Wallets, mnemonics and derivation

The phone that fell in water

Dayo drops his phone into a bucket of water. The wallet app is gone. Has he lost his money? The answer depends on one thing: does he still have his keys (or the seed that generates them)? If yes, he installs an app on another phone and his balance reappears. If not, his funds are still on the chain, but nobody can spend them any more. That difference is the heart of the workshop.

Who is who

• Funds: a line of the chain's state (a balance, or unspent outputs). They live on the chain, never in an app or on a phone.
• Key pair: a private (secret) key and the matching public key (workshop 105). Signing a transaction with the private key is the only way to spend what is locked to that key.
• Address: a public identifier computed from the public key, by a convention specific to each chain. Bitcoin passes the public key through two different hash functions (SHA-256 then RIPEMD-160, not to be confused with the double SHA-256 used for blocks and transactions) then adds an encoding; Ethereum takes the last 20 bytes of a Keccak-256 hash of the public key. In this workshop's exercises we use a toy convention: the first 20 bytes of the SHA-256 of the public key (bytes, not text). It is not the convention of any real chain.
• Wallet: software or a device that keeps keys, builds transactions, has them signed and displays balances it reads from the chain. It is not the vault of the funds.

Types of wallets

Example: getting the funds back

Dayo had an address A. The funds tied to A remain on the chain after the phone is lost. With a new app and his seed, he recovers the same private key, hence the same address A, hence the same ability to sign. Without the seed, he can still see A's balance (chain data is public) but he can no longer sign.

What this does NOT guarantee

• Losing the app does not lose the funds; losing the keys does.
• An address is not an identity: it does not say who controls it.
• A "secure" wallet does not stop you signing a transaction that you approved by mistake.
• The chain has no help desk and no "forgot password": nobody can reset a key.

Recap

Funds: on the chain. Private key: the power to spend them. Address: a public name derived from the public key. Wallet: the tool that keeps keys and signs.

Why twelve words?

A private key is 32 bytes (64 hexadecimal characters): impossible to copy without error. And if you want several accounts, you would need to back up several keys. The BIP-39 standard solves the first problem by encoding a random value as words from a list of 2,048 words; hierarchical derivation (lesson 3) solves the second.

How a phrase is built (real BIP-39)

1. Draw random entropy of 128 bits (16 bytes). For 24 words, 256 bits.
2. Compute SHA-256 of that entropy and keep the first 4 bits (entropy bits ÷ 32): the checksum.
3. Concatenate: 128 + 4 = 132 bits, split into 12 groups of 11 bits. Each 11-bit group is an index from 0 to 2,047 into the list of 2,048 words (2^11 = 2,048). For 24 words: 256 + 8 = 264 = 24 × 11.
4. The 64-byte seed is obtained with PBKDF2-HMAC-SHA512, 2,048 iterations, the phrase as password and the string "mnemonic" followed by the optional passphrase as salt.

The words are not the key: they encode the entropy; the seed is computed from the phrase itself (step 4), and the keys are derived from the seed.

Example: how many possible phrases?

128 bits of entropy make 2^128 possible values, a number of about 3.4 × 10^38. No attacker can try them all. By contrast, a phrase you choose yourself (a quote, a password "to look nice") has almost no entropy: it can be guessed. Randomness must come from a sound generator.

The 4-bit checksum lets software detect most typing mistakes: if one word is swapped for another from the list, the check still passes one time in 16 (2^−4), so it fails 15 times in 16. It does not prove the phrase is yours: a badly copied but valid phrase leads to another, empty wallet.

The passphrase: one more word that changes everything

Adding a passphrase changes the salt, hence the seed, hence all accounts. There is no error message if the passphrase is wrong: you get another valid and empty wallet. Useful (a stolen phrase without the passphrase gives no access to funds), but it is a second secret to back up.

Real and toy: a boundary not to cross

Different chains add their own rules. Substrate/Polkadot ecosystem tools also use mnemonic words, but their derivation scheme is not BIP-32's: the same words do not necessarily give the same accounts as in a Bitcoin or Ethereum wallet. Check the tool's documentation before restoring.

What this does NOT guarantee

• The words are not a resettable password: whoever reads them controls the funds.
• The checksum detects errors, not attacks.
• A 12-word phrase is safe only if it was drawn at random by a good generator.
• Two programs that accept the same phrase may derive different accounts (path, passphrase, scheme).

Recap

Entropy → words (with checksum) → seed through PBKDF2 → keys. The words are the only backup, hence the single point of theft.

