<p>It is specified in BIP32 (<a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki" rel="noreferrer">https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki</a>). The SHA512-HMAC function is reused because it is already part of the standard elsewhere, but it takes a key in addition to the data being hashed. As the key can be arbitrary, we opted to use to make sure the key derivation was Bitcoin-specific.</p>

CC BY-SA 3.0
2015-04-16T13:54:32.587Z
I've clarified the question.
Wizard Of Ozzie
CC BY-SA 3.0
2015-04-16T11:30:28.917Z
2015-04-16T11:30:28.917Z
Pieter Wuille
<p><a href="http://github.com/vbuterin/pybitcointools" rel="nofollow">Pybitcointools</a> uses <a href="https://github.com/vbuterin/pybitcointools/blob/master/bitcoin/deterministic.py#L135" rel="nofollow">the following code</a> for calculating a master private key (BIP32) from a seed:</p>

<pre><code>def bip32_master_key(seed, vbytes=MAINNET_PRIVATE):
    I = hmac.new(from_string_to_bytes("Bitcoin seed"), seed, hashlib.sha512).digest()
    return bip32_serialize((vbytes, 0, b'\x00'*4, 0, I[32:], I[:32]+b'\x01'))
</code></pre>

<p>Why - specifically - is the byte string <code>Bitcoin seed</code> used in the HMAC algorithm? When one considers that the byte strings <code>Mnemonic</code> and <code>Electrum</code> are used in HMAC derivations (in BIP39/quasi BIP39, respectively), the label<strong>s</strong> seem overly non-specific. I'm wondering why the byte string doesn't clarify or specify a version, <em>eg BIP32 V0.1 seed</em>.</p>

<p>None of this is criticism, to be clear! I'm trying to elucidate how these decisions were chosen and implemented, which is often very difficult without being intimately knowledgeable in RFCs, Github etc. </p>

<p>Perhaps this could be explained in context of how HMAC works also?</p>

<cryptography><bip32-hd-wallets>
HMAC "Bitcoin Seed" for BIP32
Wizard Of Ozzie
# HMAC "Bitcoin Seed" for BIP32

(Asked by: username_0 on 2015-04-15)

[Pybitcointools](http://github.com/vbuterin/pybitcointools) uses [the following code](https://github.com/vbuterin/pybitcointools/blob/master/bitcoin/deterministic.py#L135) for calculating a master private key (BIP32) from a seed:

```
def bip32_master_key(seed, vbytes=MAINNET_PRIVATE):
    I = hmac.new(from_string_to_bytes("Bitcoin seed"), seed, hashlib.sha512).digest()
    return bip32_serialize((vbytes, 0, b'\x00'*4, 0, I[32:], I[:32]+b'\x01'))

```

Why - specifically - is the byte string `Bitcoin seed` used in the HMAC algorithm? When one considers that the byte strings `Mnemonic` and `Electrum` are used in HMAC derivations (in BIP39/quasi BIP39, respectively), the label**s** seem overly non-specific. I'm wondering why the byte string doesn't clarify or specify a version, *eg BIP32 V0.1 seed*.

None of this is criticism, to be clear! I'm trying to elucidate how these decisions were chosen and implemented, which is often very difficult without being intimately knowledgeable in RFCs, Github etc.

Perhaps this could be explained in context of how HMAC works also?

**Tags:** cryptography, bip32-hd-wallets


---

## 1 answers

### Answer by username_1 on 2015-04-16. Score: 9

It is specified in BIP32 (<https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki>). The SHA512-HMAC function is reused because it is already part of the standard elsewhere, but it takes a key in addition to the data being hashed. As the key can be arbitrary, we opted to use to make sure the key derivation was Bitcoin-specific.

> **Comments:**
> **username_0**: I've clarified the question.  

---

