<p>BIP 39 is not in Bitcoin Core largely for implementation reasons and because BIP 39 is not as secure as it could be.</p>

<p>The structure of Bitcoin Core's wallet doesn't really allow for BIP 39 to be implemented. The current structure doesn't allow for 512 bit seeds as BIP 39 specifies, and adding it would require some significant changes to the wallet code. Implementing BIP 39 would also require implementation of PBKDF2, although that isn't very hard.</p>

<p>Also, more generally, many Bitcoin Core contributors don't consider BIP 39 to be secure. It uses PBKDF2 which is generally regarded to be a fairly weak KDF so it isn't considered to be good for the secure storage of all of your Bitcoin. Some software (such as Electrum) used BIP 39 in the past but have switched to using their own mnemonic algorithm because of this weakness in BIP 39.</p>

<p>BIP 39 mnemonics have some other issues as well such as version numbering (or rather lack of) and the use of a fixed wordlist. Electrum has <a href="https://electrum.readthedocs.io/en/latest/seedphrase.html#motivation" rel="noreferrer">documented</a> their reasons for why they don't support BIP 39, and those reasons are the same for Bitcoin Core.</p>

CC BY-SA 4.0
2019-10-23T06:30:50.460Z
As far as I know, key stretching mainly servers the purpose of enhancing human-generated passwords,which is not the case for BIP39 mnemonic words (except the passphrase), since the words are randomly generated. Even the key stretching issue is taken into consideration (which is only useful to enhance the passphrase), isn't it possible to improve it? Since it's still possible to fix this problem, I don't see why key stretching could be a main reason not to use BIP39 or similar protocol.
Chris Chen
CC BY-SA 4.0
2019-10-23T06:36:47.720Z
In other words, I wonder if the "mnemonic words" considered the correct direction of evolving by the developers at all?
Chris Chen
CC BY-SA 4.0
2019-10-23T06:40:54.533Z
Electrum only switched from BIP39 to their own mnemonic format - they didn't give up on this direction. According to my experience of using Electrum, the lack of version numbering is almostly relieved by providing choices (of three different address types) to the user.
Chris Chen
CC BY-SA 4.0
2019-10-23T06:57:27.397Z
IMHO, I suspect that the difficulty of coordination/seeking consensus among various projects is the main problem of BIP32/39/44 protocol. However, the incompatibility of mnemonic words seems to push the users back to handling WIF private keys, which seems to be far worse than adopting BIP32/39/44.
Chris Chen
CC BY-SA 4.0
2019-12-14T16:52:01.083Z
@skaht I checked the docs of Electrum: "In order to eliminate the dependency on a fixed wordlist, the master private key and the version number are both obtained by hashes of the UTF8 normalized seed phrase" - Electrum also hashes the mnemonic words to generate the seed, which is not "invertible". Also, I didn't understand what you meant. What's "drive the synthesis of Electrum seed word"? What's "the other way around"? What "are Monero hardware wallets doing"?
Chris Chen
CC BY-SA 4.0
2019-12-14T19:42:50.550Z
@Chris-Chen, see https://monero.stackexchange.com/questions/9815/support-for-a-ledger-nano-s-recovery-plan-b/10922#10922 for how BIP 39 seed words and bx can mimic the behaviors of Monero on a Ledger Nano S or Nano X.  Details are provided for what the Trezor Model T is doing, not interoperable with Ledger devices. Concerning invertibility, go to https://github.com/skaht/XMR and look at the `./secret_key_to_public_key` and `./bytes_to_words` examples. With BIP 39 SHA512 hashing, one can't go backwards backwards.  Good hashing functions are like entering into the event horizon of a black hole.
skaht
CC BY-SA 4.0
2019-12-14T19:49:27.343Z
@Chris-Chen, the use of BIP 39 seed words is superior and substantially more capable the WIF private keys.  BIP 39 HD wallets can support numerous decentralized accounts (essentially mathematically firewalled, *speaking as an engineer*) and provide multi-currency support.
skaht
CC BY-SA 4.0
2019-06-08T09:37:18.180Z
does bitcoin core use 256 bit seed in the wallet? And is this direct entropy that is used as seed or entropy is passed through some algorithm to arrive at the seed in Bitcoin Core?
Ugam Kamat
CC BY-SA 4.0
2019-06-08T10:51:30.683Z
Besides PBKDF2, what would be the main reason for its weak security? Suppose if some other hash function that outputs 512 bit numbers is used. Would it be secure then?
kcalvinalvin
CC BY-SA 4.0
2019-06-08T15:05:51.580Z
@Ugam Kamat yes, Bitcoin Core uses 256 bit seeds. It piggy backs off of the normal private key generation code.
Ava Chow
CC BY-SA 4.0
2019-06-08T15:06:43.367Z
@K Calvin if another hash function were used, it may be more secure. However, as I've just edited, there are a few other issues with BIP 39.
Ava Chow
CC BY-SA 4.0
2019-06-09T19:47:36.667Z
Worth noting that Electrum seed words are invertible while BIP 39 seed words are not due to the impact of one way hashes. Additionally, BIP 39 spoken language specific seed words (no internationalization of entropy is supported) can drive the synthesis of Electrum seed word but not the other way around because of BIP 39's one way hashing, i.e. Monero hardware wallets are doing this.
skaht
CC BY-SA 4.0
2019-06-08T08:46:45.310Z
2019-06-08T15:04:58.277Z
2019-06-08T15:04:58.277Z
Ava Chow
<p>Is there a specific reason to why BIP39 isn't added to Bitcoin Core? Seems very trivial to add and am confused to why it isn't there.</p>

