From 8d639fd794d196446dd0cbf190d56f347dbee1c4 Mon Sep 17 00:00:00 2001
From: slush0 <slush@satoshilabs.com>
Date: Thu, 9 Jan 2014 19:31:22 +0100
Subject: PBKDF2 uses 2048 rounds

---
 bip-0039.mediawiki | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'bip-0039.mediawiki')

diff --git a/bip-0039.mediawiki b/bip-0039.mediawiki
index 679572b..aa2c0b3 100644
--- a/bip-0039.mediawiki
+++ b/bip-0039.mediawiki
@@ -84,7 +84,7 @@ an empty string "" is used instead.
 
 To create binary seed from mnemonic, we use PBKDF2 function with mnemonic sentence
 (in UTF-8) used as a password and string "mnemonic" + passphrase (again in UTF-8)
-used as a salt. Iteration count is set to 4096 and HMAC-SHA512 is used as a pseudo-
+used as a salt. Iteration count is set to 2048 and HMAC-SHA512 is used as a pseudo-
 random function. Desired length of the derived key is 512 bits (= 64 bytes).
 
 This seed can be later used to generate deterministic wallets using BIP-0032 or
-- 
cgit v1.2.3


From 8f8044b12db7af31c0250e8d74c26a742b965428 Mon Sep 17 00:00:00 2001
From: Sean Bowe <ewillbefull@gmail.com>
Date: Mon, 20 Jan 2014 12:21:43 -0700
Subject: Restructured, fixed some grammar/spelling errors.

---
 bip-0039.mediawiki | 76 +++++++++++++++++++++++++++---------------------------
 1 file changed, 38 insertions(+), 38 deletions(-)

(limited to 'bip-0039.mediawiki')

diff --git a/bip-0039.mediawiki b/bip-0039.mediawiki
index aa2c0b3..77da086 100644
--- a/bip-0039.mediawiki
+++ b/bip-0039.mediawiki
@@ -5,6 +5,7 @@
            Pavol Rusnak <stick@satoshilabs.com>
            ThomasV <thomasv@bitcointalk.org>
            Aaron Voisine <voisine@gmail.com>
+           Sean Bowe <ewillbefull@gmail.com>
   Status:  Draft
   Type:    Standards Track
   Created: 10-09-2013
@@ -12,35 +13,36 @@
 
 ==Abstract==
 
-This BIP describes an usage of mnemonic code or mnemonic sentence - a group of
-easy to remember words - to generate deterministic wallets.
+This BIP describes the implementation of a mnemonic code or mnemonic sentence --
+a group of easy to remember words -- for the generation of deterministic wallets.
 
-It consists of two parts: generating the mnemonic and converting it into
-a binary seed. This seed can be later used to generate deterministic wallets
-using BIP-0032 or similar methods.
+It consists of two parts: generating the mnenomic, and converting it into a
+binary seed. This seed can be later used to generate deterministic wallets using
+BIP-0032 or similar methods.
 
 ==Motivation==
 
-Such mnemonic code or mnemonic sentence is much easier to work with than working
-with the binary data directly (or its hexadecimal interpretation). The sentence
-could be writen down on paper (e.g. for storing in a secure location such as
-safe), told over telephone or other voice communication method, or memorized
-in ones memory (this method is called brainwallet).
+A mnenomic code or sentence is superior for human interaction compared to the
+handling of raw binary or hexidecimal representations of a wallet seed. The
+sentence could be written on paper, spoken over the telephone, or memorized as a
+brain wallet.
 
 ==Generating the mnemonic==
 
-First, we decide how much entropy we want mnemonic to encode. Recommended size
-is 128-256 bits, but basically any multiple of 32 bits will do. More bits
-mean more security, but also longer word sentence.
+The mnemonic must encode entropy in any multiple of 32 bits. With larger entropy
+security is improved but the sentence length increases. We can refer to the
+initial entropy length as ENT. The recommended size of ENT is 128-256 bits.
 
