<p>They adopted bip39 where the seed mnemonic is <a href="https://github.com/trezor/python-mnemonic/blob/master/mnemonic/mnemonic.py#L184" rel="nofollow noreferrer">run through a key derivation function</a> to derive the seed. This is an irreversible step.</p>

CC BY-SA 4.0
2022-02-20T04:17:27.487Z
answering the wrong question, overloading the term "seed" is too common
HansBKK
CC BY-SA 3.0
2018-03-26T08:07:34.963Z
2018-03-26T08:07:34.963Z
Abdussamad
<p>Fundamental flaw here, multiple meanings of the word &quot;seed&quot;even within discussion of just BIP39.</p>
<p>The &quot;entropy&quot; is a better term for the BIP39 starting point. Then the endpoint of the process should be &quot;BIP39 numeric seed&quot;.</p>
<blockquote>
<p>&quot;Convert the entropy to a BIP39 mnemonic. Use that mnemonic plus a (technically optional but no) passphrase as the inputs to produce the BIP39 numeric seed. End of BIP39. &quot;</p>
</blockquote>
<p>is how I would tell the story.</p>
<p>Now, looking at this from *Mastering Bitcoin *</p>
<blockquote>
<p>The seed can be encoded using the mnemonic-encode command:</p>
</blockquote>
<blockquote>
<p>$ bx hd-mnemonic &lt; seed &gt; words
adore repeat vision worst especially veil inch woman cast recall dwell appreciate</p>
</blockquote>
<blockquote>
<p>The seed can then be decoded using the mnemonic-decode command:</p>
</blockquote>
<blockquote>
<p>$ bx mnemonic-decode &lt; words
eb68ee9f3df6bd4441a9feadec179ff1</p>
</blockquote>
<p>Andreas Antonopoulos is here clearly using &quot;seed&quot; to refer to the entropy. The process described does not involve hashing, or cryptographic &quot;encoding&quot;, it's just a change in representation, like going from binary to hex.</p>
<p>Except for the N/32 checksum getting added.</p>
<p>Which means an input entropy of 256 bits is entirely reversible, but the last 8 bits to get to 264 (24 words x 11 bits) is the result of the checksum process.</p>
<p>What the other answers here are referring to is not the &quot;entropy seed&quot; but the output, the &quot;BIP39 numeric seed&quot; which is indeed a one way derivation process.</p>
<p>I believe the <code>bx mnemonic-decode</code> command may have gotten removed simply because it is useless, or at least I cannot think of a use case.</p>
<p>I do not think it stopped working in the transition to BIP39. <strong>EDIT</strong> The entropy to mnemonic &quot;conversion&quot; is reversed by many tools - see <a href="https://iancoleman.app" rel="nofollow noreferrer">https://iancoleman.app</a></p>

CC BY-SA 4.0
2022-02-19T12:10:23.100Z
Yes the entropy and mnemonic "encoding" process is fully reversible http://www.petecorey.com/blog/2018/05/07/reversing-bip39-and-the-power-of-property-testing
HansBKK
CC BY-SA 4.0
2022-03-08T01:29:26.720Z
Also with https://github.com/bitcoinjs/bip39
HansBKK
CC BY-SA 4.0
2022-02-19T11:55:57.903Z
2022-02-20T04:15:33.013Z
2022-02-20T04:15:33.013Z
HansBKK
<p>A note for those reading this in the future: &quot;bx seed&quot; is completely insecure and will result in your money being stolen.  See <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39910" rel="nofollow noreferrer">CVE-2023-39910</a>, aka the &quot;Milk Sad&quot; issue:</p>
<blockquote>
<p>The use of an mt19937 Mersenne Twister PRNG restricts the internal
entropy to 32 bits regardless of settings. This allows remote
attackers to recover any wallet private keys generated from &quot;bx seed&quot;
entropy output and steal funds. (Affected users need to move funds to
a secure new cryptocurrency wallet.)</p>
</blockquote>

CC BY-SA 4.0
2023-08-10T17:07:00.363Z
2023-08-10T17:07:00.363Z
Andrew Klaassen
<p>I asked the same questions regarding the example in Mastering Bitcoin and here is the answer:</p>

<blockquote>
  <p>The old mnemonic-decode (electrum v1 mnemonics I believe) was dropped
  from libbitcoin before version3 and replaced with BIP-39 mnemonics.
  libbitcoin version4 also adds in electrum v2 mnemonics. Unlike
  electrum v1 mnemonics (which are symmetric), BIP-39 is asymmetric
  --<a href="https://github.com/libbitcoin/libbitcoin-explorer/issues/366" rel="nofollow noreferrer">https://github.com/libbitcoin/libbitcoin-explorer/issues/366</a></p>
</blockquote>

CC BY-SA 4.0
2022-02-20T04:16:55.613Z
asking the wrong question, overloading the term "seed" is too common
HansBKK
CC BY-SA 4.0
2019-01-18T08:28:23.040Z
2019-01-18T08:28:23.040Z
LIU YUE
<p>From an example in the <a href="https://github.com/libbitcoin/libbitcoin-explorer/wiki/bx-mnemonic-to-seed" rel="nofollow noreferrer">documentation</a>:</p>

<pre><code>$ bx seed | bx mnemonic-new | bx mnemonic-to-seed | bx hd-new
</code></pre>

<p><code>655a1ed2d4fef69bb314198c7327f23c
grab special regret prepare urge evidence slush lobster midnight odor wish ketchup
57bae342ae8e69eb63f17ef993a90a59159e0f78114b602bf0ebabfec0e5d086e883c31975bf03f8a47a32853452623094d1303fd0549745db457145e5756582
xprv9s21ZrQH143K43CUCgNp5SmXzg2axQx2P4WupA2zEnKpFM19QfqfdqfpJR3yfzAXZnsHeUaQhWQMwyuqL8DbdeLeCbdMoKNn6pCY4RUn2pK</code></p>

