slip-0010.md

SLIP-0010 : Universal private key derivation from master private key

Number:  SLIP-0010
Title:   Universal private key derivation from master private key
Type:    Standard
Status:  Final
Authors: Jochen Hoenicke <hoenicke@gmail.com>
         Pavol Rusnak <stick@satoshilabs.com>
Created: 2016-04-26

Abstract

SLIP-0010 describes a generalized derivation scheme for private and public key pairs in hierarchical deterministic wallets for the curves secp256k1, NIST P-256, ed25519 and curve25519.

Motivation

Some Trezor applications, in particular SSH and GPG, need different curve types, e.g., NIST P-256 and ed25519. For security reasons different private and public key pairs should be used for these curves. This SLIP describes how to derive a master private/public key for these curves by generalizing the derivation scheme used in BIP-0032.

Body

Trezor generates all keys from a BIP-0039 mnemonic or from a set of SLIP-0039 mnemonic shares and optionally a passphrase. Each of these standards specifies how to compute a seed from the mnemonic(s) and passphrase. From this seed Trezor can create several master keys, one for each curve. It uses a process similar and practically compatible with BIP-0032. For other curves it uses a different salt than BIP-0032. This avoids using the same private key for different elliptic curves with different orders.

Master key generation

We adapt the master key generation from BIP-0032. To use different private keys for different curves we use different keys for the HMAC hash that generates the master key. For the NIST P-256 curve the only other difference is the curve domain parameters. In the algorithm below we denote the group order of the elliptic curve by n. point(k) is the scalar multiplication of the curve generator by the scalar k. The operation (+) of two elements on the curve is the group point addition. For ed25519 and curve25519 the private keys are no longer multipliers for the group generator; instead the hash of the private key is the multiplier. For this reason, our scheme for ed25519 and curve25519 does not support public key derivation and uses the produced hashes directly as private keys.

For ed25519 public keys we define ser_P(P): serializes the elliptic curve point P = (x,y) on a twisted Edwards curve as a byte sequence: 0x00 || ENC(x, y), where ENC is defined in RFC 8032.

For curve25519 public keys we define ser_P(P): serializes the elliptic curve point P = (u,v) on a Montgomery curve as a byte sequence: 0x00 || encodeUCoordinate(u, 255), where encodeUCoordinate is defined in RFC 7748.

For ed25519 and curve25519 private keys we define ser₂₅₆(p) = p and parse₂₅₆(p) = p, since private keys for these two curves are not integers but byte sequences.

To avoid invalid master keys, the algorithm is retried with the intermediate hash as new seed if the key is invalid.

Let S be a seed byte sequence of 128 to 512 bits in length. This is the same as the seed byte sequence used in BIP-0032. The value of S should be the binary seed obtained from a BIP-0039 mnemonic and optional passphrase or it should be the master secret obtained from a set of SLIP-0039 mnemonics and optional passphrase.

1. Calculate I = HMAC-SHA512(Key = Curve, Data = S)
2. Split I into two 32-byte sequences, I_L and I_R.
3. Use parse₂₅₆(I_L) as master secret key, and I_R as master chain code.
4. If curve is not ed25519 or curve25519 and I_L is 0 or ≥ n (invalid key):
   • Set S := I and restart at step 1.

The supported curves are

• Curve = "Bitcoin seed" for the secp256k1 curve (this is compatible with BIP-0032).
• Curve = "Nist256p1 seed" for the NIST P-256 curve.
• Curve = "ed25519 seed" for the ed25519 curve.
• Curve = "curve25519 seed" for curve25519.

For ed25519 and curve25519, the last step always succeeds since every 32-byte sequence (even all zero) is a valid private key.

Child key derivation (CKD) functions

Private and public key derivation for NIST P-256 is identical to the generation for secp256k1 but uses the domain parameters of that curve. We change BIP-32 to not fail if the resulting key is not valid but retry hashing until a valid key is found. For ed25519 and curve25519 only hardened key generation from private parent key to private child key is supported.

Given a parent extended key and an index i, it is possible to compute the corresponding child extended key. The algorithm to do so depends on whether the child is a hardened key or not (or, equivalently, whether i ≥ 2³¹), and whether we're talking about private or public keys.

