<p>It's actually a good question. Let's take a look at what is happening. First, Electrum hashes your mnemonic to generate a seed. The seed indeed contains all the information necessary to generate the Master Public Key and the Master Secret Key, first being used to generate the sequence of public keys (adresses) and the second being used to derive a secret key from a public key (actually it's slightly more complex). Then, Electrum saves the wallet file, which contains the seed and the keys being actually in use, the whole sequence of key pairs unless it hits 5 consecutive unused adresses. It can store it either <strong>unenrypted</strong> or <strong>encrypted</strong>. In the first case, the seed value in the file will always look the same, as will private keys. In the second case, however, they won't. Why? The Electrum documentation says:</p>

<blockquote>
  <p>Electrum uses AES-256-CBC to encrypt the seed and private keys in the wallet.</p>
</blockquote>

<p>What does it mean? AES-256 is simply a block cipher. It takes a block of data (128 bit in this case) and a block of key (256 bit) and outputs 128 bits of encrypted data. But it is <strong>not</strong> what Electrum does. <em>Actually, noone uses block ciphers like that and noone ever should. Instead, so called modes are used.</em> In our case it is Cipher Block Chaining (CBC) mode. Electrum first generates a random initialization vector (IV), mix it (by exclusive or operation) with first 128 bit of input and uses AES-256 on this mixed block to produce first encrypted block. For any subseqent block it does the same, except instead of IV it takes previous encrypted block to mix with the plaintext block. The IV is saved alongside with the file. Finally, that's why you always arrive with a different seed value in a file, even when using the same password (which results in the same key for AES-256-CBC encryption [1]) -- a different IV is used each time.</p>

<p>[1] It is not probably the case either, as Key Derivation Function is likely to be used to deliver a key from your passphrase, in which case additional random salt value is added to the passphrase before hashing it and saved alongside, similarly to the IV.</p>

CC BY-SA 3.0
2017-08-29T21:22:40.630Z
"being used to derive a secret key from a public key". If one can do that then there's not much security? Surely it's the other way around?
Squirrel
CC BY-SA 3.0
2017-09-01T07:58:46.663Z
@Squirrel Not really. One can derive any private key from it's corresponding public key with extra knowledge. It's secure as long as the user doesn't disclose this extra knowledge.
Hubert Jasieniecki
CC BY-SA 3.0
2017-09-02T11:25:47.133Z
Ah just been reading about this - 'hardened derivation' protects against this. The 'extra knowledge' your referring to is the chain code?
Squirrel
CC BY-SA 3.0
2017-10-03T08:56:29.150Z
First, sorry for the late reply, it has been a busy time for me.
No, hardened derivation is meant to protect against this "attack", but the extra knowledge is something entirely else: it's the master private key which can be effectively extracted from the master public key and any of the individual private keys.
I would happily explain this in more details if you ask a question, as it won't fit as nicely in a comment and comments doesn't allow all the math formatting. Just make sure to let me know you have asked it.
Hubert Jasieniecki
CC BY-SA 3.0
2017-02-23T00:01:41.860Z
2017-02-23T00:01:41.860Z
Hubert Jasieniecki
<p>The seed is the key that is taken to derive all your addresses deterministically. The encryption is to protect the seed <a href="https://electrum.org/faq.html#wallet-encryption" rel="nofollow">https://electrum.org/faq.html#wallet-encryption</a></p>

<p><a href="https://electrum.org/faq.html#seed" rel="nofollow">https://electrum.org/faq.html#seed</a></p>

