How to generate a BIP39 mnemonic from an Ed25519 (Ed25519+libsodium, with 8 for salt, 48 for key plus 32 bytes) encrypted private key? I have an Ed25519 encrypted private key (for which I know the password). I would like to create a BIP39 mnemonic from it.

This is to import a private key generated elsewhere into a Nano Ledger S wallet. I get this is not recommended, but I am aware of the risks and want to make it an exercise.

  • 1
    $\begingroup$ This is so crypto-currency specific, I'm thinking that this does not belong here. $\endgroup$
    – schroeder
    Jul 10 '18 at 19:41

An Ed25519 private key can come in any of several typical forms—almost always either just a 32-byte or 64-byte string. Which form you have or need depends on what software or protocol you are using it with.

For, e.g., a BIP32-style hierarchical wallet, for instance, you almost certainly need the full 64-byte string encoding the PRF secret and the secret scalar. I don't know about the Nano Ledger S: if you want a specific answer about it, you'll have to point to specific documentation about the specific protocol that the Nano Ledger S implements.

If you already have an Ed25519 private key, then you can't generate a BIP39 mnemonic from it because BIP39 is a system for generating keys by way of generating mnemonics from which the keys are derived. Inventing a BIP39 mnemonic for a private key not generated from one would be an amazing feat of cryptography demonstrating an unbelievably structured preimage attack on SHA-256.

If you want to generate an Ed25519 private key by way of a mnemonic, then you could in principle use BIP39 for that. Whether the software you're using supports it, I can't say.

If all you want is a memorable representation of an Ed25519 private key or any other (say) 32-byte string, you could take a (say) 256-entry word list, and map each octet to a word, yielding a 32-word mnemonic. If 32 words is too long, you could use a 65536-entry word list and map a 32-byte string to a 16-word mnemonic. That's not BIP39, but it is a potentially memorable way you could back up an Ed25519 private key.

  • $\begingroup$ Updated question to specify better the type of Ed25519 $\endgroup$
    – Gaia
    Jul 11 '18 at 1:18
  • 1
    $\begingroup$ @Gaia I'm not really sure what you mean by ‘Ed25519+libsodium, with 8 for salt, 48 for key plus 32 bytes’, but in any case, the main point of the answer remains unchanged: BIP39 doesn't help you to make a mnemonic for an existing key; it only helps you to simultaneously generate a mnemonic and a key. $\endgroup$ Jul 11 '18 at 1:26
  • $\begingroup$ I actually don't need the seed phrase anymore (see updated question) $\endgroup$
    – Gaia
    Jul 11 '18 at 1:43
  • $\begingroup$ @Gaia OK…can you revert it to the original question, and ask a new question? This is a completely different question now—I answered ‘Can I create a BIP39 mnemonic for an existing key?’ but your question is now ‘Can I extract a BIP32 private key from an existing Ed25519 key format?’. $\endgroup$ Jul 11 '18 at 2:08
  • $\begingroup$ done. thank you for your patience. new q is at crypto.stackexchange.com/questions/60697 $\endgroup$
    – Gaia
    Jul 11 '18 at 3:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.