<blockquote>
<p><strong>I don't know based on what algorithm I need to convert a 512 bits seed into a 256 bits private key.</strong></p>
</blockquote>
<h2>Regarding <em>algorithms</em>:</h2>
<p>BIP-0039 says:</p>
<blockquote>
<p>From mnemonic to seed</p>
<p>A user may decide to protect their mnemonic with a passphrase. If a passphrase is not present, an empty string &quot;&quot; is used instead.</p>
<p>To create a binary seed from the mnemonic, we use the PBKDF2 function with a mnemonic sentence (in UTF-8 NFKD) used as the password and the string &quot;mnemonic&quot; + passphrase (again in UTF-8 NFKD) used as the salt. The iteration count is set to 2048 and HMAC-SHA512 is used as the pseudo-random function. The length of the derived key is 512 bits (= 64 bytes).</p>
</blockquote>
<p>So the algorithms so far are described by</p>
<ul>
<li><a href="https://en.wikipedia.org/wiki/PBKDF2" rel="nofollow noreferrer">PBKDF2</a></li>
<li><a href="https://en.wikipedia.org/wiki/SHA-2" rel="nofollow noreferrer">HMAC-SHA512</a></li>
<li>Reference implementations</li>
<li>Example implementations</li>
</ul>
<p>According to the Bkitcoin Wiki entry for <a href="https://en.bitcoin.it/wiki/Private_key" rel="nofollow noreferrer">Private key</a>:</p>
<blockquote>
<p>Wallet software may use a BIP 32 seed to generate many private keys and corresponding public keys from a single secret value. This is called a hierarchical deterministic wallet, or HD wallet for short. The seed value, or master extended key, consists of a 256-bit private key and a 256-bit chain code, for 512 bits in total. The seed value should not be confused with the private keys used directly to sign Bitcoin transactions.</p>
</blockquote>
<p><a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki" rel="nofollow noreferrer">BIP-0032</a> says:</p>
<blockquote>
<p>Extended keys</p>
<p>In what follows, we will define a function that derives a number of child keys from a parent key. In order to prevent these from depending solely on the key itself, we extend both private and public keys first with an extra 256 bits of entropy. This extension, called the chain code, is identical for corresponding private and public keys, and consists of 32 bytes.</p>
<p>We represent an extended private key as (k, c), with k the normal private key, and c the chain code. An extended public key is represented as (K, c), with K = point(k) and c the chain code.</p>
</blockquote>
<p>It then goes on to describe the algorithm used.</p>
<hr />
<h2>Regarding <em>Javascript</em> Libraries</h2>
<ul>
<li><a href="https://github.com/bitcoinjs/bip39" rel="nofollow noreferrer">https://github.com/bitcoinjs/bip39</a></li>
<li><a href="https://github.com/bitcoinjs/bip32" rel="nofollow noreferrer">https://github.com/bitcoinjs/bip32</a></li>
</ul>
<hr />
<p>It seems to me that this requires a lot of digging about in documentation and source code.</p>
<p>It initially doesn't seem to be something that can be fully encompassed in the space alloted to answers in this Q&amp;A forum.</p>
<hr />

CC BY-SA 4.0
2018-11-14T12:10:42.080Z
So, based on what you say:  I should split the produced `512 bits seed` into two `256 bits` parts, use the first part as the `master private key`, and use the second part as the `chain code (entropy)`. right?
saeid ezzati
CC BY-SA 4.0
2018-11-14T12:11:26.183Z
@saeidezzati: that is how it seems to me.
RedGrittyBrick
CC BY-SA 4.0
2018-11-14T11:53:52.430Z
2018-11-14T12:02:31.673Z
2020-06-16T11:10:03.350Z
RedGrittyBrick
<p>according to <a href="https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#from-mnemonic-to-seed" rel="nofollow noreferrer">bip39</a>, I maked <code>12 mnemonic words</code> and then get a <code>512 bit seed</code> from them.</p>

<p>now I want to know how must I convert this seed to <strong>private key</strong> ?</p>