Private parent key → private child key

Let n denote the order of the curve.

The function CKDpriv((k_par, c_par), i) → (k_i, c_i) computes a child extended private key from the parent extended private key:

1. Check whether i ≥ 2³¹ (whether the child is a hardened key).
   • If so (hardened child): let I = HMAC-SHA512(Key = c_par, Data = 0x00 || ser₂₅₆(k_par) || ser₃₂(i)). (Note: The 0x00 pads the private key to make it 33 bytes long.)
   • If not (normal child):
     • If curve is ed25519 or curve25519: return failure.
     • let I = HMAC-SHA512(Key = c_par, Data = ser_P(point(k_par)) || ser₃₂(i)).
2. Split I into two 32-byte sequences, I_L and I_R.
3. The returned chain code c_i is I_R.
4. If curve is ed25519 or curve25519: The returned child key k_i is I_L.
5. If parse₂₅₆(I_L) ≥ n or parse₂₅₆(I_L) + k_par (mod n) = 0 (resulting key is invalid):
   • let I = HMAC-SHA512(Key = c_par, Data = 0x01 || I_R || ser₃₂(i) and restart at step 2.
6. Otherwise: The returned child key k_i is parse₂₅₆(I_L) + k_par (mod n).

The HMAC-SHA512 function is specified in RFC 4231.

Public parent key → public child key

This function always fails for ed25519 and curve25519 since normal derivation is not supported.

The function CKDpub((K_par, c_par), i) → (K_i, c_i) computes a child extended public key from the parent extended public key. It is only defined for non-hardened child keys.

1. Check whether i ≥ 2³¹ (whether the child is a hardened key).
   • If so (hardened child): return failure
   • If not (normal child): let I = HMAC-SHA512(Key = c_par, Data = ser_P(K_par) || ser₃₂(i)).
2. Split I into two 32-byte sequences, I_L and I_R.
3. The returned child key K_i is point(parse₂₅₆(I_L)) + K_par.
4. The returned chain code c_i is I_R.
5. If parse₂₅₆(I_L) ≥ n or K_i is the point at infinity (the resulting key is invalid):
   • let I = HMAC-SHA512(Key = c_par, Data = 0x01 || I_R || ser₃₂(i)) and restart at step 2.

Compatibility with BIP-0032

Master key generation in BIP-0032 may result in an invalid key, in which case the wallet keys are undefined. Similarly child key derivation may result in an invalid key, in which case the child key for the given index is undefined and one should proceed with the next index value. For the secp256k1 curve the probability of this happening is lower than 2⁻¹²⁷, i.e. practically impossible. For the NIST P-256 curve, on the other hand, the probability is 2⁻³², i.e. unlikely but possible. The present specification extends the BIP-0032 definition of child key derivation so that the keys for all indices are well defined. The reason for extending the definition is to avoid problems when dealing with the NIST P-256 curve. However, the extended definition also applies to the secp256k1 curve.

For the secp256k1 curve the SLIP-0010 derivation scheme is identical to BIP-0032 with near certainty (probability greater than 1−2⁻¹²⁷ per derivation operation). Theoretically, if a seed is used in a SLIP-0010 wallet to receive assets and the seed is ported to a BIP-0032 wallet, then there is an infinitesimal chance that some assets will not be discovered by the BIP-0032 wallet. Conversely, if a seed is used in a BIP-0032 wallet to receive assets and the seed is ported to a SLIP-0010 wallet, then all assets will be discovered by the SLIP-0010 wallet.

