<blockquote>
  <p>Specifically, given that the root seed was derived using PBKDF2 (with 2048 rounds of hashing with HMAC-SHA256 already), why do we undergo</p>
</blockquote>

<p>and </p>

<blockquote>
  <p>an additional pass of HMAC-SHA512, besides for creating 512 bits of entropy?</p>
</blockquote>

<p>Those things come from different standards. BIP32 (which specifies going from masterkey to keys) came first. Various ways for constructing master keys/seeds are in use that came later; I assume you're referring to one of those.</p>

CC BY-SA 3.0
2018-02-26T00:00:45.973Z
2018-02-26T00:00:45.973Z
Pieter Wuille
<blockquote>
  <p>Why not just use SHA512 alone?</p>
</blockquote>

<p>I'm not sure. I think that would work fine. The only tricky detail would be that you need include the passphrase, too.</p>

<blockquote>
  <p>It seems for derivation of the master private key and chain node, the function is being used as a one-way hash function only, </p>
</blockquote>

<p>To be entirely accurate, you need more than a one-way function. For example, if the hash function always produced a hash that was divisible by 3, that would follow <a href="https://en.wikipedia.org/wiki/Cryptographic_hash_function" rel="nofollow noreferrer">all of the properties</a> of the hash function, but it would be weaker as a key derivation function.</p>

CC BY-SA 3.0
2017-10-27T09:40:57.777Z
2017-10-27T09:40:57.777Z
Nick ODell
<p>I'm willing to bet the 2048 rounds of hashing required by the BIP 39 Standard takes considerably more energy than 1 round of hashing. </p>

<p>Put another way, substantial computing cycles are required to create brute forced <strong>Rainbow Tables</strong> when lower entropy human readable seeds are functionally mapped to private keys. This is somewhat analogous to the leading hash zeroes values miners satisfy to add blocks to a PoW-based blockchain, except the computing cylces are fixed by <a href="https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#from-mnemonic-to-seed" rel="nofollow noreferrer"><strong>mnemonics-to-seed</strong></a> portion of the BIP39 Standard.</p>

<p>The Python <a href="https://pypi.org/project/stretch/" rel="nofollow noreferrer"><strong>stretch</strong></a> can effectively implement the mnemonics-to-seed functionality written into BIP 39.</p>

<p><code>stretch-&gt;passlib.pbkdf2(secret, “mnemonic”+salt, rounds=2048, keylength=64, sha512)</code></p>

<p>The two two Bitcoin-related examples of piped commands using <strong>stretch</strong> and <a href="https://github.com/libbitcoin/libbitcoin-explorer/wiki#about-bitcoin-explorer" rel="nofollow noreferrer"><strong>bx</strong></a> yield the same result.</p>

<p><strong>% stretch -f sha512 -r 2048 "bunker wreck real edge inflict aerobic buddy mercy divorce wolf bright immune fat foot poet section sustain reveal unique reflect have latin problem chapter" mnemonic123 | bx base64-decode | bx base16-encode | bx hd-new | bx hd-private</strong>
<code>xprv9veSXAfA7GoYvaMAXgm3uYGS4VLH1Foc9qmTBRCb4c3F2Vqd261k2vo646nLU54MRVseFx2BbhZYQS9HDUy4dvTV3fygVGxedqYSR82B3he</code></p>

<p><strong>% echo "bunker wreck real edge inflict aerobic buddy mercy divorce wolf bright immune fat foot poet section sustain reveal unique reflect have latin problem chapter" | bx mnemonic-to-seed -p 123 | bx hd-new -v 76066276 | bx hd-private</strong>
<code>xprv9veSXAfA7GoYvaMAXgm3uYGS4VLH1Foc9qmTBRCb4c3F2Vqd261k2vo646nLU54MRVseFx2BbhZYQS9HDUy4dvTV3fygVGxedqYSR82B3he</code> </p>

CC BY-SA 4.0
2022-01-20T19:12:00.950Z
This doesn't answer the question why HMAC-SHA-512 is used as opposed to SHA-512.
smizzlov
CC BY-SA 4.0
2022-01-20T20:39:32.130Z
Rainbow tables aren't applicable to BIP39; the key space is too large to construct them.
Pieter Wuille
CC BY-SA 4.0
2022-01-23T16:33:39.077Z
% echo -n "Bull Shit" | bx base16-encode | bx sha256 | bx mnemonic-new
`shiver enact raise shoe vocal evidence dismiss lawsuit hospital multiply project wonder art fish next club bridge steak ritual face recipe school knife second`
skaht
CC BY-SA 4.0
2018-07-08T22:45:30.687Z
2018-09-15T23:37:15.663Z
2018-09-15T23:37:15.663Z
skaht
<p>The process is depicted in <a href="https://raw.githubusercontent.com/bitcoinbook/bitcoinbook/develop/images/mbc2_0509.png" rel="nofollow noreferrer">this</a> picture. Specifically, given that the root seed was derived using PBKDF2 (with 2048 rounds of hashing with HMAC-SHA256 already), why do we undergo an additional pass of HMAC-SHA512, besides for creating 512 bits of entropy? Why not just use SHA512 alone? I've asked here before and the answer I got was that the HMAC version is used to ensure unique generation of the key, but I don't know what that means. It seems for derivation of the master private key and chain node, the function is being used as a one-way hash function only, so why is a MAC being used? There is a single thing being encrypted, we are not additionally trying to guarantee authenticity on anything here, right?</p>

<private-key><hash><bip32-hd-wallets>
Why is HMAC-SHA512 used on root the root seed to create master private key and chain code in HD wallets?
Leeren
# Why is HMAC-SHA512 used on root the root seed to create master private key and chain code in HD wallets?

