BIP39 converts mnemonic "zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo wrong"

to the fairly long seed "b6a6d8921942dd9806607ebc2750416b289adea669198769f2e15ed926c3aa92bf88ece232317b4ea463e84b0fcd3b53577812ee449ccc448eb45e6f544e25b6"

Good tool to play around https://iancoleman.io/bip39/

What's the point of so long seed value when the entropy value of random 12-words mnemonic is much smaller?

  • 2048 words list dictionary = 2^11 => 11 bit

  • 12 words * 11 bits = 132 bit

  • in hex format (4 bit for character) is 132/4=33 charter long, vs 128 of seed


This is specified in BIP 39 itself:

To create a binary seed from the mnemonic, we use the PBKDF2 function with a mnemonic sentence (in UTF-8 NFKD) used as the password and the string "mnemonic" + passphrase (again in UTF-8 NFKD) used as the salt. The iteration count is set to 2048 and HMAC-SHA512 is used as the pseudo-random function. The length of the derived key is 512 bits (= 64 bytes).

So the seed that's used is essentially a 512-bit hash of the mnemonic, which explains why it's 512 bits long (= 128 nibbles).

The BIP doesn't explain why they do this, but I would assume that it's convenient to know that the seed will always be a certain size, regardless of how much entropy is actually used to generate it. This means, for instance, that key generation code can be written to always work on 512 bit seeds.

| improve this answer | |
  • 1
    The need to have a constant size seed doesn't explain the use of PBKDF2 over say, SHA256/512 which are already used. My assumption would be that the PBKDF2 function was chosen so that in the event the mnemonic phrase is leaked, but is password protected, it is computationally less feasible to brute force passwords under PBKDF2. – Mark H Apr 25 '19 at 6:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.