<p>You probably know that HMAC-SHA256/HMAC-SHA512 and thus PBKDF2 are one-way functions. There would be no way how to reconstruct the seed from the generated sentence in your setup, which is the only purpose of such sentence.</p>

CC BY-SA 3.0
2018-02-16T23:14:10.550Z
that what I was trying to say :D
Tailer
CC BY-SA 3.0
2018-02-16T23:18:50.867Z
Thanks. I feel bad not to have thought it through.
Klaus
CC BY-SA 3.0
2018-02-16T23:12:51.283Z
2018-02-16T23:12:51.283Z
Pavol Rusnak
<p>The standard BIP39 does three things:</p>

<p>1) Generate 256+8 entropy</p>

<p>2) Generate sentence</p>

<p>3) Derive seed from sentence (using PBKDF2 with HMAC-SHA512).</p>

<p>I wonder what would be the security implication of doing things the reverse way:</p>

<p>1) Generate entropy and use it as seed</p>

<p>2) Derive 256 bit array from entropy (using PBKDF2 with HMAC-SHA256/HMAC-SHA512). + 8 bit checksum</p>

<p>3) Use above bit array to construct sentence</p>

<p>Essentially, instead of creating the seed from the sentence, I create the sentence from the seed. In the last step, if HMAC-SHA512 is used, it would generate a bit array of length 512 which is too long for the sentence. To solve that I would XOR the two halves of the array. Alternately, I could just use HMAC-SHA256.</p>

<p>The company I work for has a library that does seed generation and this is what we are mandated to use. </p>

<seed><mnemonic-seed>
Mnemonic Phrase (BIP39) with Existing Seed Generating Library
Klaus
# Mnemonic Phrase (BIP39) with Existing Seed Generating Library

(Asked by: username_0 on 2018-02-16)

The standard BIP39 does three things:

1) Generate 256+8 entropy

2) Generate sentence

3) Derive seed from sentence (using PBKDF2 with HMAC-SHA512).

I wonder what would be the security implication of doing things the reverse way:

1) Generate entropy and use it as seed

2) Derive 256 bit array from entropy (using PBKDF2 with HMAC-SHA256/HMAC-SHA512). + 8 bit checksum

3) Use above bit array to construct sentence

Essentially, instead of creating the seed from the sentence, I create the sentence from the seed. In the last step, if HMAC-SHA512 is used, it would generate a bit array of length 512 which is too long for the sentence. To solve that I would XOR the two halves of the array. Alternately, I could just use HMAC-SHA256.

The company I work for has a library that does seed generation and this is what we are mandated to use.

**Tags:** seed, mnemonic-seed


---

## 1 answers

### Answer by username_1 on 2018-02-16. Score: 3 | Accepted answer

You probably know that HMAC-SHA256/HMAC-SHA512 and thus PBKDF2 are one-way functions. There would be no way how to reconstruct the seed from the generated sentence in your setup, which is the only purpose of such sentence.

> **Comments:**
> **username_2**: that what I was trying to say :D  
> **username_0**: Thanks. I feel bad not to have thought it through.  

---

