What key derivation function uses Electrum / how generates private key?

Question

I know some brain wallets are using scrypt as the key derivation function and AFAIK scrypt is a good derivation function as it is deliberately slow and makes use of big amount of both CPU and Memory, difficulting brute force attacks.

But I couldn't find which derivation function is actually using Electrum wallet or how does it generate the private key.

Finally, how secure is to generate a wallet in Electrum style from 2048-word list compared to a brain wallet? Apparently to me, it looks like generating the key from a limited set of words would be less secure than doing it from a free-passphrase... how it really is?

Answer 1

Key derivation from seeds is standardised across wallets - Electrum specifically follows the BIP32 spec for key derivation.

Looking at the security aspect, a set of 12 words and 2048 words to choose from results in log2(2048^12) = 132 bits of entropy. If I've done my maths right, this is equivalent to a 22 character long completely random alphanumeric password.

A 256 bit bitcoin private key has 128 bits of entropy, so an electrum 12 word seed is about as secure - it is essentially impossible to crack through brute force.

Apparently to me, it looks like generating the key from a limited set of words would be less secure than doing it from a free-passphrase

I'm not sure of any wallets that use a passphrase to derive keys - usually a passphrase is used to encrypt a set of private keys, as opposed to deriving them from scratch. For example, in Bitcoin Core, the private keys are randomly generated and then the passphrase is simply used to encrypt the file storing them on disk.

The benefit of using a seed-based derivation approach (such as in Electrum) is that the seed is enough to restore all the associated private keys. Otherwise, every private key for every address would need to be backed up and kept secure.