-We take initial entropy of ENT bits and compute its checksum by taking first
-ENT / 32 bits of its SHA256 hash. We append these bits to the end of the initial
-entropy. Next we take these concatenated bits and split them into groups of 11
-bits. Each group encodes number from 0-2047 which is a position in a wordlist.
-We convert numbers into words and use joined words as mnemonic sentence.
+First, an initial entropy of ENT bits is generated. A checksum is generated by
+taking the first <pre>ENT / 32</pre> bits of its SHA256 hash. This checksum is
+appended to the end of the initial entropy. Next, these concatenated bits are
+are split into groups of 11 bits, each encoding a number from 0-2047, serving
+as an index to a wordlist. Later, we will convert these numbers into words and
+use the joined words as a mnemonic sentence.
 
-The following table describes the relation between initial entropy length (ENT),
-checksum length (CS) and length of the generated mnemonic sentence (MS) in words.
+The following table describes the relation between the initial entropy
+length (ENT), the checksum length (CS) and length of the generated mnemonic
+sentence (MS) in words.
 
 <pre>
 CS = ENT / 32
@@ -57,46 +59,44 @@ MS = (ENT + CS) / 11
 
 ==Wordlist==
 
-In previous section we described how to pick words from a wordlist. Now we
-describe how does a good wordlist look like.
+An ideal wordlist has the following characteristics:
 
 a) smart selection of words
-   - wordlist is created in such way that it's enough to type just first four
+   - wordlist is created in such way that it's enough to type the first four
      letters to unambiguously identify the word
 
 b) similar words avoided
-   - words as "build" and "built", "woman" and "women" or "quick" or "quickly"
+   - word pairs like "build" and "built", "woman" and "women", or "quick" and "quickly"
      not only make remembering the sentence difficult, but are also more error
-     prone and more difficult to guess (see point below)
-   - we avoid these words by carefully selecting them during addition
+     prone and more difficult to guess
 
 c) sorted wordlists
-   - wordlist is sorted which allow more efficient lookup of the code words
+   - wordlist is sorted which allows for more efficient lookup of the code words
      (i.e. implementation can use binary search instead of linear search)
    - this also allows trie (prefix tree) to be used, e.g. for better compression
 
-Wordlist can contain native characters, but they have to be encoded using UTF-8.
+The wordlist can contain native characters, but they have to be encoded using UTF-8.
 
 ==From mnemonic to seed==
 
-User can decide to protect his mnemonic by passphrase. If passphrase is not present
-an empty string "" is used instead.
+A user may decide to protect their mnemonic by passphrase. If a passphrase is not
+present, an empty string "" is used instead.
 
-To create binary seed from mnemonic, we use PBKDF2 function with mnemonic sentence
-(in UTF-8) used as a password and string "mnemonic" + passphrase (again in UTF-8)
-used as a salt. Iteration count is set to 2048 and HMAC-SHA512 is used as a pseudo-
-random function. Desired length of the derived key is 512 bits (= 64 bytes).
+To create a binary seed from the mnemonic, we use PBKDF2 function with a mnemonic
+sentence (in UTF-8) used as a password and string "mnemonic" + passphrase (again
+in UTF-8) used as a salt. Iteration count is set to 2048 and HMAC-SHA512 is used as
+a pseudo-random function. Desired length of the derived key is 512 bits (= 64 bytes).
 
 This seed can be later used to generate deterministic wallets using BIP-0032 or
 similar methods.
 
 The conversion of the mnemonic sentence to binary seed is completely independent
-from generating the sentence. This results in rather simple code, there are no
+from generating the sentence. This results in rather simple code; there are no
 constraints on sentence structure and clients are free to implement their own
-wordlists or even whole sentence generators (they'll lose the proposed method
-for typo detection in that case, but they can come up with their own).
+wordlists or even whole sentence generators, allowing for flexibility in wordlists
+for typo detection or other purposes.
 
