<p>Key derivation from seeds is standardised across wallets - Electrum specifically follows the <a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki" rel="nofollow noreferrer">BIP32 spec</a> for key derivation.</p>

<p>Looking at the security aspect, a set of 12 words and 2048 words to choose from results in <code>log2(2048^12) = 132</code> bits of entropy. If I've done my maths right, this is equivalent to a 22 character long completely random alphanumeric password.</p>

<p>A 256 bit bitcoin private key has 128 bits of entropy, so an electrum 12 word seed is about as secure - it is essentially impossible to crack through brute force.</p>

<blockquote>
  <p>Apparently to me, it looks like generating the key from a limited set of words would be less secure than doing it from a free-passphrase</p>
</blockquote>

<p>I'm not sure of any wallets that use a passphrase to derive keys - usually a passphrase is used to <strong>encrypt</strong> a set of private keys, as opposed to deriving them from scratch. For example, in Bitcoin Core, the private keys are randomly generated and then the passphrase is simply used to encrypt the file storing them on disk.</p>

<p>The benefit of using a seed-based derivation approach (such as in Electrum) is that the seed is enough to restore all the associated private keys. Otherwise, every private key for every address would need to be backed up and kept secure.</p>

CC BY-SA 3.0
2018-01-04T00:15:58.883Z
I think these two are using scrypt (with salt) for key derivation: https://brainwallet.io/ and https://keybase.io/warp/
Anyway as you say an equivalnt of 22 length random password looks reasonable. It was curious to know if the slowliness and high memory requirements of scrypt was better or how BIP32 is it doing.
Gerard Bosch
CC BY-SA 3.0
2018-01-04T09:24:19.320Z
The key derivation standardisation is good for two reasons - firstly, support: you don't have to reply on some wallet provider still existing to access your coins, since every wallet uses the same thing. Also, BIP32 has been very rigorously checked and tested, knowing that it's been
mxbi
CC BY-SA 3.0
2018-01-03T23:04:06.813Z
2018-01-03T23:04:06.813Z
mxbi
<p>I know some brain wallets are using scrypt as the key derivation function and AFAIK scrypt is a good derivation function as it is deliberately slow and makes use of big amount of both CPU and Memory, difficulting brute force attacks.</p>

<p>But I couldn't find which derivation function is actually using Electrum wallet or how does it generate the private key.</p>

<p>Finally, how secure is to generate a wallet in Electrum style from 2048-word list compared to a brain wallet? Apparently to me, it looks like generating the key from a limited set of words would be less secure than doing it from a free-passphrase... how it really is?</p>

<wallet><bip32-hd-wallets>
What key derivation function uses Electrum / how generates private key?
Gerard Bosch
# What key derivation function uses Electrum / how generates private key?

(Asked by: username_0 on 2018-01-03)

I know some brain wallets are using scrypt as the key derivation function and AFAIK scrypt is a good derivation function as it is deliberately slow and makes use of big amount of both CPU and Memory, difficulting brute force attacks.

But I couldn't find which derivation function is actually using Electrum wallet or how does it generate the private key.

Finally, how secure is to generate a wallet in Electrum style from 2048-word list compared to a brain wallet? Apparently to me, it looks like generating the key from a limited set of words would be less secure than doing it from a free-passphrase... how it really is?

**Tags:** wallet, bip32-hd-wallets


---

## 1 answers

### Answer by username_1 on 2018-01-03. Score: 1 | Accepted answer

Key derivation from seeds is standardised across wallets - Electrum specifically follows the [BIP32 spec](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki) for key derivation.

Looking at the security aspect, a set of 12 words and 2048 words to choose from results in `log2(2048^12) = 132` bits of entropy. If I've done my maths right, this is equivalent to a 22 character long completely random alphanumeric password.

A 256 bit bitcoin private key has 128 bits of entropy, so an electrum 12 word seed is about as secure - it is essentially impossible to crack through brute force.

> Apparently to me, it looks like generating the key from a limited set of words would be less secure than doing it from a free-passphrase

I'm not sure of any wallets that use a passphrase to derive keys - usually a passphrase is used to **encrypt** a set of private keys, as opposed to deriving them from scratch. For example, in Bitcoin Core, the private keys are randomly generated and then the passphrase is simply used to encrypt the file storing them on disk.

The benefit of using a seed-based derivation approach (such as in Electrum) is that the seed is enough to restore all the associated private keys. Otherwise, every private key for every address would need to be backed up and kept secure.

> **Comments:**
> **username_0**: I think these two are using scrypt (with salt) for key derivation: https://brainwallet.io/ and https://keybase.io/warp/ Anyway as you say an equivalnt of 22 length random password looks reasonable. It was curious to know if the slowliness and high memory requirements of scrypt was better or how BIP32 is it doing.  
> **username_1**: The key derivation standardisation is good for two reasons - firstly, support: you don't have to reply on some wallet provider still existing to access your coins, since every wallet uses the same thing. Also, BIP32 has been very rigorously checked and tested, knowing that it's been  

---

