<p>I can refer you to this implementation, method <code>mnemonic_from_data()</code> (from wallet-core/trezor):
<a href="https://github.com/trustwallet/wallet-core/blob/master/trezor-crypto/crypto/bip39.c#L70" rel="nofollow noreferrer">https://github.com/trustwallet/wallet-core/blob/master/trezor-crypto/crypto/bip39.c#L70</a></p>
<p>I haven't fully analyzed your code snippet, but most likely the checksum byte is incorrect. It is the first byte of the Sha256 hash, appended to the end.</p>
<p>Note that depending on the mnemonic length, some bits at the end of the mnemonic are unused, as follows:</p>
<pre><code>12-words: 12*11=132 bits used, 17*8=136 bits stored, last 4 bits unused
15-words: 15*11=165     /      21*8=168,                  3 unused
18-words: 18*11=198     /      25*8=200,                  2 unused
21-words: 21*11=231     /      29*8=232,                  1 usused
24-words: 24*11=264     /      33*8=264,                  all used
</code></pre>
<p>Since the unused bits don't matter, simplest is to just copy the first byte of the hash, without zeroing the unused bits (note that at <em>checking</em> one has to mask the bits).</p>
<p>The correct checksum for the example you provided is:</p>
<pre><code>'sustain resemble shift future stone merge antique denial devote century clay celery'
entropy: 'daf6eb172f4d6516c279d33cc4aca89280'
</code></pre>
<p>original (invalid):</p>
<pre><code>'sustain resemble shift future stone merge antique denial devote century clay chalk' 
entropy: 'daf6eb172f4d6516c279d33cc4aca892f0'
</code></pre>
<p>(Note: SHA256(daf6eb172f4d6516c279d33cc4aca892) = 8e51c3...71, its first byte is '8e', but only the 4 first (high) bits are needed, hence the '80' in the last byte. '8e' would work as well.)</p>

CC BY-SA 4.0
2022-10-14T08:52:44.167Z
2022-10-14T08:52:44.167Z
OptOut
<p>I created a random entropy using this code</p>
<pre><code>func randomNumGenerator() []byte {

    n := 16
    randomByte := make([]byte, n)
    _, err := rand.Read(randomByte)
    if err != nil {
        panic(err)
    }

    return randomByte
}
</code></pre>
<p>And created a checksum</p>
<pre><code>func checkSum(entropy *string) {

    data := *entropy
    checkSumLength := len(*entropy) / 32

    //Sha256 of entropy
    hash := sha256.Sum256([]byte(data))
    // hexFormat := hex.EncodeToString(hash[:])

    bitHash := byteToBit(hash[:])
    *entropy = *entropy + bitHash[0:checkSumLength]

}
</code></pre>
<p>And added that to the end of the entropy and divided that entropy into 11 bits equal parts
and matched it with the 2048 word list and I got words</p>
<p>&quot;sustain resemble shift future stone merge antique denial devote century clay chalk&quot;</p>
<p>But when I use this words in trust wallet it's showing invalid seed phrase</p>
<p>Can anyone explain me why? I followed all BIP39 procedures correctly in my code</p>

CC BY-SA 4.0
2022-09-19T04:11:25.983Z
Perhaps it's an issue with the wallet software you are using, check with them. The words you provided "work" fine and I get the HD Seed: 495fbf2c715222b46553fb8c466c33c59a8775541c1fedfe76ae71013f6431c54e8c8465de2f392b2d449f56efb3784a8195335bdd1017621d84e84c6eb0fa61
m1xolyd1an
<wallet><bip32-hd-wallets><mnemonic-seed><seed>
Why my manually generated mnemonic seed phrase is not recognised by metamask or trust wallet
Athul A
# Why my manually generated mnemonic seed phrase is not recognised by metamask or trust wallet

(Asked by: username_0 on 2022-09-18)

I created a random entropy using this code
func randomNumGenerator() []byte {

    n := 16
    randomByte := make([]byte, n)
    _, err := rand.Read(randomByte)
    if err != nil {
        panic(err)
    }

    return randomByte
}

And created a checksum
func checkSum(entropy *string) {

    data := *entropy
    checkSumLength := len(*entropy) / 32

    //Sha256 of entropy
    hash := sha256.Sum256([]byte(data))
    // hexFormat := hex.EncodeToString(hash[:])

    bitHash := byteToBit(hash[:])
    *entropy = *entropy + bitHash[0:checkSumLength]

}

And added that to the end of the entropy and divided that entropy into 11 bits equal parts
and matched it with the 2048 word list and I got words
"sustain resemble shift future stone merge antique denial devote century clay chalk"
But when I use this words in trust wallet it's showing invalid seed phrase
Can anyone explain me why? I followed all BIP39 procedures correctly in my code

**Tags:** wallet, bip32-hd-wallets, mnemonic-seed, seed

> **Comments:**
> **username_1**: Perhaps it's an issue with the wallet software you are using, check with them. The words you provided "work" fine and I get the HD Seed: 495fbf2c715222b46553fb8c466c33c59a8775541c1fedfe76ae71013f6431c54e8c8465de2f392b2d449f56efb3784a8195335bdd1017621d84e84c6eb0fa61  

---

## 1 answers

### Answer by username_2 on 2022-10-14. Score: 1

I can refer you to this implementation, method mnemonic_from_data() (from wallet-core/trezor):
https://github.com/trustwallet/wallet-core/blob/master/trezor-crypto/crypto/bip39.c#L70
I haven't fully analyzed your code snippet, but most likely the checksum byte is incorrect. It is the first byte of the Sha256 hash, appended to the end.
Note that depending on the mnemonic length, some bits at the end of the mnemonic are unused, as follows:
12-words: 12*11=132 bits used, 17*8=136 bits stored, last 4 bits unused
15-words: 15*11=165     /      21*8=168,                  3 unused
18-words: 18*11=198     /      25*8=200,                  2 unused
21-words: 21*11=231     /      29*8=232,                  1 usused
24-words: 24*11=264     /      33*8=264,                  all used

Since the unused bits don't matter, simplest is to just copy the first byte of the hash, without zeroing the unused bits (note that at checking one has to mask the bits).
The correct checksum for the example you provided is:
'sustain resemble shift future stone merge antique denial devote century clay celery'
entropy: 'daf6eb172f4d6516c279d33cc4aca89280'

original (invalid):
'sustain resemble shift future stone merge antique denial devote century clay chalk' 
entropy: 'daf6eb172f4d6516c279d33cc4aca892f0'

(Note: SHA256(daf6eb172f4d6516c279d33cc4aca892) = 8e51c3...71, its first byte is '8e', but only the 4 first (high) bits are needed, hence the '80' in the last byte. '8e' would work as well.)


---

