<p>HMAC-SHA512 is a function that can take arbitrary length input and always produce 512 bit output. So the seed that is the input to the function can be 192, 256, or 512 bits (or really any other length) and the result will always be 512 bits.</p>
<p>It should be noted that there are different methods for producing the seed, and what you are looking at is the combination of 2 different specifications. The first part that produces the seed to be HMAC'd is BIP 39. The second part which does the HMAC-SHA512 is BIP 32.</p>
<p>BIP 39 specifies that the result is always a 512 bit seed which is then fed into BIP 32. BIP 32 specifies that it can take input seeds of 192, 256, or 512 bits that it HMACs to get the master private key and chaincode.</p>
<p>Although BIP 39 is specified for usage with BIP 32, BIP 32 does not require BIP 39. BIP 32 can and is used without BIP 39. For example, Bitcoin Core uses BIP 32 to derive its keys from a seed. However this seed is generated randomly and directly given to BIP 32 without doing anything related to BIP 39. Bitcoin Core also uses a 256 bit seed.</p>

CC BY-SA 4.0
2023-10-26T02:45:48.267Z
That's right but, from my understanding it goes like this
1. Generate entropy, convert to 12 word mnemonic sentence
2. Put mnemonic sentence with string "mnemonic" and passphrase through BKDF2 with HMAC-SHA512 2048 times, you get 512 bit SEED.
3. Put SEED through HMAC-SHA512 with string "Bitcoin seed" and you get 512 bit key which you split. 
Concern is that in the book it says 128,256,512 bit SEED, which should be 512
Bob Nakamoto
CC BY-SA 4.0
2023-10-26T02:52:55.960Z
@Bob - the point Andrew is making is that the *input* to the HMAC-SHA512 function can be any length - the *output* is always 512 bits regardless of the length of the input.
Hannah Vernon
CC BY-SA 4.0
2023-10-26T02:58:35.653Z
Yeah, I understand it, I added another picture for you to understand where I am coming from
Bob Nakamoto
CC BY-SA 4.0
2023-10-26T03:00:24.040Z
@BobNakamoto I think maybe you're confused about why there can be other sized seeds? If so, I've updated my answer to address that.
Ava Chow
CC BY-SA 4.0
2023-10-26T03:11:11.307Z
So does that mean that I can either generate an entropy, convert it to mnemonic, feed into bip-39 (which is pbkdf2 2048 times), get 512 bits and then put it through bip-32 (which is just hmac sha512) and get 512 bit key and code. Or i can just put anything through bip-32 straight away without any seed and still get valid key and code? but its better to do it with both bip 32 and 39 for better security?
Bob Nakamoto
CC BY-SA 4.0
2023-10-26T03:13:49.700Z
Yes, you can generate entropy and put it straight into BIP 32 without doing BIP 39. The specs are (nominally) independent. For example, Bitcoin Core does this. It doesn't use BIP 39, but it still derives keys deterministically with BIP 32 by generating entropy and using that as the BIP 32 seed.
Ava Chow
CC BY-SA 4.0
2023-10-26T03:37:50.643Z
Ok, so does that mean that there is no bip39 wordlist in bitcoin core, just wif-private keys? or does it mean that it generates 256bit seed, puts it straight into the bip32 hashing but you can still back it up with bip39 words?
Bob Nakamoto
CC BY-SA 4.0
2023-10-26T14:30:56.537Z
Bitcoin Core does not have a BIP 39 wordlist at all. It just stores the seed, or the master private key, depending on when the wallet was created.
Ava Chow
CC BY-SA 4.0
2023-10-26T02:38:27.107Z
2023-10-26T03:16:07.270Z
2023-10-26T03:16:07.270Z
Ava Chow
<p>Please help me understand how you generate a Private key + Chaincode from entropy.</p>
<p>As I understand it, you generate entropy which should be random and can vary from 128 - 256 bits of data. You could use a coin or dice for this purpose.</p>
<p>Then you generate the checksum; in the case of 12 words it will be 4 bits, therefore 132 bits in total. Next, you take 132 bits and run it through PBKDF2 with HMAC-SHA512 2048 times with a string &quot;mnemonic&quot; + optional passphrase.</p>
<p>You receive 512 bits of data, called the Seed. Afterwards, you put the 512 bit seed through HMAC-SHA512 with &quot;Bitcoin seed&quot; and you receive 512 bits of data which is split into the private key and the chain code.</p>
<p>The part I don't understand is that some sources say you put the Seed which can be 128, 256 or 512 bits in length through the HMAC-SHA512 to get the private key and the chaincode. How is it possible if the Seed should be 512 bits in length?</p>
<p>In the picture below, it is named Root Seed.
<a href="https://i.sstatic.net/tQrdw.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/tQrdw.jpg" alt="Mastering Bitcoin" /></a></p>
<p>My understanding is that it works like this. The first picture is from Mastering Bitcoin, the other from learnmeabitcoin.com</p>
<p><a href="https://i.sstatic.net/iNNlF.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/iNNlF.jpg" alt="enter image description here" /></a></p>

<bip32-hd-wallets><address-generation><mnemonic-seed>
How is an HD Wallet Key Generated?
Bob Nakamoto
# How is an HD Wallet Key Generated?