Test vectors

Test vector 1 for secp256k1

Seed (hex): 000102030405060708090a0b0c0d0e0f

• Chain m
  • fingerprint: 00000000
  • chain code: 873dff81c02f525623fd1fe5167eac3a55a049de3d314bb42ee227ffed37d508
  • private: e8f32e723decf4051aefac8e2c93c9c5b214313817cdb01a1494b917c8436b35
  • public: 0339a36013301597daef41fbe593a02cc513d0b55527ec2df1050e2e8ff49c85c2
• Chain m/0_H
  • fingerprint: 3442193e
  • chain code: 47fdacbd0f1097043b78c63c20c34ef4ed9a111d980047ad16282c7ae6236141
  • private: edb2e14f9ee77d26dd93b4ecede8d16ed408ce149b6cd80b0715a2d911a0afea
  • public: 035a784662a4a20a65bf6aab9ae98a6c068a81c52e4b032c0fb5400c706cfccc56
• Chain m/0_H/1
  • fingerprint: 5c1bd648
  • chain code: 2a7857631386ba23dacac34180dd1983734e444fdbf774041578e9b6adb37c19
  • private: 3c6cb8d0f6a264c91ea8b5030fadaa8e538b020f0a387421a12de9319dc93368
  • public: 03501e454bf00751f24b1b489aa925215d66af2234e3891c3b21a52bedb3cd711c
• Chain m/0_H/1/2_H
  • fingerprint: bef5a2f9
  • chain code: 04466b9cc8e161e966409ca52986c584f07e9dc81f735db683c3ff6ec7b1503f
  • private: cbce0d719ecf7431d88e6a89fa1483e02e35092af60c042b1df2ff59fa424dca
  • public: 0357bfe1e341d01c69fe5654309956cbea516822fba8a601743a012a7896ee8dc2
• Chain m/0_H/1/2_H/2
  • fingerprint: ee7ab90c
  • chain code: cfb71883f01676f587d023cc53a35bc7f88f724b1f8c2892ac1275ac822a3edd
  • private: 0f479245fb19a38a1954c5c7c0ebab2f9bdfd96a17563ef28a6a4b1a2a764ef4
  • public: 02e8445082a72f29b75ca48748a914df60622a609cacfce8ed0e35804560741d29
• Chain m/0_H/1/2_H/2/1000000000
  • fingerprint: d880d7d8
  • chain code: c783e67b921d2beb8f6b389cc646d7263b4145701dadd2161548a8b078e65e9e
  • private: 471b76e389e528d6de6d816857e012c5455051cad6660850e58372a6c3e6e7c8
  • public: 022a471424da5e657499d1ff51cb43c47481a03b1e77f951fe64cec9f5a48f7011

Test vector 1 for nist256p1

Seed (hex): 000102030405060708090a0b0c0d0e0f

• Chain m
  • fingerprint: 00000000
  • chain code: beeb672fe4621673f722f38529c07392fecaa61015c80c34f29ce8b41b3cb6ea
  • private: 612091aaa12e22dd2abef664f8a01a82cae99ad7441b7ef8110424915c268bc2
  • public: 0266874dc6ade47b3ecd096745ca09bcd29638dd52c2c12117b11ed3e458cfa9e8
• Chain m/0_H
  • fingerprint: be6105b5
  • chain code: 3460cea53e6a6bb5fb391eeef3237ffd8724bf0a40e94943c98b83825342ee11
  • private: 6939694369114c67917a182c59ddb8cafc3004e63ca5d3b84403ba8613debc0c
  • public: 0384610f5ecffe8fda089363a41f56a5c7ffc1d81b59a612d0d649b2d22355590c
• Chain m/0_H/1
  • fingerprint: 9b02312f
  • chain code: 4187afff1aafa8445010097fb99d23aee9f599450c7bd140b6826ac22ba21d0c
  • private: 284e9d38d07d21e4e281b645089a94f4cf5a5a81369acf151a1c3a57f18b2129
  • public: 03526c63f8d0b4bbbf9c80df553fe66742df4676b241dabefdef67733e070f6844
• Chain m/0_H/1/2_H
  • fingerprint: b98005c1
  • chain code: 98c7514f562e64e74170cc3cf304ee1ce54d6b6da4f880f313e8204c2a185318
  • private: 694596e8a54f252c960eb771a3c41e7e32496d03b954aeb90f61635b8e092aa7
  • public: 0359cf160040778a4b14c5f4d7b76e327ccc8c4a6086dd9451b7482b5a4972dda0
• Chain m/0_H/1/2_H/2
  • fingerprint: 0e9f3274
  • chain code: ba96f776a5c3907d7fd48bde5620ee374d4acfd540378476019eab70790c63a0
  • private: 5996c37fd3dd2679039b23ed6f70b506c6b56b3cb5e424681fb0fa64caf82aaa
  • public: 029f871f4cb9e1c97f9f4de9ccd0d4a2f2a171110c61178f84430062230833ff20
• Chain m/0_H/1/2_H/2/1000000000
  • fingerprint: 8b2b5c4b
  • chain code: b9b7b82d326bb9cb5b5b121066feea4eb93d5241103c9e7a18aad40f1dde8059
  • private: 21c4f269ef0a5fd1badf47eeacebeeaa3de22eb8e5b0adcd0f27dd99d34d0119
  • public: 02216cd26d31147f72427a453c443ed2cde8a1e53c9cc44e5ddf739725413fe3f4

