I'm investigating hardware cryptocurrency wallets and am trying to understand how recovery works from a technical point of view. These wallets typically provide a 24-word "recovery seed" from which the wallet can be recovered. What I'd like to understand is how the private keys for various cryptocurrencies can be recovered from this one seed, especially considering the the private keys are generated subsequent to the recovery seed.
1
-
5$\begingroup$ a.k.a. How does key generation work + how does one seed a PRNG. $\endgroup$– DannyNiuCommented Sep 14, 2021 at 3:45
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
5
High-level answer
There are many cryptographic algorithms (hashes, message authentication codes, ciphers, pseudo-random number generators...) that basically allow you to deterministically transform some arbitrary data into uniformly random data (formally, they are pseudorandom functions). So basically the 24-word seed is decoded as a byte string, which is then transformed into uniformly random data, which is then interpreted as a number, which is the private key (which is what you need to authorize transactions).
In other words, if you have the mnemonic, you can derive the private(s) key(s) used to authorize transactions.
Low-level answer
The 24-word mnemonic is converted to a 64-byte seed using PBKDF2 (a key-derivation function, originally used to derive keys from passwords). For Bitcoin this is described in BIP-39.
Note in particular that PBKDF2 does not care how the mnemonic was generated, it just receives a string of bytes. For this reason, there is nothing stopping other cryptocurrencies from deriving keys from the same mnemonic (as long as they don't use the exact same procedure, to avoid generating the exact same keys).
This seed is then used to generate a master key, from which a tree of key pairs can be generated (so that the same mnemonic can generate a large numbers of addresses / public keys). The master key is generated by feeding the seed into HMAC-SHA512 (a message authentication function, though in this case not used for authentication, just to derive random data) and obtaining two 32-byte sequences. The first one is interpreted as a number (the master private key) and the second is is the "master chain code". Finally, there is procedure to derive a child private key from a parent private key, the parent chain code and an index, also using HMAC-SHA512 in a similar way. This is described in BIP-32.
-
$\begingroup$ Heh, you got me interested in your story, posting intricate things about bitcoin without participating at bitcoin site itself. However your cryptoland.net site (link in your profile) seems down. $\endgroup$– Maarten Bodewes ♦Commented Sep 15, 2021 at 14:50
-
1$\begingroup$ @MaartenBodewes I've just recently started working with cryptocurrencies (Zcash to be precise). I fixed the link in my profile, thanks for letting me know! (That domain is no longer mine, someone made a good offer for it 🤣) $\endgroup$– ConradoCommented Sep 15, 2021 at 15:23
-
$\begingroup$ @Conrado I have the same question like OP, but I still don't understand how a client can generate new private keys without ever changing the secret pass-phrase to recover it. For instance, Exodus claims your private keys will never leave your computer, but despite creating many private keys in monthly usage, the pass-phrase will remain the same. How can this work? $\endgroup$ Commented Dec 19, 2022 at 19:36
-
1$\begingroup$ @MartinBraun Broadly speaking, it simply derives each private key from the seed concatenated with an integer which is incremented each time an address is generated. To recover the wallet, it just needs to increment the integer, concatenating with the seed and deriving the key in each iteration. It stops when it finds a bunch of addresses that haven't received transactions. This process is described in BIP-44 $\endgroup$– ConradoCommented Dec 21, 2022 at 14:13
-
1$\begingroup$ @Conrado Good to know, thanks I appreciate it. 🙏 $\endgroup$ Commented Dec 21, 2022 at 19:40