(Asked by: username_0 on 2023-10-26)

Please help me understand how you generate a Private key + Chaincode from entropy.

As I understand it, you generate entropy which should be random and can vary from 128 - 256 bits of data. You could use a coin or dice for this purpose.

Then you generate the checksum; in the case of 12 words it will be 4 bits, therefore 132 bits in total. Next, you take 132 bits and run it through PBKDF2 with HMAC-SHA512 2048 times with a string "mnemonic" + optional passphrase.

You receive 512 bits of data, called the Seed. Afterwards, you put the 512 bit seed through HMAC-SHA512 with "Bitcoin seed" and you receive 512 bits of data which is split into the private key and the chain code.

The part I don't understand is that some sources say you put the Seed which can be 128, 256 or 512 bits in length through the HMAC-SHA512 to get the private key and the chaincode. How is it possible if the Seed should be 512 bits in length?

In the picture below, it is named Root Seed.
[![Mastering Bitcoin](https://i.sstatic.net/tQrdw.jpg)](https://i.sstatic.net/tQrdw.jpg)

My understanding is that it works like this. The first picture is from Mastering Bitcoin, the other from learnmeabitcoin.com

[![enter image description here](https://i.sstatic.net/iNNlF.jpg)](https://i.sstatic.net/iNNlF.jpg)

**Tags:** bip32-hd-wallets, address-generation, mnemonic-seed


---

## 1 answers

### Answer by username_1 on 2023-10-26. Score: 2

HMAC-SHA512 is a function that can take arbitrary length input and always produce 512 bit output. So the seed that is the input to the function can be 192, 256, or 512 bits (or really any other length) and the result will always be 512 bits.

It should be noted that there are different methods for producing the seed, and what you are looking at is the combination of 2 different specifications. The first part that produces the seed to be HMAC'd is BIP 39. The second part which does the HMAC-SHA512 is BIP 32.

BIP 39 specifies that the result is always a 512 bit seed which is then fed into BIP 32. BIP 32 specifies that it can take input seeds of 192, 256, or 512 bits that it HMACs to get the master private key and chaincode.

Although BIP 39 is specified for usage with BIP 32, BIP 32 does not require BIP 39. BIP 32 can and is used without BIP 39. For example, Bitcoin Core uses BIP 32 to derive its keys from a seed. However this seed is generated randomly and directly given to BIP 32 without doing anything related to BIP 39. Bitcoin Core also uses a 256 bit seed.

> **Comments:**
> **username_0**: That's right but, from my understanding it goes like this 1. Generate entropy, convert to 12 word mnemonic sentence 2. Put mnemonic sentence with string "mnemonic" and passphrase through BKDF2 with HMAC-SHA512 2048 times, you get 512 bit SEED. 3. Put SEED through HMAC-SHA512 with string "Bitcoin seed" and you get 512 bit key which you split.  Concern is that in the book it says 128,256,512 bit SEED, which should be 512  
> **username_2**: @Bob - the point Andrew is making is that the *input* to the HMAC-SHA512 function can be any length - the *output* is always 512 bits regardless of the length of the input.  
> **username_0**: Yeah, I understand it, I added another picture for you to understand where I am coming from  
> **username_1**: @username_0 I think maybe you're confused about why there can be other sized seeds? If so, I've updated my answer to address that.  
> **username_0**: So does that mean that I can either generate an entropy, convert it to mnemonic, feed into bip-39 (which is pbkdf2 2048 times), get 512 bits and then put it through bip-32 (which is just hmac sha512) and get 512 bit key and code. Or i can just put anything through bip-32 straight away without any seed and still get valid key and code? but its better to do it with both bip 32 and 39 for better security?  
> **username_1**: Yes, you can generate entropy and put it straight into BIP 32 without doing BIP 39. The specs are (nominally) independent. For example, Bitcoin Core does this. It doesn't use BIP 39, but it still derives keys deterministically with BIP 32 by generating entropy and using that as the BIP 32 seed.  
> **username_0**: Ok, so does that mean that there is no bip39 wordlist in bitcoin core, just wif-private keys? or does it mean that it generates 256bit seed, puts it straight into the bip32 hashing but you can still back it up with bip39 words?  
> **username_1**: Bitcoin Core does not have a BIP 39 wordlist at all. It just stores the seed, or the master private key, depending on when the wallet was created.  

---

