasi BIP39, respectively), the labels seem overly non-specific. I'm wondering why the byte string doesn't clarify or specify a version, eg BIP32 V0.1 seed.

None of this is criticism, to be clear! I'm trying to elucidate how these decisions were chosen and implemented, which is often very difficult without being intimately knowledgeable in RFCs, Github etc.

Perhaps this could be explained in context of how HMAC works also?

1 Answer 1


It is specified in BIP32 (https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki). The SHA512-HMAC function is reused because it is already part of the standard elsewhere, but it takes a key in addition to the data being hashed. As the key can be arbitrary, we opted to use to make sure the key derivation was Bitcoin-specific.

  • I've clarified the question. Commented Apr 16, 2015 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.