Test vector 1 for ed25519

Seed (hex): 000102030405060708090a0b0c0d0e0f

• Chain m
  • fingerprint: 00000000
  • chain code: 90046a93de5380a72b5e45010748567d5ea02bbf6522f979e05c0d8d8ca9fffb
  • private: 2b4be7f19ee27bbf30c667b642d5f4aa69fd169872f8fc3059c08ebae2eb19e7
  • public: 00a4b2856bfec510abab89753fac1ac0e1112364e7d250545963f135f2a33188ed
• Chain m/0_H
  • fingerprint: ddebc675
  • chain code: 8b59aa11380b624e81507a27fedda59fea6d0b779a778918a2fd3590e16e9c69
  • private: 68e0fe46dfb67e368c75379acec591dad19df3cde26e63b93a8e704f1dade7a3
  • public: 008c8a13df77a28f3445213a0f432fde644acaa215fc72dcdf300d5efaa85d350c
• Chain m/0_H/1_H
  • fingerprint: 13dab143
  • chain code: a320425f77d1b5c2505a6b1b27382b37368ee640e3557c315416801243552f14
  • private: b1d0bad404bf35da785a64ca1ac54b2617211d2777696fbffaf208f746ae84f2
  • public: 001932a5270f335bed617d5b935c80aedb1a35bd9fc1e31acafd5372c30f5c1187
• Chain m/0_H/1_H/2_H
  • fingerprint: ebe4cb29
  • chain code: 2e69929e00b5ab250f49c3fb1c12f252de4fed2c1db88387094a0f8c4c9ccd6c
  • private: 92a5b23c0b8a99e37d07df3fb9966917f5d06e02ddbd909c7e184371463e9fc9
  • public: 00ae98736566d30ed0e9d2f4486a64bc95740d89c7db33f52121f8ea8f76ff0fc1
• Chain m/0_H/1_H/2_H/2_H
  • fingerprint: 316ec1c6
  • chain code: 8f6d87f93d750e0efccda017d662a1b31a266e4a6f5993b15f5c1f07f74dd5cc
  • private: 30d1dc7e5fc04c31219ab25a27ae00b50f6fd66622f6e9c913253d6511d1e662
  • public: 008abae2d66361c879b900d204ad2cc4984fa2aa344dd7ddc46007329ac76c429c
• Chain m/0_H/1_H/2_H/2_H/1000000000_H
  • fingerprint: d6322ccd
  • chain code: 68789923a0cac2cd5a29172a475fe9e0fb14cd6adb5ad98a3fa70333e7afa230
  • private: 8f94d394a8e8fd6b1bc2f3f49f5c47e385281d5c17e65324b0f62483e37e8793
  • public: 003c24da049451555d51a7014a37337aa4e12d41e485abccfa46b47dfb2af54b7a