-Described method also provides plausable deniability, because every passphrase
+Described method also provides plausible deniability, because every passphrase
 generates a valid seed (and thus deterministic wallet) but only the correct one
 will make the desired wallet available.
 
-- 
cgit v1.2.3


From 78eaa26d9a80f69b17c9e97af079326f710c84d4 Mon Sep 17 00:00:00 2001
From: slush0 <slush@satoshilabs.com>
Date: Fri, 7 Feb 2014 12:41:26 +0100
Subject: Draft -> Accepted

---
 bip-0039.mediawiki | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'bip-0039.mediawiki')

diff --git a/bip-0039.mediawiki b/bip-0039.mediawiki
index 77da086..526072e 100644
--- a/bip-0039.mediawiki
+++ b/bip-0039.mediawiki
@@ -6,7 +6,7 @@
            ThomasV <thomasv@bitcointalk.org>
            Aaron Voisine <voisine@gmail.com>
            Sean Bowe <ewillbefull@gmail.com>
-  Status:  Draft
+  Status:  Accepted
   Type:    Standards Track
   Created: 10-09-2013
 </pre>
-- 
cgit v1.2.3


From ce1862ac6bcffa1dd20aad858380e51e66e949ea Mon Sep 17 00:00:00 2001
From: slush0 <slush@satoshilabs.com>
Date: Fri, 7 Feb 2014 20:43:04 +0100
Subject: Added bip39 english wordlist

---
 bip-0039.mediawiki | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'bip-0039.mediawiki')

diff --git a/bip-0039.mediawiki b/bip-0039.mediawiki
index 526072e..a4ae71d 100644
--- a/bip-0039.mediawiki
+++ b/bip-0039.mediawiki
@@ -100,6 +100,10 @@ Described method also provides plausible deniability, because every passphrase
 generates a valid seed (and thus deterministic wallet) but only the correct one
 will make the desired wallet available.
 
+==Wordlists==
+
+* [[bip-0039/english.txt|English]]
+
 ==Test vectors==
 
 See https://github.com/trezor/python-mnemonic/blob/master/vectors.json
-- 
cgit v1.2.3


From 6a3bb51e3fa158e37c739702da3fa64119f55396 Mon Sep 17 00:00:00 2001
From: slush0 <slush@satoshilabs.com>
Date: Fri, 7 Feb 2014 20:57:43 +0100
Subject: Removed reference to brainwallet

---
 bip-0039.mediawiki | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

(limited to 'bip-0039.mediawiki')

diff --git a/bip-0039.mediawiki b/bip-0039.mediawiki
index a4ae71d..6fbff6b 100644
--- a/bip-0039.mediawiki
+++ b/bip-0039.mediawiki
@@ -24,8 +24,11 @@ BIP-0032 or similar methods.
 
 A mnenomic code or sentence is superior for human interaction compared to the
 handling of raw binary or hexidecimal representations of a wallet seed. The
-sentence could be written on paper, spoken over the telephone, or memorized as a
-brain wallet.
+sentence could be written on paper or spoken over the telephone.
+
+This guide meant to be as a way to transport computer-generated randomnes over
+human readable transcription. It's not a way how to process user-created
+sentences (also known as brainwallet) to wallet seed.
 
 ==Generating the mnemonic==
 
@@ -96,6 +99,11 @@ constraints on sentence structure and clients are free to implement their own
 wordlists or even whole sentence generators, allowing for flexibility in wordlists
 for typo detection or other purposes.
 
