1. Initial Entropy
Generation of 128 bits of cryptographic random entropy
1. Generate 16 bytes (128 bits) of random entropy using crypto.getRandomValues()
2. Each byte is a number between 0 and 255 (8 bits)
3. Bytes are converted to hexadecimal representation (2 characters per byte)
4. Bytes are also converted to binary representation (8 bits per byte)
5. This entropy will serve as the foundation for generating the mnemonic phrase
Raw Bytes (16 bytes)
Byte Conversions
Final Result
2. Checksum
Calculating checksum from SHA256 of entropy
1. The entropy (in hex) is passed through the SHA256 function
2. The result is a 256-bit hash (64 hex characters)
3. Take the first byte of the hash (first 2 hex characters)
4. Convert this byte to binary (8 bits)
5. Keep the first bits according to ENT/32 formula (4 bits for 128 bits of entropy)
Input Data
SHA256 Calculation
Final Checksum
These 0 bits will be added to the entropy to form the data that will be used to generate the mnemonic phrase.
3. Mnemonic Phrase
Generating 12 BIP39 words from entropy + checksum
1. Entropy (128 bits) and checksum (4 bits) are combined to form 132 bits
2. These 132 bits are divided into 12 groups of 11 bits
3. Each 11-bit group represents a number between 0 and 2047
4. This number is used as an index in the BIP39 wordlist of 2048 words
5. The 12 selected words form the mnemonic phrase
Combined Bits
11-bit Groups
Final Mnemonic Phrase
This 12-word phrase allows you to recreate the wallet at any time. It must be kept secure and never shared with anyone.
4. Seed
Generating seed using PBKDF2-HMAC-SHA512
1. The mnemonic phrase is used as the password
2. The salt is composed of the word 'mnemonic' and an optional passphrase
3. PBKDF2 performs 2048 iterations of HMAC-SHA512
4. Each iteration uses the previous result as input
5. The final result is a 512-bit (64 bytes) seed
Input Parameters
Passphrase (Additional Security)
The passphrase acts as a "13th word" secret and offers several benefits:
- Protection against physical theft of the mnemonic phrase
- Creation of multiple wallets from the same mnemonic phrase
- Additional layer of security (2FA)
- Ability to create a decoy wallet under duress
Note: The same mnemonic phrase with different passphrases will generate completely different wallets.
Salt Construction
PBKDF2 Process
Final Seed
This seed will be used to generate the master key and chain code.
5. Master Key & Chain Code
Generating master key and chain code using HMAC-SHA512
1. The seed is used as input message for HMAC-SHA512
2. The HMAC key is the string 'Bitcoin seed'
3. The result is a 512-bit hash split into two parts:
- First 256 bits (32 bytes) become the master private key
- Last 256 bits become the chain code
4. The private key must be a valid number (< curve order)
5. The chain code will be used for child key derivation
Input Data
HMAC-SHA512 Calculation
Private Key Validation
The master private key must be a valid number for the secp256k1 curve:
- Must be greater than 0
- Must be less than the curve order (n)
- n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
- If invalid, start over with a new seed
Note: This validation is crucial for wallet security. An invalid private key could compromise the generation of child keys.
6. Extended Keys
BIP32 format for hierarchical deterministic structure
1. Extended keys combine multiple elements in a standardized format
2. The format allows deterministic derivation of child keys
3. Version indicates key type (private/public) and network
4. Depth indicates level in derivation tree
5. Parent fingerprint allows tracing hierarchy
6. Child number identifies position among siblings
Extended Keys Structure
Extended Private Key (xprv)
Extended Public Key (xpub)
Extended Key Versions
- xprv: 0x0488ADE4
- xpub: 0x0488B21E
- tprv: 0x04358394
- tpub: 0x043587CF
7. Multi-Network Derivation
Key derivation following BIP44 standard
1. BIP44 path is structured in 5 hierarchical levels
2. Each level has a specific meaning
3. The apostrophe (') indicates hardened derivation
4. Derivation can be normal or hardened
5. Hardened indices are calculated as index + 2³¹
BIP44 Path Structure
Derivation Types
Normal Derivation
Used for change and address levels
Hardened Derivation
Used for purpose, coin type and account levels
Note on EVM (Ethereum Virtual Machine)
Several blockchains use the EVM (Ethereum Virtual Machine) and therefore share the same address format:
EVM-compatible networks:
- Ethereum (ETH) - The original network
- BNB Smart Chain (BNB) - Optimized Ethereum fork
- Polygon (MATIC) - L2 scaling solution
- Avalanche (AVAX) - Modular blockchain
- And many others...
Note: EVM compatibility allows using the same addresses and private keys across different networks, facilitating blockchain interoperability.