From Wallet Seed to Ethereum Address: Hashing, Key Derivation and Cryptographic Primitives

Boxes are data, arrows are operations. Every arrow is deterministic except the first. After the entropy is drawn, the whole wallet (every key, every address) can be recomputed from the words alone.

1. Entropy128–256 random bits
2. CSPRNGkey generation
3. Mnemonic12–24 words
4. BIP-39 append SHA-256 checksum bits, split into 11-bit word indicesencodingchecksum
5. Seed512 bits
6. BIP-39 PBKDF2-HMAC-SHA512, 2048 rounds, salt "mnemonic" + passphrasekey derivation
7. Master key + chain code256 + 256 bits
8. BIP-32 child derivation along the BIP-44 path m/44'/60'/0'/0/ikey derivation
9. Private key k256 bits, 1 ≤ k < n
10. secp256k1 Q = kGpublic-key crypto
11. Public key64 bytes, X ‖ Y
12. Keccak-256, keep the last 20 byteshashing
13. Address20 bytes, 40 hex digits
14. EIP-55 uppercase hex letters chosen by Keccak-256(address)checksumencoding
15. Checksummed address0xf39Fd6e5…b92266

Generation vs derivation: generation answers "where does the secret come from?" (randomness). Derivation answers "how do I get more keys out of it?" (a deterministic function). A wallet does one generation and unlimited derivations. That is why backing up 12 words backs up every account the wallet will ever create.

Test phrases only. The demo generates new phrases or loads public test phrases, and runs entirely in the browser. Never type a real recovery phrase into any website.

1. 1 · Entropy

   key generation

   Random bits from crypto.getRandomValues (a CSPRNG). For the test phrases, the bits are recovered from the words.

   hex

2. 2 · Mnemonic (BIP-39)

   encodingchecksum

   ENT bits + CS = ENT/32 bits of SHA-256(entropy), cut into 11-bit groups. Each group indexes one of 2048 words. Click a word to replace it with a random one and watch the checksum fail (it survives about 1 time in 16).

3. 3 · Seed

   key derivation

   PBKDF2(HMAC-SHA512, password = mnemonic, salt = "mnemonic" + passphrase, 2048 rounds, 64 bytes). The rounds slow down brute force. The passphrase has no checksum: every passphrase opens a valid but different wallet.

   seed

4. 4 · HD derivation (BIP-32 along a BIP-44 path)

   key derivation

   Master: I = HMAC-SHA512("Bitcoin seed", seed). Each child: I = HMAC-SHA512(chain code, data), child key = (I_L + parent key) mod n. A prime ′ marks a hardened index (≥ 2³¹), whose data is the parent private key. Normal indices hash the parent public key.

   Path	Level (BIP-44)	Hardened	Private key	Chain code

5. 5 · Private key

   key derivation (result)
   k

6. 6 · Public key (secp256k1)

   public-key crypto

   Q = kG on y² = x³ + 7 over F_p, p = 2²⁵⁶ − 2³² − 977. This is the same computation as Part 1 on a curve of size ≈ 2²⁵⁶. It is written as 04 ‖ X ‖ Y.

   04 ‖ X ‖ Y

7. 7 · Keccak-256 → address

   hashing

   Hash the 64 bytes X ‖ Y (without the 04 prefix) and keep the last 20 bytes, highlighted below.

   Keccak-256
   address

8. 8 · EIP-55 checksum

   checksumencoding

   Hash the lowercase hex text with Keccak-256. Each letter a–f is uppercased when the hash nibble at the same position is ≥ 8. Digits 0–9 carry no information.

   Checksummed address

Monte Carlo estimates of the probabilities above, using the same code as the demo. Intervals are 95% Wilson score intervals. The experiments start when this section scrolls into view and take a few seconds. A 95% interval misses the true value 1 time in 20, so an occasional "outside" is expected. Press run again and it should move.

A · BIP-39 checksum: how often does a wrong phrase pass?

B · EIP-55: how often does a typo pass?

A random address gets one character replaced and is checked against its EIP-55 checksum. Each letter a–f carries one check bit, so a typo passes only when all the letter cases still happen to match: about (13/16)⁴⁰ ≈ 0.0247% of the time.

Letters per address

number of a–f characters in random addresses vs Binomial(40, 6/16)

C · Keccak-256 avalanche

D · Are addresses uniform?

The milestones of the wallet pipeline, in chronological order.

1. 1977
   RSA (Rivest, Shamir, Adleman): first practical public-key encryption and signature scheme, based on factoring.
2. 2001
   SHA-2 family (SHA-256, SHA-512) published by NIST.
3. 2012
   Keccak wins SHA-3 (October). BIP-32 (Wuille): hierarchical deterministic wallets.
4. 2013
   BIP-39: mnemonic code for generating deterministic keys.
5. 2014
   BIP-44: multi-account hierarchy and coin types. Ethereum's yellow paper specifies Keccak-256 as submitted, with the original padding. The same year NIST's draft FIPS 202 adds domain-separation bits.
6. 2015
   SHA-3 standardized (FIPS 202, August). Ethereum mainnet launches in July with Keccak-256, so "SHA3" in Ethereum code means Keccak-256.
7. 2016
   EIP-55: mixed-case checksum addresses.

The order explains the oddities: Ethereum adopted Keccak between the competition win and the final standard, and the Bitcoin-era wallet standards (BIP-32/39/44, all using SHA-2/HMAC) were reused unchanged for Ethereum by choosing coin type 60.

The deep reason, linking Part 1 and Part 2: the properties conflict. Public-key cryptography and xpub derivation need algebraic structure (a homomorphism). Addresses and checksums need the absence of structure (random-function behaviour). No single primitive can be both, so the pipeline alternates between them: structured where structure is useful, hashed where it would leak or bias.