CC BY-SA 4.0
2019-06-07T20:49:10.233Z
Good question.  I thought there might be a [github issue](https://github.com/bitcoin/bitcoin/issues) suggesting this, which might contain some explanation, but I couldn't find one.
Nate Eldredge
CC BY-SA 4.0
2019-06-08T00:42:58.217Z
@NateEldredge It is discussed in https://github.com/bitcoin/bitcoin/pull/6265
Raghav Sood
CC BY-SA 4.0
2019-06-08T02:07:22.443Z
@RaghavSood: Thanks.  As far as I can tell, the summary seems to be "people might be tempted to make up their own mnemonic phrases, instead of randomly generating them, and that would be bad because they'd be susceptible to brute force".
Nate Eldredge
CC BY-SA 4.0
2019-06-08T02:31:15.790Z
BIPs 32/39/44 is already native to other Bitcoin frameworks, e.g., https://github.com/libbitcoin/libbitcoin-explorer/wiki/bx-mnemonic-to-seed.
skaht
CC BY-SA 4.0
2019-06-08T04:15:34.987Z
@NateEldredge I got the same feeling from it, but the discussion is quite old, and possibly involves some misunderstanding - BIP39 in its current form already includes checksums, and it would generally be quite hard to create an insecure mnemonic, barring bad raw entropy (which would affect the current BIP32 seed in Bitcoin Core equally, since it would be the same entropy)
Raghav Sood
CC BY-SA 4.0
2019-06-08T04:23:48.503Z
Well, the checksum for a 128-bit seed is only 4 bits, so you have a 1 in 16 chance of passing on the first try, and otherwise you can just change a couple of the words until you do.  It appears the checksum feature was part of the BIP 39 proposal from its earliest days, at least since [September 2013](https://en.bitcoin.it/w/index.php?title=BIP_0039&direction=next&oldid=37506), so it's not a recent innovation.
Nate Eldredge
CC BY-SA 4.0
2019-06-08T04:26:15.647Z
As an illustration, it only took about a minute of random guessing to come up with the valid BIP 39 phrase `baby baby baby baby baby baby baby baby baby baby baby zebra`.
Nate Eldredge
CC BY-SA 4.0
2019-06-08T06:16:06.597Z
@NateEldredge If what you say is correct, that doesn't seem like a valid reason for not adding support for it. I mean no one stopping anyone from hashing a simple passphrase for their entropy. Seems like a very weak argument at best.
kcalvinalvin
CC BY-SA 4.0
2019-06-08T06:19:01.193Z
I suppose you could open an issue on github requesting that it be implemented, and see how the developers respond.
Nate Eldredge
CC BY-SA 4.0
2019-06-08T06:19:50.180Z
@NateEldredge Maybe that is the best way to go about it. Thanks for the effort though.
kcalvinalvin
<bitcoin-core><client><mnemonic-seed><bip>
Is there a reason to why Bitcoin Core does not implement BIP39?
kcalvinalvin
# Is there a reason to why Bitcoin Core does not implement BIP39?

(Asked by: username_0 on 2019-06-07)

Is there a specific reason to why BIP39 isn't added to Bitcoin Core? Seems very trivial to add and am confused to why it isn't there.

**Tags:** bitcoin-core, client, mnemonic-seed, bip

> **Comments:**
> **username_1**: Good question.  I thought there might be a [github issue](https://github.com/bitcoin/bitcoin/issues) suggesting this, which might contain some explanation, but I couldn't find one.  
> **username_2**: @username_1 It is discussed in https://github.com/bitcoin/bitcoin/pull/6265  
> **username_1**: @username_2: Thanks.  As far as I can tell, the summary seems to be "people might be tempted to make up their own mnemonic phrases, instead of randomly generating them, and that would be bad because they'd be susceptible to brute force".  
> **username_3**: BIPs 32/39/44 is already native to other Bitcoin frameworks, e.g., https://github.com/libbitcoin/libbitcoin-explorer/wiki/bx-mnemonic-to-seed.  
> **username_2**: @username_1 I got the same feeling from it, but the discussion is quite old, and possibly involves some misunderstanding - BIP39 in its current form already includes checksums, and it would generally be quite hard to create an insecure mnemonic, barring bad raw entropy (which would affect the current BIP32 seed in Bitcoin Core equally, since it would be the same entropy)  
> **username_1**: Well, the checksum for a 128-bit seed is only 4 bits, so you have a 1 in 16 chance of passing on the first try, and otherwise you can just change a couple of the words until you do.  It appears the checksum feature was part of the BIP 39 proposal from its earliest days, at least since [September 2013](https://en.bitcoin.it/w/index.php?title=BIP_0039&direction=next&oldid=37506), so it's not a recent innovation.  
> **username_1**: As an illustration, it only took about a minute of random guessing to come up with the valid BIP 39 phrase `baby baby baby baby baby baby baby baby baby baby baby zebra`.  
> **username_0**: @username_1 If what you say is correct, that doesn't seem like a valid reason for not adding support for it. I mean no one stopping anyone from hashing a simple passphrase for their entropy. Seems like a very weak argument at best.  
> **username_1**: I suppose you could open an issue on github requesting that it be implemented, and see how the developers respond.  
> **username_0**: @username_1 Maybe that is the best way to go about it. Thanks for the effort though.  