CC BY-SA 3.0
2014-01-13T14:36:05.013Z
I read those links before asking my question...this doesn't answer the question of why the wallet file shows 2 different seeds for the same 12-word mnemonic.  It seems there is likely some entropy from the user added to some sort of salt, but I'd like some confirmation on this.
Michael McGowan
CC BY-SA 3.0
2014-01-13T21:07:53.527Z
You are plain wrong in most of the content of your question, so if you really read all content in those links then you didn't understand anything. Why would that matter if the encrypted seed doesn't match? It just matter that the seeds are the same after decrypting them, that's the way encryption works.
rdymac
CC BY-SA 3.0
2014-01-14T00:05:57.007Z
If I'm wrong about any of my assumptions then please educate me...that's why this site exists.
Michael McGowan
CC BY-SA 3.0
2014-01-14T00:10:16.227Z
As for why it matters if the encrypted seed doesn't match, it matters greatly for confirming my understanding of what information is and is not in the default_wallet file.  Seeing that they were different surprised me and made me wonder if my understanding of the file was incorrect or if perhaps there were some bug in the implementation.
Michael McGowan
CC BY-SA 3.0
2014-01-13T14:20:19.143Z
2014-01-13T21:09:38.520Z
2014-01-13T21:09:38.520Z
rdymac
<p>I was looking through an Electrum wallet file (from Electrum 1.9.6 for Windows if it matters) trying to understand what information was contained in it, and I couldn't initially figure out exactly where the private keys were stored (or even if they were perhaps stored in some other file).  I'm guessing the "seed" field in the default_wallet file contains sufficient information for the private keys, public keys, and 12 word mnemonic to be generated.  Am I right so far?</p>

<p>To experiment a bit more, I wanted to see if 2 wallet files that use the same 12 word mnemonic would be identical.  Not surprisingly, when I did not encrypt the wallets, the same mnemonic appeared to lead to identical wallet files.  However, I also tried encrypting each wallet with the same password, and to my surprise, the files had different values in the "seed" field.  This surprised me, so I'm wondering if this is expected behavior and why is this happening?</p>

CC BY-SA 3.0
2014-01-13T07:19:33.527Z
If the 12 word mnemonic produces different wallet, that makes the mnemonic useless. Are you sure you didn't mistype the words or something?
John T
CC BY-SA 3.0
2014-01-13T07:31:35.387Z
I copied and pasted and saw the same effect multiple times.  The wallets are the same in that they have the same addresses.
Michael McGowan
CC BY-SA 3.0
2014-01-13T10:50:06.110Z
Perhaps the "seed" is a salt/IV used for encryption. The transformation from passphrase to private keys needs to be deterministic, the encryption doesn't need to be.
CodesInChaos
CC BY-SA 3.0
2014-01-13T14:43:16.417Z
@CodesInChaos That's my guess, but I was hoping for someone with more familiarity with the inner workings to verify.  A very, very cursory glance at the code didn't make it obvious to me whether or not this was the case.
Michael McGowan
CC BY-SA 3.0
2014-01-13T22:57:45.633Z
Encryption almost always incorporates some random element.
David Schwartz
<wallet><private-key><electrum><thin-clients><seed>
Why can the same 12 words produce different seeds in an Electrum wallet file?
Michael McGowan
# Why can the same 12 words produce different seeds in an Electrum wallet file?

(Asked by: username_0 on 2014-01-13)

I was looking through an Electrum wallet file (from Electrum 1.9.6 for Windows if it matters) trying to understand what information was contained in it, and I couldn't initially figure out exactly where the private keys were stored (or even if they were perhaps stored in some other file). I'm guessing the "seed" field in the default\_wallet file contains sufficient information for the private keys, public keys, and 12 word mnemonic to be generated. Am I right so far?

To experiment a bit more, I wanted to see if 2 wallet files that use the same 12 word mnemonic would be identical. Not surprisingly, when I did not encrypt the wallets, the same mnemonic appeared to lead to identical wallet files. However, I also tried encrypting each wallet with the same password, and to my surprise, the files had different values in the "seed" field. This surprised me, so I'm wondering if this is expected behavior and why is this happening?

**Tags:** wallet, private-key, electrum, thin-clients, seed

> **Comments:**
> **username_1**: If the 12 word mnemonic produces different wallet, that makes the mnemonic useless. Are you sure you didn't mistype the words or something?  
> **username_0**: I copied and pasted and saw the same effect multiple times.  The wallets are the same in that they have the same addresses.  
> **username_2**: Perhaps the "seed" is a salt/IV used for encryption. The transformation from passphrase to private keys needs to be deterministic, the encryption doesn't need to be.  
> **username_0**: @username_2 That's my guess, but I was hoping for someone with more familiarity with the inner workings to verify.  A very, very cursory glance at the code didn't make it obvious to me whether or not this was the case.  
> **username_3**: Encryption almost always incorporates some random element.  