+Although using mnemonic not generated by algorithm described in "Generating the
+mnemonic" section is possible, this is not advised and software should compute
+checksum of the mnemonic sentence using wordlist and issue a warning if it is
+invalid.
+
 Described method also provides plausible deniability, because every passphrase
 generates a valid seed (and thus deterministic wallet) but only the correct one
 will make the desired wallet available.
-- 
cgit v1.2.3


From 041f51c2fffcee067b5fe61f544d686e0f2b0ecb Mon Sep 17 00:00:00 2001
From: slush0 <slush@satoshilabs.com>
Date: Fri, 7 Feb 2014 21:01:10 +0100
Subject: Usage of UTF-8 NFKD

---
 bip-0039.mediawiki | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

(limited to 'bip-0039.mediawiki')

diff --git a/bip-0039.mediawiki b/bip-0039.mediawiki
index 6fbff6b..a7a56c3 100644
--- a/bip-0039.mediawiki
+++ b/bip-0039.mediawiki
@@ -78,7 +78,8 @@ c) sorted wordlists
      (i.e. implementation can use binary search instead of linear search)
    - this also allows trie (prefix tree) to be used, e.g. for better compression
 
-The wordlist can contain native characters, but they have to be encoded using UTF-8.
+The wordlist can contain native characters, but they have to be encoded in UTF-8
+using Normalization Form Compatibility Decomposition (NFKD).
 
 ==From mnemonic to seed==
 
@@ -86,8 +87,8 @@ A user may decide to protect their mnemonic by passphrase. If a passphrase is no
 present, an empty string "" is used instead.
 
 To create a binary seed from the mnemonic, we use PBKDF2 function with a mnemonic
-sentence (in UTF-8) used as a password and string "mnemonic" + passphrase (again
-in UTF-8) used as a salt. Iteration count is set to 2048 and HMAC-SHA512 is used as
+sentence (in UTF-8 NFKD) used as a password and string "mnemonic" + passphrase (again
+in UTF-8 NFKD) used as a salt. Iteration count is set to 2048 and HMAC-SHA512 is used as
 a pseudo-random function. Desired length of the derived key is 512 bits (= 64 bytes).
 
 This seed can be later used to generate deterministic wallets using BIP-0032 or
-- 
cgit v1.2.3


From 6da6c402183fe75c39e1c0c1e7f22f7f6c2168d9 Mon Sep 17 00:00:00 2001
From: slush0 <slush@satoshilabs.com>
Date: Sun, 9 Feb 2014 18:10:22 +0100
Subject: BIP39: Accepted -> Draft

---
 bip-0039.mediawiki | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'bip-0039.mediawiki')

diff --git a/bip-0039.mediawiki b/bip-0039.mediawiki
index a7a56c3..2f60ad9 100644
--- a/bip-0039.mediawiki
+++ b/bip-0039.mediawiki
@@ -6,7 +6,7 @@
            ThomasV <thomasv@bitcointalk.org>
            Aaron Voisine <voisine@gmail.com>
            Sean Bowe <ewillbefull@gmail.com>
-  Status:  Accepted
+  Status:  Draft
   Type:    Standards Track
   Created: 10-09-2013
 </pre>
-- 
cgit v1.2.3


From 13b7749520236a38710374bdca86de7cad808525 Mon Sep 17 00:00:00 2001
From: slush0 <slush@satoshilabs.com>
Date: Mon, 10 Feb 2014 02:47:19 +0100
Subject: should -> must

---
 bip-0039.mediawiki | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'bip-0039.mediawiki')

diff --git a/bip-0039.mediawiki b/bip-0039.mediawiki
index 2f60ad9..a04a745 100644
--- a/bip-0039.mediawiki
+++ b/bip-0039.mediawiki
@@ -101,7 +101,7 @@ wordlists or even whole sentence generators, allowing for flexibility in wordlis
 for typo detection or other purposes.
 
 Although using mnemonic not generated by algorithm described in "Generating the
-mnemonic" section is possible, this is not advised and software should compute
+mnemonic" section is possible, this is not advised and software must compute
 checksum of the mnemonic sentence using wordlist and issue a warning if it is
 invalid.
 
-- 
cgit v1.2.3