Test vector 1 for curve25519

Seed (hex): 000102030405060708090a0b0c0d0e0f

• Chain m
  • fingerprint: 00000000
  • chain code: 77997ca3588a1a34f3589279ea2962247abfe5277d52770a44c706378c710768
  • private: d70a59c2e68b836cc4bbe8bcae425169b9e2384f3905091e3d60b890e90cd92c
  • public: 005c7289dc9f7f3ea1c8c2de7323b9fb0781f69c9ecd6de4f095ac89a02dc80577
• Chain m/0_H
  • fingerprint: 6f5a9c0d
  • chain code: 349a3973aad771c628bf1f1b4d5e071f18eff2e492e4aa7972a7e43895d6597f
  • private: cd7630d7513cbe80515f7317cdb9a47ad4a56b63c3f1dc29583ab8d4cc25a9b2
  • public: 00cb8be6b256ce509008b43ae0dccd69960ad4f7ff2e2868c1fbc9e19ec3ad544b
• Chain m/0_H/1_H
  • fingerprint: fde474d7
  • chain code: 2ee5ba14faf2fe9d7ab532451c2be3a0a5375c5e8c44fb31d9ad7edc25cda000
  • private: a95f97cfc1a61dd833b882c89d36a78a030ea6b2fbe3ae2a70e4f1fc9008d6b1
  • public: 00e9506455dce2526df42e5e4eb5585eaef712e5f9c6a28bf9fb175d96595ea872
• Chain m/0_H/1_H/2_H
  • fingerprint: 6569dde7
  • chain code: e1897d5a96459ce2a3d294cb2a6a59050ee61255818c50e03ac4263ef17af084
  • private: 3d6cce04a9175929da907a90b02176077b9ae050dcef9b959fed978bb2200cdc
  • public: 0018f008fcbc6d1cd8b4fe7a9eba00f6570a9da02a9b0005028cb2731b12ee4118
• Chain m/0_H/1_H/2_H/2_H
  • fingerprint: 1b7cce71
  • chain code: 1cccc84e2737cfe81b51fbe4c97bbdb000f6a76eddffb9ed03108fbff3ff7e4f
  • private: 7ae7437efe0a3018999e6f00d72e810ebc50578dbf6728bfa1c7fe73501081a7
  • public: 00512e288a8ef4d869620dc4b06bb06ad2524b350dee5a39fcfeb708dbac65c25c
• Chain m/0_H/1_H/2_H/2_H/1000000000_H
  • fingerprint: de5dcb65
  • chain code: 8ccf15d55b1dda246b0c1bf3e979a471a82524c1bd0c1eaecccf00dde72168bb
  • private: 7a59954d387abde3bc703f531f67d659ec2b8a12597ae82824547d7e27991e26
  • public: 00a077fcf5af53d210257d44a86eb2031233ac7237da220434ac01a0bebccc1919

Test vector 2 for secp256k1

Seed (hex): fffcf9f6f3f0edeae7e4e1dedbd8d5d2cfccc9c6c3c0bdbab7b4b1aeaba8a5a29f9c999693908d8a8784817e7b7875726f6c696663605d5a5754514e4b484542

• Chain m
  • fingerprint: 00000000
  • chain code: 60499f801b896d83179a4374aeb7822aaeaceaa0db1f85ee3e904c4defbd9689
  • private: 4b03d6fc340455b363f51020ad3ecca4f0850280cf436c70c727923f6db46c3e
  • public: 03cbcaa9c98c877a26977d00825c956a238e8dddfbd322cce4f74b0b5bd6ace4a7
• Chain m/0
  • fingerprint: bd16bee5
  • chain code: f0909affaa7ee7abe5dd4e100598d4dc53cd709d5a5c2cac40e7412f232f7c9c
  • private: abe74a98f6c7eabee0428f53798f0ab8aa1bd37873999041703c742f15ac7e1e
  • public: 02fc9e5af0ac8d9b3cecfe2a888e2117ba3d089d8585886c9c826b6b22a98d12ea
• Chain m/0/2147483647_H
  • fingerprint: 5a61ff8e
  • chain code: be17a268474a6bb9c61e1d720cf6215e2a88c5406c4aee7b38547f585c9a37d9
  • private: 877c779ad9687164e9c2f4f0f4ff0340814392330693ce95a58fe18fd52e6e93
  • public: 03c01e7425647bdefa82b12d9bad5e3e6865bee0502694b94ca58b666abc0a5c3b
• Chain m/0/2147483647_H/1
  • fingerprint: d8ab4937
  • chain code: f366f48f1ea9f2d1d3fe958c95ca84ea18e4c4ddb9366c336c927eb246fb38cb
  • private: 704addf544a06e5ee4bea37098463c23613da32020d604506da8c0518e1da4b7
  • public: 03a7d1d856deb74c508e05031f9895dab54626251b3806e16b4bd12e781a7df5b9
• Chain m/0/2147483647_H/1/2147483646_H
  • fingerprint: 78412e3a
  • chain code: 637807030d55d01f9a0cb3a7839515d796bd07706386a6eddf06cc29a65a0e29
  • private: f1c7c871a54a804afe328b4c83a1c33b8e5ff48f5087273f04efa83b247d6a2d
  • public: 02d2b36900396c9282fa14628566582f206a5dd0bcc8d5e892611806cafb0301f0
• Chain m/0/2147483647_H/1/2147483646_H/2
  • fingerprint: 31a507b8
  • chain code: 9452b549be8cea3ecb7a84bec10dcfd94afe4d129ebfd3b3cb58eedf394ed271
  • private: bb7d39bdb83ecf58f2fd82b6d918341cbef428661ef01ab97c28a4842125ac23
  • public: 024d902e1a2fc7a8755ab5b694c575fce742c48d9ff192e63df5193e4c7afe1f9c