<p>In Mastering Bitcoin, the example given <a href="https://github.com/bitcoinbook/bitcoinbook/blob/develop/appdx-bx.asciidoc" rel="nofollow noreferrer">here</a> shows it going back to the seed that was originally created; this was done using an older version of bx though. Can someone explain how the seeds from line 1 and line 3 in the example are encoded/related?</p>

CC BY-SA 4.0
2023-08-17T07:18:27.787Z
Warning: `bx seed` generates insecure seeds from [a pseudorandom number generator and very low entropy.](https://milksad.info)
Zenul_Abidin
<seed><mnemonic-seed>
Why are the seeds different when going from seed to mnemonic and back using bx?
Kevin
# Why are the seeds different when going from seed to mnemonic and back using bx?

(Asked by: username_0 on 2018-03-26)

From an example in the [documentation](https://github.com/libbitcoin/libbitcoin-explorer/wiki/bx-mnemonic-to-seed):

```
$ bx seed | bx mnemonic-new | bx mnemonic-to-seed | bx hd-new

```

`655a1ed2d4fef69bb314198c7327f23c
grab special regret prepare urge evidence slush lobster midnight odor wish ketchup
57bae342ae8e69eb63f17ef993a90a59159e0f78114b602bf0ebabfec0e5d086e883c31975bf03f8a47a32853452623094d1303fd0549745db457145e5756582
xprv9s21ZrQH143K43CUCgNp5SmXzg2axQx2P4WupA2zEnKpFM19QfqfdqfpJR3yfzAXZnsHeUaQhWQMwyuqL8DbdeLeCbdMoKNn6pCY4RUn2pK`

In Mastering Bitcoin, the example given [here](https://github.com/bitcoinbook/bitcoinbook/blob/develop/appdx-bx.asciidoc) shows it going back to the seed that was originally created; this was done using an older version of bx though. Can someone explain how the seeds from line 1 and line 3 in the example are encoded/related?

**Tags:** seed, mnemonic-seed

> **Comments:**
> **username_1**: Warning: `bx seed` generates insecure seeds from [a pseudorandom number generator and very low entropy.](https://milksad.info)  

---

## 4 answers

### Answer by username_2 on 2018-03-26. Score: 1 | Accepted answer

They adopted bip39 where the seed mnemonic is [run through a key derivation function](https://github.com/trezor/python-mnemonic/blob/master/mnemonic/mnemonic.py#L184) to derive the seed. This is an irreversible step.

> **Comments:**
> **username_3**: answering the wrong question, overloading the term "seed" is too common  

---

### Answer by username_3 on 2022-02-19. Score: 1

Fundamental flaw here, multiple meanings of the word "seed"even within discussion of just BIP39.

The "entropy" is a better term for the BIP39 starting point. Then the endpoint of the process should be "BIP39 numeric seed".

> "Convert the entropy to a BIP39 mnemonic. Use that mnemonic plus a (technically optional but no) passphrase as the inputs to produce the BIP39 numeric seed. End of BIP39. "

is how I would tell the story.

Now, looking at this from \*Mastering Bitcoin \*

> The seed can be encoded using the mnemonic-encode command:

> $ bx hd-mnemonic < seed > words
> adore repeat vision worst especially veil inch woman cast recall dwell appreciate

> The seed can then be decoded using the mnemonic-decode command:

> $ bx mnemonic-decode < words
> eb68ee9f3df6bd4441a9feadec179ff1

Andreas Antonopoulos is here clearly using "seed" to refer to the entropy. The process described does not involve hashing, or cryptographic "encoding", it's just a change in representation, like going from binary to hex.

Except for the N/32 checksum getting added.

Which means an input entropy of 256 bits is entirely reversible, but the last 8 bits to get to 264 (24 words x 11 bits) is the result of the checksum process.

What the other answers here are referring to is not the "entropy seed" but the output, the "BIP39 numeric seed" which is indeed a one way derivation process.

I believe the `bx mnemonic-decode` command may have gotten removed simply because it is useless, or at least I cannot think of a use case.

I do not think it stopped working in the transition to BIP39. **EDIT** The entropy to mnemonic "conversion" is reversed by many tools - see <https://iancoleman.app>

> **Comments:**
> **username_3**: Yes the entropy and mnemonic "encoding" process is fully reversible http://www.petecorey.com/blog/2018/05/07/reversing-bip39-and-the-power-of-property-testing  
> **username_3**: Also with https://github.com/bitcoinjs/bip39  

---

### Answer by username_4 on 2023-08-10. Score: 1

A note for those reading this in the future: "bx seed" is completely insecure and will result in your money being stolen. See [CVE-2023-39910](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39910), aka the "Milk Sad" issue:

> The use of an mt19937 Mersenne Twister PRNG restricts the internal
> entropy to 32 bits regardless of settings. This allows remote
> attackers to recover any wallet private keys generated from "bx seed"
> entropy output and steal funds. (Affected users need to move funds to
> a secure new cryptocurrency wallet.)


---

### Answer by username_5 on 2019-01-18. Score: 0

I asked the same questions regarding the example in Mastering Bitcoin and here is the answer:

> The old mnemonic-decode (electrum v1 mnemonics I believe) was dropped
> from libbitcoin before version3 and replaced with BIP-39 mnemonics.
> libbitcoin version4 also adds in electrum v2 mnemonics. Unlike
> electrum v1 mnemonics (which are symmetric), BIP-39 is asymmetric
> --<https://github.com/libbitcoin/libbitcoin-explorer/issues/366>

> **Comments:**
> **username_3**: asking the wrong question, overloading the term "seed" is too common  

---

