Why seed from BIP39 mnemonic phrase is much longer than entropy?

Question

BIP39 converts mnemonic "zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo wrong"

to the fairly long seed "b6a6d8921942dd9806607ebc2750416b289adea669198769f2e15ed926c3aa92bf88ece232317b4ea463e84b0fcd3b53577812ee449ccc448eb45e6f544e25b6"

Good tool to play around https://iancoleman.io/bip39/

What's the point of so long seed value when the entropy value of random 12-words mnemonic is much smaller?

• 2048 words list dictionary = 2^11 => 11 bit

• 12 words * 11 bits = 132 bit

• in hex format (4 bit for character) is 132/4=33 charter long, vs 128 of seed

Answer 1

This is specified in BIP 39 itself:

To create a binary seed from the mnemonic, we use the PBKDF2 function with a mnemonic sentence (in UTF-8 NFKD) used as the password and the string "mnemonic" + passphrase (again in UTF-8 NFKD) used as the salt. The iteration count is set to 2048 and HMAC-SHA512 is used as the pseudo-random function. The length of the derived key is 512 bits (= 64 bytes).

So the seed that's used is essentially a 512-bit hash of the mnemonic, which explains why it's 512 bits long (= 128 nibbles).

The BIP doesn't explain why they do this, but I would assume that it's convenient to know that the seed will always be a certain size, regardless of how much entropy is actually used to generate it. This means, for instance, that key generation code can be written to always work on 512 bit seeds.