Test vector 2 for nist256p1

Seed (hex): fffcf9f6f3f0edeae7e4e1dedbd8d5d2cfccc9c6c3c0bdbab7b4b1aeaba8a5a29f9c999693908d8a8784817e7b7875726f6c696663605d5a5754514e4b484542

• Chain m
  • fingerprint: 00000000
  • chain code: 96cd4465a9644e31528eda3592aa35eb39a9527769ce1855beafc1b81055e75d
  • private: eaa31c2e46ca2962227cf21d73a7ef0ce8b31c756897521eb6c7b39796633357
  • public: 02c9e16154474b3ed5b38218bb0463e008f89ee03e62d22fdcc8014beab25b48fa
• Chain m/0
  • fingerprint: 607f628f
  • chain code: 84e9c258bb8557a40e0d041115b376dd55eda99c0042ce29e81ebe4efed9b86a
  • private: d7d065f63a62624888500cdb4f88b6d59c2927fee9e6d0cdff9cad555884df6e
  • public: 039b6df4bece7b6c81e2adfeea4bcf5c8c8a6e40ea7ffa3cf6e8494c61a1fc82cc
• Chain m/0/2147483647_H
  • fingerprint: 946d2a54
  • chain code: f235b2bc5c04606ca9c30027a84f353acf4e4683edbd11f635d0dcc1cd106ea6
  • private: 96d2ec9316746a75e7793684ed01e3d51194d81a42a3276858a5b7376d4b94b9
  • public: 02f89c5deb1cae4fedc9905f98ae6cbf6cbab120d8cb85d5bd9a91a72f4c068c76
• Chain m/0/2147483647_H/1
  • fingerprint: 218182d8
  • chain code: 7c0b833106235e452eba79d2bdd58d4086e663bc8cc55e9773d2b5eeda313f3b
  • private: 974f9096ea6873a915910e82b29d7c338542ccde39d2064d1cc228f371542bbc
  • public: 03abe0ad54c97c1d654c1852dfdc32d6d3e487e75fa16f0fd6304b9ceae4220c64
• Chain m/0/2147483647_H/1/2147483646_H
  • fingerprint: 931223e4
  • chain code: 5794e616eadaf33413aa309318a26ee0fd5163b70466de7a4512fd4b1a5c9e6a
  • private: da29649bbfaff095cd43819eda9a7be74236539a29094cd8336b07ed8d4eff63
  • public: 03cb8cb067d248691808cd6b5a5a06b48e34ebac4d965cba33e6dc46fe13d9b933
• Chain m/0/2147483647_H/1/2147483646_H/2
  • fingerprint: 956c4629
  • chain code: 3bfb29ee8ac4484f09db09c2079b520ea5616df7820f071a20320366fbe226a7
  • private: bb0a77ba01cc31d77205d51d08bd313b979a71ef4de9b062f8958297e746bd67
  • public: 020ee02e18967237cf62672983b253ee62fa4dd431f8243bfeccdf39dbe181387f