---

## 1 answers

### Answer by username_4 on 2019-06-08. Score: 20 | Accepted answer

BIP 39 is not in Bitcoin Core largely for implementation reasons and because BIP 39 is not as secure as it could be.

The structure of Bitcoin Core's wallet doesn't really allow for BIP 39 to be implemented. The current structure doesn't allow for 512 bit seeds as BIP 39 specifies, and adding it would require some significant changes to the wallet code. Implementing BIP 39 would also require implementation of PBKDF2, although that isn't very hard.

Also, more generally, many Bitcoin Core contributors don't consider BIP 39 to be secure. It uses PBKDF2 which is generally regarded to be a fairly weak KDF so it isn't considered to be good for the secure storage of all of your Bitcoin. Some software (such as Electrum) used BIP 39 in the past but have switched to using their own mnemonic algorithm because of this weakness in BIP 39.

BIP 39 mnemonics have some other issues as well such as version numbering (or rather lack of) and the use of a fixed wordlist. Electrum has [documented](https://electrum.readthedocs.io/en/latest/seedphrase.html#motivation) their reasons for why they don't support BIP 39, and those reasons are the same for Bitcoin Core.

> **Comments:**
> **username_6**: does bitcoin core use 256 bit seed in the wallet? And is this direct entropy that is used as seed or entropy is passed through some algorithm to arrive at the seed in Bitcoin Core?  
> **username_0**: Besides PBKDF2, what would be the main reason for its weak security? Suppose if some other hash function that outputs 512 bit numbers is used. Would it be secure then?  
> **username_4**: @username_6 yes, Bitcoin Core uses 256 bit seeds. It piggy backs off of the normal private key generation code.  
> **username_4**: @K Calvin if another hash function were used, it may be more secure. However, as I've just edited, there are a few other issues with BIP 39.  
> **username_3**: Worth noting that Electrum seed words are invertible while BIP 39 seed words are not due to the impact of one way hashes. Additionally, BIP 39 spoken language specific seed words (no internationalization of entropy is supported) can drive the synthesis of Electrum seed word but not the other way around because of BIP 39's one way hashing, i.e. Monero hardware wallets are doing this.  
> **username_5**: As far as I know, key stretching mainly servers the purpose of enhancing human-generated passwords,which is not the case for BIP39 mnemonic words (except the passphrase), since the words are randomly generated. Even the key stretching issue is taken into consideration (which is only useful to enhance the passphrase), isn't it possible to improve it? Since it's still possible to fix this problem, I don't see why key stretching could be a main reason not to use BIP39 or similar protocol.  
> **username_5**: In other words, I wonder if the "mnemonic words" considered the correct direction of evolving by the developers at all?  
> **username_5**: Electrum only switched from BIP39 to their own mnemonic format - they didn't give up on this direction. According to my experience of using Electrum, the lack of version numbering is almostly relieved by providing choices (of three different address types) to the user.  
> **username_5**: IMHO, I suspect that the difficulty of coordination/seeking consensus among various projects is the main problem of BIP32/39/44 protocol. However, the incompatibility of mnemonic words seems to push the users back to handling WIF private keys, which seems to be far worse than adopting BIP32/39/44.  
> **username_5**: @username_3 I checked the docs of Electrum: "In order to eliminate the dependency on a fixed wordlist, the master private key and the version number are both obtained by hashes of the UTF8 normalized seed phrase" - Electrum also hashes the mnemonic words to generate the seed, which is not "invertible". Also, I didn't understand what you meant. What's "drive the synthesis of Electrum seed word"? What's "the other way around"? What "are Monero hardware wallets doing"?  
> **username_3**: @username_5, see https://monero.stackexchange.com/questions/9815/support-for-a-ledger-nano-s-recovery-plan-b/10922#10922 for how BIP 39 seed words and bx can mimic the behaviors of Monero on a Ledger Nano S or Nano X.  Details are provided for what the Trezor Model T is doing, not interoperable with Ledger devices. Concerning invertibility, go to https://github.com/username_3/XMR and look at the `./secret_key_to_public_key` and `./bytes_to_words` examples. With BIP 39 SHA512 hashing, one can't go backwards backwards.  Good hashing functions are like entering into the event horizon of a black hole.  
> **username_3**: @username_5, the use of BIP 39 seed words is superior and substantially more capable the WIF private keys.  BIP 39 HD wallets can support numerous decentralized accounts (essentially mathematically firewalled, *speaking as an engineer*) and provide multi-currency support.  

---