(Asked by: username_0 on 2017-10-27)

The process is depicted in [this](https://raw.githubusercontent.com/bitcoinbook/bitcoinbook/develop/images/mbc2_0509.png) picture. Specifically, given that the root seed was derived using PBKDF2 (with 2048 rounds of hashing with HMAC-SHA256 already), why do we undergo an additional pass of HMAC-SHA512, besides for creating 512 bits of entropy? Why not just use SHA512 alone? I've asked here before and the answer I got was that the HMAC version is used to ensure unique generation of the key, but I don't know what that means. It seems for derivation of the master private key and chain node, the function is being used as a one-way hash function only, so why is a MAC being used? There is a single thing being encrypted, we are not additionally trying to guarantee authenticity on anything here, right?

**Tags:** private-key, hash, bip32-hd-wallets


---

## 3 answers

### Answer by username_1 on 2018-02-26. Score: 2

> Specifically, given that the root seed was derived using PBKDF2 (with 2048 rounds of hashing with HMAC-SHA256 already), why do we undergo

and

> an additional pass of HMAC-SHA512, besides for creating 512 bits of entropy?

Those things come from different standards. BIP32 (which specifies going from masterkey to keys) came first. Various ways for constructing master keys/seeds are in use that came later; I assume you're referring to one of those.


---

### Answer by username_2 on 2017-10-27. Score: 1

> Why not just use SHA512 alone?

I'm not sure. I think that would work fine. The only tricky detail would be that you need include the passphrase, too.

> It seems for derivation of the master private key and chain node, the function is being used as a one-way hash function only,

To be entirely accurate, you need more than a one-way function. For example, if the hash function always produced a hash that was divisible by 3, that would follow [all of the properties](https://en.wikipedia.org/wiki/Cryptographic_hash_function) of the hash function, but it would be weaker as a key derivation function.


---

### Answer by username_3 on 2018-07-08. Score: 0

I'm willing to bet the 2048 rounds of hashing required by the BIP 39 Standard takes considerably more energy than 1 round of hashing.

Put another way, substantial computing cycles are required to create brute forced **Rainbow Tables** when lower entropy human readable seeds are functionally mapped to private keys. This is somewhat analogous to the leading hash zeroes values miners satisfy to add blocks to a PoW-based blockchain, except the computing cylces are fixed by [**mnemonics-to-seed**](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#from-mnemonic-to-seed) portion of the BIP39 Standard.

The Python [**stretch**](https://pypi.org/project/stretch/) can effectively implement the mnemonics-to-seed functionality written into BIP 39.

`stretch->passlib.pbkdf2(secret, “mnemonic”+salt, rounds=2048, keylength=64, sha512)`

The two two Bitcoin-related examples of piped commands using **stretch** and [**bx**](https://github.com/libbitcoin/libbitcoin-explorer/wiki#about-bitcoin-explorer) yield the same result.

**% stretch -f sha512 -r 2048 "bunker wreck real edge inflict aerobic buddy mercy divorce wolf bright immune fat foot poet section sustain reveal unique reflect have latin problem chapter" mnemonic123 | bx base64-decode | bx base16-encode | bx hd-new | bx hd-private**
`xprv9veSXAfA7GoYvaMAXgm3uYGS4VLH1Foc9qmTBRCb4c3F2Vqd261k2vo646nLU54MRVseFx2BbhZYQS9HDUy4dvTV3fygVGxedqYSR82B3he`

**% echo "bunker wreck real edge inflict aerobic buddy mercy divorce wolf bright immune fat foot poet section sustain reveal unique reflect have latin problem chapter" | bx mnemonic-to-seed -p 123 | bx hd-new -v 76066276 | bx hd-private**
`xprv9veSXAfA7GoYvaMAXgm3uYGS4VLH1Foc9qmTBRCb4c3F2Vqd261k2vo646nLU54MRVseFx2BbhZYQS9HDUy4dvTV3fygVGxedqYSR82B3he`

> **Comments:**
> **username_4**: This doesn't answer the question why HMAC-SHA-512 is used as opposed to SHA-512.  
> **username_1**: Rainbow tables aren't applicable to BIP39; the key space is too large to construct them.  
> **username_3**: % echo -n "Bull Shit" | bx base16-encode | bx sha256 | bx mnemonic-new `shiver enact raise shoe vocal evidence dismiss lawsuit hospital multiply project wonder art fish next club bridge steak ritual face recipe school knife second`  

---

