1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
<pre>
BIP: BIP-0039
Title: Mnemonic code for generating deterministic keys
Authors: Marek Palatinus <slush@satoshilabs.com>
Pavol Rusnak <stick@satoshilabs.com>
ThomasV <thomasv@bitcointalk.org>
Aaron Voisine <voisine@gmail.com>
Sean Bowe <ewillbefull@gmail.com>
Status: Accepted
Type: Standards Track
Created: 10-09-2013
</pre>
==Abstract==
This BIP describes the implementation of a mnemonic code or mnemonic sentence --
a group of easy to remember words -- for the generation of deterministic wallets.
It consists of two parts: generating the mnenomic, and converting it into a
binary seed. This seed can be later used to generate deterministic wallets using
BIP-0032 or similar methods.
==Motivation==
A mnenomic code or sentence is superior for human interaction compared to the
handling of raw binary or hexidecimal representations of a wallet seed. The
sentence could be written on paper, spoken over the telephone, or memorized as a
brain wallet.
==Generating the mnemonic==
The mnemonic must encode entropy in any multiple of 32 bits. With larger entropy
security is improved but the sentence length increases. We can refer to the
initial entropy length as ENT. The recommended size of ENT is 128-256 bits.
First, an initial entropy of ENT bits is generated. A checksum is generated by
taking the first <pre>ENT / 32</pre> bits of its SHA256 hash. This checksum is
appended to the end of the initial entropy. Next, these concatenated bits are
are split into groups of 11 bits, each encoding a number from 0-2047, serving
as an index to a wordlist. Later, we will convert these numbers into words and
use the joined words as a mnemonic sentence.
The following table describes the relation between the initial entropy
length (ENT), the checksum length (CS) and length of the generated mnemonic
sentence (MS) in words.
<pre>
CS = ENT / 32
MS = (ENT + CS) / 11
| ENT | CS | ENT+CS | MS |
+-------+----+--------+------+
| 128 | 4 | 132 | 12 |
| 160 | 5 | 165 | 15 |
| 192 | 6 | 198 | 18 |
| 224 | 7 | 231 | 21 |
| 256 | 8 | 264 | 24 |
</pre>
==Wordlist==
An ideal wordlist has the following characteristics:
a) smart selection of words
- wordlist is created in such way that it's enough to type the first four
letters to unambiguously identify the word
b) similar words avoided
- word pairs like "build" and "built", "woman" and "women", or "quick" and "quickly"
not only make remembering the sentence difficult, but are also more error
prone and more difficult to guess
c) sorted wordlists
- wordlist is sorted which allows for more efficient lookup of the code words
(i.e. implementation can use binary search instead of linear search)
- this also allows trie (prefix tree) to be used, e.g. for better compression
The wordlist can contain native characters, but they have to be encoded using UTF-8.
==From mnemonic to seed==
A user may decide to protect their mnemonic by passphrase. If a passphrase is not
present, an empty string "" is used instead.
To create a binary seed from the mnemonic, we use PBKDF2 function with a mnemonic
sentence (in UTF-8) used as a password and string "mnemonic" + passphrase (again
in UTF-8) used as a salt. Iteration count is set to 2048 and HMAC-SHA512 is used as
a pseudo-random function. Desired length of the derived key is 512 bits (= 64 bytes).
This seed can be later used to generate deterministic wallets using BIP-0032 or
similar methods.
The conversion of the mnemonic sentence to binary seed is completely independent
from generating the sentence. This results in rather simple code; there are no
constraints on sentence structure and clients are free to implement their own
wordlists or even whole sentence generators, allowing for flexibility in wordlists
for typo detection or other purposes.
Described method also provides plausible deniability, because every passphrase
generates a valid seed (and thus deterministic wallet) but only the correct one
will make the desired wallet available.
==Wordlists==
* [[bip-0039/english.txt|English]]
==Test vectors==
See https://github.com/trezor/python-mnemonic/blob/master/vectors.json
==Reference Implementation==
Reference implementation including wordlists is available from
http://github.com/trezor/python-mnemonic
|