Test vector 2 for ed25519

Seed (hex): fffcf9f6f3f0edeae7e4e1dedbd8d5d2cfccc9c6c3c0bdbab7b4b1aeaba8a5a29f9c999693908d8a8784817e7b7875726f6c696663605d5a5754514e4b484542

• Chain m
  • fingerprint: 00000000
  • chain code: ef70a74db9c3a5af931b5fe73ed8e1a53464133654fd55e7a66f8570b8e33c3b
  • private: 171cb88b1b3c1db25add599712e36245d75bc65a1a5c9e18d76f9f2b1eab4012
  • public: 008fe9693f8fa62a4305a140b9764c5ee01e455963744fe18204b4fb948249308a
• Chain m/0_H
  • fingerprint: 31981b50
  • chain code: 0b78a3226f915c082bf118f83618a618ab6dec793752624cbeb622acb562862d
  • private: 1559eb2bbec5790b0c65d8693e4d0875b1747f4970ae8b650486ed7470845635
  • public: 0086fab68dcb57aa196c77c5f264f215a112c22a912c10d123b0d03c3c28ef1037
• Chain m/0_H/2147483647_H
  • fingerprint: 1e9411b1
  • chain code: 138f0b2551bcafeca6ff2aa88ba8ed0ed8de070841f0c4ef0165df8181eaad7f
  • private: ea4f5bfe8694d8bb74b7b59404632fd5968b774ed545e810de9c32a4fb4192f4
  • public: 005ba3b9ac6e90e83effcd25ac4e58a1365a9e35a3d3ae5eb07b9e4d90bcf7506d
• Chain m/0_H/2147483647_H/1_H
  • fingerprint: fcadf38c
  • chain code: 73bd9fff1cfbde33a1b846c27085f711c0fe2d66fd32e139d3ebc28e5a4a6b90
  • private: 3757c7577170179c7868353ada796c839135b3d30554bbb74a4b1e4a5a58505c
  • public: 002e66aa57069c86cc18249aecf5cb5a9cebbfd6fadeab056254763874a9352b45
• Chain m/0_H/2147483647_H/1_H/2147483646_H
  • fingerprint: aca70953
  • chain code: 0902fe8a29f9140480a00ef244bd183e8a13288e4412d8389d140aac1794825a
  • private: 5837736c89570de861ebc173b1086da4f505d4adb387c6a1b1342d5e4ac9ec72
  • public: 00e33c0f7d81d843c572275f287498e8d408654fdf0d1e065b84e2e6f157aab09b
• Chain m/0_H/2147483647_H/1_H/2147483646_H/2_H
  • fingerprint: 422c654b
  • chain code: 5d70af781f3a37b829f0d060924d5e960bdc02e85423494afc0b1a41bbe196d4
  • private: 551d333177df541ad876a60ea71f00447931c0a9da16f227c11ea080d7391b8d
  • public: 0047150c75db263559a70d5778bf36abbab30fb061ad69f69ece61a72b0cfa4fc0

Test vector 2 for curve25519

Seed (hex): fffcf9f6f3f0edeae7e4e1dedbd8d5d2cfccc9c6c3c0bdbab7b4b1aeaba8a5a29f9c999693908d8a8784817e7b7875726f6c696663605d5a5754514e4b484542

