Computational cryptography › Live on mainnet today › Hashes and symmetric crypto
KEY DERIVATIONPrimitive

Wallet seeds: BIP-39 / BIP-32

In plain words

Your 12 or 24 seed words generate every key in your wallet.

The idea: Your seed words become one big secret number, and a one-way function derives keys from it along numbered paths (account 0, account 1...), so a single backup restores every key. Getting from any derived key back to the seed would mean inverting one-way functions (PBKDF2 and HMAC-SHA512), which even a quantum computer can't do efficiently.

Why it matters: The seed can't be worked out from the keys, which matters for quantum recovery plans.

The details

On the map: PBKDF2 + HMAC-SHA512, EIP-2333 for BLS keys

A seed phrase (BIP-39)[1] is turned into a 512-bit seed with PBKDF2-HMAC-SHA512, and BIP-32 derives every account key from it with HMAC-SHA512[2]. Validator BLS keys use a similar tree (EIP-2333)[3].

Because derivation is one-way, a quantum attacker who recovers a private key from a public key still can't recover the seed. The emergency fork plan relies on exactly that[4].

Rests on

If any of these breaks, this breaks too.

If it falls

If this breaks, these break with it.

References

  1. Marek Palatinus, Pavol Rusnak, Aaron Voisine and Sean Bowe. BIP 39: Mnemonic code for generating deterministic keys. Bitcoin Improvement Proposals, 2013. github.com/bitcoin/bips/blob/master/bip-0039.mediawiki
  2. Pieter Wuille. BIP 32: Hierarchical Deterministic Wallets. Bitcoin Improvement Proposals, 2012. github.com/bitcoin/bips/blob/master/bip-0032.mediawiki
  3. Carl Beekhuizen. ERC-2333: BLS12-381 Key Generation. Ethereum Request for Comments (Review), 2019. eips.ethereum.org/EIPS/eip-2333
  4. Vitalik Buterin. How to hard-fork to save most users' funds in a quantum emergency. ethresear.ch, 2024. ethresear.ch/t/how-to-hard-fork-to-save-most-users-funds-in-a-quantum-emergency/18901