Keys, Seeds & Wallet Internals
How private keys, mnemonic seeds, and HD wallets actually work under the hood.
- 01Explain how ECDSA and secp256k1 produce a key pair from entropy
- 02Trace the derivation path from a BIP-39 mnemonic to a set of addresses
- 03Evaluate the security trade-offs of different mnemonic backup strategies
- 04Verify a signature manually using a block explorer
Entropy to Private Key
Every wallet begins with entropy — random bytes sourced from your operating system's CSPRNG. A private key on secp256k1 is a 256-bit integer in the range [1, n-1], where n is the curve order. In practice you never see this number directly; your wallet software turns it into a mnemonic phrase (BIP-39) so that a human can back it up.
The quality of the entropy source matters more than almost any other single factor in wallet security. Hardware wallets use dedicated TRNGs (true random number generators); software wallets rely on the OS. If the entropy is weak — as it was in several early Android Bitcoin wallets — the private key is predictable and the funds are gone.
BIP-32/39/44 Derivation Paths
BIP-39 maps entropy to a mnemonic phrase: 12 or 24 words drawn from a fixed 2,048-word list. The phrase is stretched through PBKDF2 (2,048 rounds of HMAC-SHA512) into a 512-bit seed. BIP-32 then derives a tree of child keys from that seed using HMAC-SHA512 at each level.
BIP-44 standardises the tree shape: m/purpose'/coin'/account'/change/index. This means a single mnemonic can produce keys for Bitcoin, Ethereum, and other chains, each on a separate branch. The apostrophe marks hardened derivation — a child key cannot be used to reconstruct its parent.
Understanding this hierarchy is critical because it determines which addresses your wallet shows, how recovery works when you import a seed into a different wallet, and what is at risk if a single child key is compromised.
Mnemonic Handling and Metal Backups
The mnemonic IS the wallet. If it is lost, the funds are irrecoverable. If it is stolen, the funds are gone. Backup strategy therefore sits at the centre of operational security.
Paper backups degrade — ink fades, paper burns, water destroys. Metal backups (stamped steel plates, Cryptosteel, Billfodl) survive fire and flood but are bulky and still single-point-of-failure. Shamir's Secret Sharing (SLIP-39) splits the mnemonic into N shares of which K are needed to reconstruct — distributing trust across locations and people.
For individuals, a metal backup in a bank safe deposit box plus a fire-resistant home safe is the baseline. For teams, multi-sig (which we will cover in Week 3) is almost always better than splitting a single seed.
- 01Generate a BIP-39 mnemonic using Ian Coleman's tool (offline). Derive the first 5 addresses at m/44'/60'/0'/0/0-4. Verify the first address matches what MetaMask shows when you import the same mnemonic.
- 02Given a signed Ethereum transaction, extract the v, r, s values and use ecrecover to derive the signer's address. Confirm it matches the 'from' field.
- 03Compare the physical durability specifications of three metal backup products. Write a one-paragraph recommendation for a solo founder holding < €50k in crypto.
- ✓A private key is just a large random number; its security depends on the entropy source
- ✓BIP-32/39/44 turn a single mnemonic into a deterministic tree of keys across chains
- ✓Hardened derivation prevents child→parent key recovery
- ✓Mnemonic backup strategy is a risk-management decision, not a one-size-fits-all recipe
- BIP-39 Specification ↗
- Ian Coleman BIP-39 Tool (use offline) ↗
- Mastering Bitcoin, Ch. 5 — Keys & Addresses