• Chain m
  • fingerprint: 00000000
  • chain code: b62c0c81a80a0ee16b977abb3677eb47549d0eef090f7a6c2b2010e739875e34
  • private: 088491f5b4dfafbe956de471f3db10e02d784bc76050ee3b7c3f11b9706d3730
  • public: 0060cc3b40567729af08757e1efe62536dc864a57ec582f98b96f484201a260c7a
• Chain m/0_H
  • fingerprint: 75edaf13
  • chain code: 341f386e571229e8adc52b82e824532817a31a35ba49ae334424e7228d020eed
  • private: 8e73218a1ba5c7b95e94b6e7cf7b37fb6240fb3b2ecd801402a4439da7067ee2
  • public: 007992b3f270ef15f266785fffb73246ad7f40d1fe8679b737fed0970d92cc5f39
• Chain m/0_H/2147483647_H
  • fingerprint: 5b26da66
  • chain code: 942cbec088b4ae92e8db9336025e9185fec0985a3da89d7a408bc2a4e18a8134
  • private: 29262b215c961bae20274588b33955c36f265c1f626df9feebb51034ce63c19d
  • public: 002372feac417c38b833e1aba75f2420278122d698605b995cafc2fed7bb453d41
• Chain m/0_H/2147483647_H/1_H
  • fingerprint: f701c832
  • chain code: fe02397ae2ca71efe455f470fb23928baf026360a9e9090e21958f6fba9efc30
  • private: a4d2474bd98c5e9ff416f536697b89949627d6d2c384b81a86d29f1136f4c2d1
  • public: 00eca4fd0458d3f729b6218eda871b350fa8870a744caf6d30cd84dad2b9dd9c2d
• Chain m/0_H/2147483647_H/1_H/2147483646_H
  • fingerprint: 6063347b
  • chain code: b3b49d550e732ee629f4aeb4bf7213c3ae0f239fd10add513253cddbb8efb868
  • private: d3500d9b30529c51d92497eded1d68d29f60c630c45c61a481c185e574c6e5cf
  • public: 00edaa3d381a2b02f40a80d69b2ce7ba7c3c4a9421744808857cd48c50d29b5868
• Chain m/0_H/2147483647_H/1_H/2147483646_H/2_H
  • fingerprint: 86bf4fed
  • chain code: f6ded904046e9758b9388dbf95ea5db837ab98b03b00e4db7009a8e3ac077685
  • private: e20fecd59312b63b37eee27714465aae1caa1c87840abd0d685ea88b3d598fdf
  • public: 00aa705de68066e9534a238af35ea77c48016462a8aff358d22eaa6c7d5b034354

Test derivation retry for nist256p1

Seed (hex): 000102030405060708090a0b0c0d0e0f

• Chain m
  • fingerprint: 00000000
  • chain code: beeb672fe4621673f722f38529c07392fecaa61015c80c34f29ce8b41b3cb6ea
  • private: 612091aaa12e22dd2abef664f8a01a82cae99ad7441b7ef8110424915c268bc2
  • public: 0266874dc6ade47b3ecd096745ca09bcd29638dd52c2c12117b11ed3e458cfa9e8
• Chain m/28578_H
  • fingerprint: be6105b5
  • chain code: e94c8ebe30c2250a14713212f6449b20f3329105ea15b652ca5bdfc68f6c65c2
  • private: 06f0db126f023755d0b8d86d4591718a5210dd8d024e3e14b6159d63f53aa669
  • public: 02519b5554a4872e8c9c1c847115363051ec43e93400e030ba3c36b52a3e70a5b7
• Chain m/28578_H/33941
  • fingerprint: 3e2b7bc6
  • chain code: 9e87fe95031f14736774cd82f25fd885065cb7c358c1edf813c72af535e83071
  • private: 092154eed4af83e078ff9b84322015aefe5769e31270f62c3f66c33888335f3a
  • public: 0235bfee614c0d5b2cae260000bb1d0d84b270099ad790022c1ae0b2e782efe120

Test seed retry for nist256p1

Seed (hex): a7305bc8df8d0951f0cb224c0e95d7707cbdf2c6ce7e8d481fec69c7ff5e9446

• Chain m
  • fingerprint: 00000000
  • chain code: 7762f9729fed06121fd13f326884c82f59aa95c57ac492ce8c9654e60efd130c
  • private: 3b8c18469a4634517d6d0b65448f8e6c62091b45540a1743c5846be55d47d88f
  • public: 0383619fadcde31063d8c5cb00dbfe1713f3e6fa169d8541a798752a1c1ca0cb20

Implementation

• Python implementation to generate test vectors
• .NET Standard 2.0 Implementation
• Swift implementation
• Kotlin implementation

References

• BIP-0032: Hierarchical Deterministic Wallets
• BIP-0039: Mnemonic code for generating deterministic keys
• SLIP-0039: Shamir's Secret-Sharing for Mnemonic Codes
• RFC 8032: Edwards-Curve Digital Signature Algorithm (EdDSA)
• RFC 7748: Elliptic Curves for Security