<pre>
BIP:
Layer: Applications
Title: Versioned BIP39 Mnemonic Phrases
Author: Leslie <0300dbd...@protonmail.com>
Status: None
Type: Standards Track
Created: 2024-01-10
</pre>
## Abstract
This BIP proposes an enhancement to the BIP39 mnemonic phrases by introducing a
version field.
The version field will be a 32-bit field, prepended to the entropy of the BIP39
mnemonic phrase.
The first 24 bits are for general purposes, and the subsequent 8 bits are for
defining the version used.
## Motivation
The current implementation of BIP39 mnemonic phrases lacks a crucial feature:
versioning.
This omission has been identified as a significant design flaw, affecting the
robustness and future-proofness of the mnemonic phrase generation and usage.
Notable community members and projects have expressed concerns over this
shortcoming:
>The lack of versioning is a serious design flaw in this proposal. On this
>basis alone I would recommend against use of this proposal.
\- [Greg Maxwell
2017-03-14](https://github.com/bitcoin/bips/wiki/Comments:BIP-0039/fd2ddb6d840c6a91c98a29146b9a62d6a65d03bf)
Furthermore, the absence of a version number in BIP39 seed phrases poses risks
and inefficiencies in wallet software development and backward compatibility:
>BIP39 seed phrases do not include a version number. This means that software
>should always know how to generate keys and addresses. BIP43 suggests that
>wallet software will try various existing derivation schemes within the BIP32
>framework. This is extremely inefficient and rests on the assumption that
>future wallets will support all previously accepted derivation methods. If, in
>the future, a wallet developer decides not to implement a particular
>derivation method because it is deprecated, then the software will not be able
>to detect that the corresponding seed phrases are not supported, and it will
>return an empty wallet instead. This threatens users funds.
>
>For these reasons, Electrum does not generate BIP39 seeds.
\- [Electrum Documentation
2017-01-27](https://electrum.readthedocs.io/en/latest/seedphrase.html#motivation)
The proposed BIP aims to address these concerns by introducing a version field
in the BIP39 mnemonic phrases.
The introduction of versioning is expected to enhance the mnemonic's
adaptability to future changes, improve the efficiency of wallet software in
handling different derivation methods, and secure users funds by reducing the
risk of incompatibilities between mnemonic phrases and wallet implementations.
## Generating the Mnemonic
In this proposal, we build upon the structure of BIP39 to include a versioned
enhancement in the mnemonic generation process. The mnemonic encodes entropy,
as in BIP39, but with a flexible approach to the size of the initial entropy
(ENT).
### Version Field Inclusion:
1. **Initial Entropy Generation:**
The initial entropy of ENT bits is generated, where ENT can be any size as long
as it is a multiple of 32 bits.
2. **Version Field Prepending:**
A crucial addition to this process is the prepending of a 32-bit version field
to the initial entropy. This field is composed of:
- The first 24 bits are reserved for general purposes, which can be utilized
for various enhancements or specific wallet functionalities.
- The remaining 8 bits are designated for specifying the version of the BIP39
standard.
3. **Checksum Calculation:**
A checksum is generated following the BIP39 method: taking the first (ENT + VF
) / 32 bits of the SHA256 hash of the combined entropy (initial entropy plus
the 32-bit version field). This checksum is then appended to the combined
entropy.
4. **Concatenation and Splitting:**
The combined entropy, including the initial entropy, version field, and
checksum, is split into groups of 11 bits. Each group of bits corresponds to an
index in the BIP39 wordlist.
5. **Mnemonic Sentence Formation:**
The mnemonic sentence is formed by converting these 11-bit groups into words
using the standard BIP39 wordlist.
## Compatibility Considerations
- **Backward Compatibility:** Systems designed for BIP39, unaware of the 32-bit
extension, will interpret the mnemonic as a 'Legacy' BIP39 phrase.
- **Forward Compatibility:** The versioning mechanism prepares systems for
future modifications to the BIP39 standard, facilitating seamless integration.
## Dictionary Dependency
Wallets will still require access to the predefined BIP39 dictionary to
retrieve the version of the mnemonic seed and validate the checksum.
> 💡 It's noteworthy that the BIP39 English wordlist includes specific words
> that software can use to identify the mnemonic's version number in a
> user-friendly manner, reducing dependence on the wordlist for version
> recognition.
>
> One way to achieve this is by assigning the first 22
> bits of the reserved field to match these words.
>
> 11110010110 11111111101 : version zero
> 11110010110 10011010101 : version one
> 11110010110 11101011101 : version two
> 11110010110 11100001000 : version three
> ...
> 11110010110 01101111001 : version hundred
## Changing Derivation Methods
The introduction of mnemonic versioning provides the flexibility to adopt
alternative entropy derivation methods in the future. While BIP39 currently
uses PBKDF2 for key stretching, future versions could employ different
mechanisms to meet evolving cryptographic standards and requirements.
> 💡 Changing the derivation method in versioned mnemonics could lead to
> compatibility issues with older software.
## References
1. [Bitcoin Improvement Proposals. BIP39: Mnemonic code for generating
deterministic
keys](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki)2.
[bip39-versioned](https://github.com/lukechilds/bip39-versioned)
_______________________________________________
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