---

## 2 answers

### Answer by username_4 on 2017-02-23. Score: 4

It's actually a good question. Let's take a look at what is happening. First, Electrum hashes your mnemonic to generate a seed. The seed indeed contains all the information necessary to generate the Master Public Key and the Master Secret Key, first being used to generate the sequence of public keys (adresses) and the second being used to derive a secret key from a public key (actually it's slightly more complex). Then, Electrum saves the wallet file, which contains the seed and the keys being actually in use, the whole sequence of key pairs unless it hits 5 consecutive unused adresses. It can store it either **unenrypted** or **encrypted**. In the first case, the seed value in the file will always look the same, as will private keys. In the second case, however, they won't. Why? The Electrum documentation says:

> Electrum uses AES-256-CBC to encrypt the seed and private keys in the wallet.

What does it mean? AES-256 is simply a block cipher. It takes a block of data (128 bit in this case) and a block of key (256 bit) and outputs 128 bits of encrypted data. But it is **not** what Electrum does. *Actually, noone uses block ciphers like that and noone ever should. Instead, so called modes are used.* In our case it is Cipher Block Chaining (CBC) mode. Electrum first generates a random initialization vector (IV), mix it (by exclusive or operation) with first 128 bit of input and uses AES-256 on this mixed block to produce first encrypted block. For any subseqent block it does the same, except instead of IV it takes previous encrypted block to mix with the plaintext block. The IV is saved alongside with the file. Finally, that's why you always arrive with a different seed value in a file, even when using the same password (which results in the same key for AES-256-CBC encryption [1]) -- a different IV is used each time.

[1] It is not probably the case either, as Key Derivation Function is likely to be used to deliver a key from your passphrase, in which case additional random salt value is added to the passphrase before hashing it and saved alongside, similarly to the IV.

> **Comments:**
> **username_5**: "being used to derive a secret key from a public key". If one can do that then there's not much security? Surely it's the other way around?  
> **username_4**: @username_5 Not really. One can derive any private key from it's corresponding public key with extra knowledge. It's secure as long as the user doesn't disclose this extra knowledge.  
> **username_5**: Ah just been reading about this - 'hardened derivation' protects against this. The 'extra knowledge' your referring to is the chain code?  
> **username_4**: First, sorry for the late reply, it has been a busy time for me. No, hardened derivation is meant to protect against this "attack", but the extra knowledge is something entirely else: it's the master private key which can be effectively extracted from the master public key and any of the individual private keys. I would happily explain this in more details if you ask a question, as it won't fit as nicely in a comment and comments doesn't allow all the math formatting. Just make sure to let me know you have asked it.  

---

### Answer by username_6 on 2014-01-13. Score: -2

The seed is the key that is taken to derive all your addresses deterministically. The encryption is to protect the seed <https://electrum.org/faq.html#wallet-encryption>

<https://electrum.org/faq.html#seed>

> **Comments:**
> **username_0**: I read those links before asking my question...this doesn't answer the question of why the wallet file shows 2 different seeds for the same 12-word mnemonic.  It seems there is likely some entropy from the user added to some sort of salt, but I'd like some confirmation on this.  
> **username_6**: You are plain wrong in most of the content of your question, so if you really read all content in those links then you didn't understand anything. Why would that matter if the encrypted seed doesn't match? It just matter that the seeds are the same after decrypting them, that's the way encryption works.  
> **username_0**: If I'm wrong about any of my assumptions then please educate me...that's why this site exists.  
> **username_0**: As for why it matters if the encrypted seed doesn't match, it matters greatly for confirming my understanding of what information is and is not in the default_wallet file.  Seeing that they were different surprised me and made me wonder if my understanding of the file was incorrect or if perhaps there were some bug in the implementation.  

---

