9

I was wondering how addresses are calculated from the seed. Specifically, I thought it was using the hash of the seed plus a nonce to create the address. But I would appreciate if someone could shed a bit more light on the technical details.

Improve this question
3
  • What is your specific concern?
    – Helmar
    Dec 11, 2017 at 12:50
  • Mainly curiosity how it works. From https://iotasupport.com/how-addresses-are-used-in-IOTA.shtml: ... a new address is generated it is calculated from the combination of a seed + Address Index, where the Address Index can be any positive Integer (including "0")[...] starts from Address Index 0, but it will skip any Address Index where [...] address has already been attached to the tangle. I was wondering what hashing function is used and how the address index (nonce?) and how the check is performed for existing addresses.
    – Dominik Harz
    Dec 11, 2017 at 16:57
  • I’m voting to close this question because it is about the legacy-network and it is a good idea to keep only Shimmer/ShimmerEVM and latest IOTA Chrysalis questions
    – Antonio Nardella
    Apr 24 at 14:05

1 Answer 1

Reset to default
10

  • First, a subseed is derived from the seed

    • Treat the seed as a (little-endian) number and add the index to it (a seed starting FEDCBA... and an index of 1 therefore results in GEDCBA....
    • Hash the result of the previous step with Kerl (keccak)

  • Then, a private key is derived from the subseed. The private key consists of multiple blocks (number depends on security and the Winternitz signing scheme) which are each of the length of the hash. The first block is the hash of the subseed. Every subsequent block is the hash of the previous block, with all bits/trits flipped (for Curl it was the trits, but for Kerl the bits after converting to binary).

  • Last, a public key is derived, which is the address. For this, first every block of the private key is hashed 26 times (so the later Winternitz signing can decide to reveal each block in 27 different ways, by hashing 0 times to 26 times). Then the resulting hashed blocks are hashed together to build the public key.

  • For public representation (in wallets, etc.) a 9-tryte checksum (to detect typos) is added so that the address has 90 trytes instead of 81

I assume that the flipping of the bits is done so that the intermediate hashes for each block differ from the intermediate hashes of other blocks (if a block was just the hashed version of the previous one, the intermediate hashes would overlap, therefore making it easy to break the signatures). But anyone feel free to correct me here if I am wrong.

Improve this answer
3
  • 1
    Kerl or SHA-3? I thought I read that Kerl was unsafe and they switched to SHA-3?
    – w00t
    Dec 11, 2017 at 22:24
  • 2
    The unsafe one is called Curl. Kerl is just convert-trinary-to-binary, then SHA-3, then convert-back-to-trinary
    – mihi ♦
    Dec 12, 2017 at 21:48
  • 1
    The "private key" part is not accurate. The subseed is hashed two times with Kerl, and then just squeezed (see keccak algorithm) to get the resulting blocks.
    – Pomyk
    Jan 23, 2018 at 23:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.