<p>From the section <strong>From mnemonic to seed</strong>
in <a href="https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki" rel="nofollow noreferrer">BIP39</a>:</p>
<blockquote>
<p>To create a binary seed from the mnemonic, we use the PBKDF2 function with a mnemonic sentence (in UTF-8 NFKD) used as the password and the string &quot;mnemonic&quot; + passphrase (again in UTF-8 NFKD) used as the salt. The iteration count is set to 2048 and HMAC-SHA512 is used as the pseudo-random function. The length of the derived key is 512 bits (= 64 bytes)</p>
</blockquote>
<p>and from <strong>Master key generation</strong> in <a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#user-content-Master_key_generation" rel="nofollow noreferrer">BIP32</a></p>
<blockquote>
<p>The total number of possible extended keypairs is almost 2512, but the produced keys are only 256 bits long, and offer about half of that in terms of security. Therefore, master keys are not generated directly, but instead from a potentially short seed value.</p>
</blockquote>
<blockquote>
<ul>
<li>Generate a seed byte sequence S of a chosen length (between 128 and 512 bits; 256 bits is advised) from a (P)RNG.</li>
<li>Calculate I = HMAC-SHA512(Key = &quot;Bitcoin seed&quot;, Data = S)</li>
<li>Split I into two 32-byte sequences, IL and IR.</li>
<li>Use parse256(IL) as master secret key, and IR as master chain code.</li>
</ul>
</blockquote>
<p>This means that from the mnemonic (word list) you generate a 512 bit number,
half of the bits you'll use as the master private key and the other half you'll take as the chain code.</p>

CC BY-SA 4.0
2023-06-17T06:10:46.510Z
2023-06-17T06:10:46.510Z
Lepus Cyberneticus
<p>BIP-32 defines the chain code as entropy <strong>additional</strong> to the private key:</p>
<blockquote>
<p>In what follows, we will define a function that derives a number of child keys from a parent key. In order to prevent these from depending solely on the key itself, we extend both private and public keys first with an extra 256 bits of entropy. This extension, called the chain code, is identical for corresponding private and public keys, and consists of 32 bytes.</p>
</blockquote>
<p>If the chain code is additional entropy, how is it that HD wallets can be restored from seed words without the chain code entropy being explicitly provided?</p>

<bip32-hd-wallets>
How is it that HD wallets can be restored from seed words without the chain code entropy being known?
Robert Dickinson
# How is it that HD wallets can be restored from seed words without the chain code entropy being known?

(Asked by: username_0 on 2023-06-17)

BIP-32 defines the chain code as entropy **additional** to the private key:

> In what follows, we will define a function that derives a number of child keys from a parent key. In order to prevent these from depending solely on the key itself, we extend both private and public keys first with an extra 256 bits of entropy. This extension, called the chain code, is identical for corresponding private and public keys, and consists of 32 bytes.

If the chain code is additional entropy, how is it that HD wallets can be restored from seed words without the chain code entropy being explicitly provided?

**Tags:** bip32-hd-wallets


---

## 1 answers

### Answer by username_1 on 2023-06-17. Score: 3 | Accepted answer

From the section **From mnemonic to seed**
in [BIP39](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki):

> To create a binary seed from the mnemonic, we use the PBKDF2 function with a mnemonic sentence (in UTF-8 NFKD) used as the password and the string "mnemonic" + passphrase (again in UTF-8 NFKD) used as the salt. The iteration count is set to 2048 and HMAC-SHA512 is used as the pseudo-random function. The length of the derived key is 512 bits (= 64 bytes)

and from **Master key generation** in [BIP32](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#user-content-Master_key_generation)

> The total number of possible extended keypairs is almost 2512, but the produced keys are only 256 bits long, and offer about half of that in terms of security. Therefore, master keys are not generated directly, but instead from a potentially short seed value.

> * Generate a seed byte sequence S of a chosen length (between 128 and 512 bits; 256 bits is advised) from a (P)RNG.
> * Calculate I = HMAC-SHA512(Key = "Bitcoin seed", Data = S)
> * Split I into two 32-byte sequences, IL and IR.
> * Use parse256(IL) as master secret key, and IR as master chain code.

This means that from the mnemonic (word list) you generate a 512 bit number,
half of the bits you'll use as the master private key and the other half you'll take as the chain code.


---