One seed, many accounts

From a single seed, a hierarchical deterministic (HD) wallet generates a tree of keys: same inputs, same keys, always. You back up the seed once; accounts can be re-created at will, and you can use a fresh address for each payment received.

Real BIP-32, in summary

• Master key: compute HMAC-SHA512 of the seed with the key "Bitcoin seed". The first 32 bytes of the result form the master private key, the last 32 the chain code.
• Child key: compute HMAC-SHA512 with the parent's chain code as key. The data is: for a normal derivation, the parent's public key followed by the 4-byte index; for a hardened derivation (index ≥ 2^31), a zero byte, the parent's private key, then the index. The result is split in two: the left part is added, modulo the order of the secp256k1 curve, to the parent key to give the child key; the right part is the new chain code.
• Path: a sequence of indices, written for example m/44'/0'/0'/0/0 (the BIP-44 standard gives the levels their meaning: purpose, coin type, account, change, address index). The apostrophe marks a hardened derivation.

The course's toy version

The exercises use a deliberate simplification: the chain code is the key of an HMAC-SHA512 and the data is the parent key (32 bytes) followed by the index as 4 big-endian bytes. The first 32 bytes of the result are the child key, the last 32 the child chain code.

So never reuse this toy for real keys: it illustrates the shape of derivation (HMAC, chain code, index), not its cryptographic content.

Example: reading the structure

With a parent key, a chain code and an index of 5, the toy gives a pair (child key, child chain code). With index 6 you get a completely different pair (avalanche, workshop 104), but always the same at every computation: that is what makes restoring possible. With the hmac tool, enter the chain code as key and the concatenation parent key + index as data, then slice the 64-byte result with the bytes tool.

Why the normal/hardened difference exists

With normal derivation, you can compute child public keys from the parent's public key and chain code alone: a merchant website can thus produce new receiving addresses without ever holding a private key. The flip side: if someone knows the parent's chain code and public key and the private key of a single normal child, they can climb back to the parent's private key. Hardened derivation cuts that link, at the price of not allowing computation from the public key alone.

What this does NOT guarantee

• A deterministic derivation is not an extra secret: whoever has the seed and the path recomputes everything.
• Different paths in different software give different addresses from the same words.
• Each chain has its conventions (curve, address format, scheme): the same mnemonic does not imply the same accounts elsewhere.

Recap

Same seed + same path = same keys, always. Real BIP-32: HMAC-SHA512, elliptic curve, normal/hardened. Toy: HMAC-SHA512 only, and with no real value.

The question that matters: what exactly is lost?

Dayo photographs his 12-word phrase "so as not to forget it". The photo syncs to an online storage account that is later hacked. What are the consequences, exactly?

If someone obtains the phrase (and the passphrase, where there is one), they obtain the seed, hence:

• All the keys of the tree, for every path they try, including accounts you have not yet created.
• On all chains whose tools derive from that seed by a scheme they know.
• The power to sign transactions the chains will accept as coming from you: the chain cannot tell the owner from the thief.

And what they do not obtain:

• They cannot cancel or rewrite past transactions.
• They learn nothing about your other passwords.
• They do not affect accounts derived from a different seed.

There is no revocation

There is no "change password" procedure on a chain. The only response is to move the funds to keys of a new seed, generated on a healthy device, starting with the highest values. It is a race: a thief watching your addresses can move the funds before you, which is why you must not let the seed be exposed. An undisclosed passphrase limits the damage, but it is not recoverable either if you lose it.

Backing up without exposing yourself

• Write the phrase by hand on paper (or engrave it on metal), never in a photo, a message, a synced note, an email or an online notes manager.
• Keep at least two copies in two different safe places (fire, theft, flood).
• Keep the passphrase apart from the phrase.
• Test the restore: on another device or with another tool, restore with a small amount, check the expected addresses appear, and only then trust the backup.

Example: "my balance is zero"

Dayo restores his 12 words in a different app and sees a zero balance. Are his funds lost? Almost certainly not: the likely causes are a different derivation path or coin type, a forgotten passphrase, another scheme (Substrate instead of BIP-32), or a typing mistake that gave a valid but different phrase. The repair: find the original tool's path and scheme, not panic or type the phrase into a "recovery" website.

What this does NOT guarantee

• An untested backup is not a backup.
• A paper copy protects against failure, not against theft or fire.
• A phrase "deleted" after use on a device is not necessarily gone: cache, keyboard history, clipboard.
• A hardware wallet protects against malware at signing time, not against someone who has read your phrase.

Recap

Compromised phrase = all present and future accounts compromised, with no revocation. Response: move the funds to a new seed. Prevention: offline backup, separate copies, tested restore.