0
$\begingroup$

I'm investigating hardware cryptocurrency wallets and am trying to understand how recovery works from a technical point of view. These wallets typically provide a 24-word "recovery seed" from which the wallet can be recovered. What I'd like to understand is how the private keys for various cryptocurrencies can be recovered from this one seed, especially considering the the private keys are generated subsequent to the recovery seed.

$\endgroup$
1
  • 5
    $\begingroup$ a.k.a. How does key generation work + how does one seed a PRNG. $\endgroup$
    – DannyNiu
    Sep 14 '21 at 3:45
4
$\begingroup$

High-level answer

There are many cryptographic algorithms (hashes, message authentication codes, ciphers, pseudo-random number generators...) that basically allow you to deterministically transform some arbitrary data into uniformly random data (formally, they are pseudorandom functions). So basically the 24-word seed is decoded as a byte string, which is then transformed into uniformly random data, which is then interpreted as a number, which is the private key (which is what you need to authorize transactions).

In other words, if you have the mnemonic, you can derive the private(s) key(s) used to authorize transactions.

Low-level answer

The 24-word mnemonic is converted to a 64-byte seed using PBKDF2 (a key-derivation function, originally used to derive keys from passwords). For Bitcoin this is described in BIP-39.

Note in particular that PBKDF2 does not care how the mnemonic was generated, it just receives a string of bytes. For this reason, there is nothing stopping other cryptocurrencies from deriving keys from the same mnemonic (as long as they don't use the exact same procedure, to avoid generating the exact same keys).

This seed is then used to generate a master key, from which a tree of key pairs can be generated (so that the same mnemonic can generate a large numbers of addresses / public keys). The master key is generated by feeding the seed into HMAC-SHA512 (a message authentication function, though in this case not used for authentication, just to derive random data) and obtaining two 32-byte sequences. The first one is interpreted as a number (the master private key) and the second is is the "master chain code". Finally, there is procedure to derive a child private key from a parent private key, the parent chain code and an index, also using HMAC-SHA512 in a similar way. This is described in BIP-32.

$\endgroup$
2
  • $\begingroup$ Heh, you got me interested in your story, posting intricate things about bitcoin without participating at bitcoin site itself. However your cryptoland.net site (link in your profile) seems down. $\endgroup$
    – Maarten Bodewes
    Sep 15 '21 at 14:50
  • 1
    $\begingroup$ @MaartenBodewes I've just recently started working with cryptocurrencies (Zcash to be precise). I fixed the link in my profile, thanks for letting me know! (That domain is no longer mine, someone made a good offer for it 🤣) $\endgroup$
    – Conrado
    Sep 15 '21 at 15:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.