<p>what functions must I use ?</p>

<p>please introduce me libraries for <code>browser javascript</code>.</p>

<p>although I know that I must use <code>ECDSA</code> and <code>secp256k1</code>.</p>

<p>but I do not know exactly what the steps are?</p>

CC BY-SA 4.0
2018-11-13T11:11:54.987Z
What problems do you have with following the reference implementation or the Javascript implementations listed in the link you put in your question?
RedGrittyBrick
CC BY-SA 4.0
2018-11-14T10:24:23.207Z
@RedGrittyBrick My current problem is that I don't know based on what algorithm I need to convert a 512 bits seed into a 256 bits private key.
saeid ezzati
<private-key><mnemonic-seed><javascript>
generating private key from bip39 seed
saeid ezzati
# generating private key from bip39 seed

(Asked by: username_0 on 2018-11-12)

according to [bip39](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#from-mnemonic-to-seed), I maked `12 mnemonic words` and then get a `512 bit seed` from them.

now I want to know how must I convert this seed to **private key** ?

what functions must I use ?

please introduce me libraries for `browser javascript`.

although I know that I must use `ECDSA` and `secp256k1`.

but I do not know exactly what the steps are?

**Tags:** private-key, mnemonic-seed, javascript

> **Comments:**
> **username_1**: What problems do you have with following the reference implementation or the Javascript implementations listed in the link you put in your question?  
> **username_0**: @username_1 My current problem is that I don't know based on what algorithm I need to convert a 512 bits seed into a 256 bits private key.  

---

## 1 answers

### Answer by username_1 on 2018-11-14. Score: 2 | Accepted answer

> **I don't know based on what algorithm I need to convert a 512 bits seed into a 256 bits private key.**

## Regarding *algorithms*:

BIP-0039 says:

> From mnemonic to seed
>
> A user may decide to protect their mnemonic with a passphrase. If a passphrase is not present, an empty string "" is used instead.
>
> To create a binary seed from the mnemonic, we use the PBKDF2 function with a mnemonic sentence (in UTF-8 NFKD) used as the password and the string "mnemonic" + passphrase (again in UTF-8 NFKD) used as the salt. The iteration count is set to 2048 and HMAC-SHA512 is used as the pseudo-random function. The length of the derived key is 512 bits (= 64 bytes).

So the algorithms so far are described by

* [PBKDF2](https://en.wikipedia.org/wiki/PBKDF2)
* [HMAC-SHA512](https://en.wikipedia.org/wiki/SHA-2)
* Reference implementations
* Example implementations

According to the Bkitcoin Wiki entry for [Private key](https://en.bitcoin.it/wiki/Private_key):

> Wallet software may use a BIP 32 seed to generate many private keys and corresponding public keys from a single secret value. This is called a hierarchical deterministic wallet, or HD wallet for short. The seed value, or master extended key, consists of a 256-bit private key and a 256-bit chain code, for 512 bits in total. The seed value should not be confused with the private keys used directly to sign Bitcoin transactions.

[BIP-0032](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki) says:

> Extended keys
>
> In what follows, we will define a function that derives a number of child keys from a parent key. In order to prevent these from depending solely on the key itself, we extend both private and public keys first with an extra 256 bits of entropy. This extension, called the chain code, is identical for corresponding private and public keys, and consists of 32 bytes.
>
> We represent an extended private key as (k, c), with k the normal private key, and c the chain code. An extended public key is represented as (K, c), with K = point(k) and c the chain code.

It then goes on to describe the algorithm used.

---

## Regarding *Javascript* Libraries

* <https://github.com/bitcoinjs/bip39>
* <https://github.com/bitcoinjs/bip32>

---

It seems to me that this requires a lot of digging about in documentation and source code.

It initially doesn't seem to be something that can be fully encompassed in the space alloted to answers in this Q&A forum.

---

> **Comments:**
> **username_0**: So, based on what you say:  I should split the produced `512 bits seed` into two `256 bits` parts, use the first part as the `master private key`, and use the second part as the `chain code (entropy)`. right?  
> **username_1**: @username_0: that is how it seems to me.  

---

