How are addresses calculated from the seed?

I was wondering how addresses are calculated from the seed. Specifically, I thought it was using the hash of the seed plus a nonce to create the address. But I would appreciate if someone could shed a bit more light on the technical details.

• What is your specific concern? Dec 11, 2017 at 12:50
• Mainly curiosity how it works. From https://iotasupport.com/how-addresses-are-used-in-IOTA.shtml: ... a new address is generated it is calculated from the combination of a seed + Address Index, where the Address Index can be any positive Integer (including "0")[...] starts from Address Index 0, but it will skip any Address Index where [...] address has already been attached to the tangle. I was wondering what hashing function is used and how the address index (nonce?) and how the check is performed for existing addresses. Dec 11, 2017 at 16:57

• First, a subseed is derived from the seed

• Treat the seed as a (little-endian) number and add the index to it (a seed starting `FEDCBA...` and an index of 1 therefore results in `GEDCBA...`.
• Hash the result of the previous step with Kerl (keccak)
• Then, a private key is derived from the subseed. The private key consists of multiple blocks (number depends on security and the Winternitz signing scheme) which are each of the length of the hash. The first block is the hash of the subseed. Every subsequent block is the hash of the previous block, with all bits/trits flipped (for Curl it was the trits, but for Kerl the bits after converting to binary).

• Last, a public key is derived, which is the address. For this, first every block of the private key is hashed 26 times (so the later Winternitz signing can decide to reveal each block in 27 different ways, by hashing 0 times to 26 times). Then the resulting hashed blocks are hashed together to build the public key.

• For public representation (in wallets, etc.) a 9-tryte checksum (to detect typos) is added so that the address has 90 trytes instead of 81

I assume that the flipping of the bits is done so that the intermediate hashes for each block differ from the intermediate hashes of other blocks (if a block was just the hashed version of the previous one, the intermediate hashes would overlap, therefore making it easy to break the signatures). But anyone feel free to correct me here if I am wrong.

• Kerl or SHA-3? I thought I read that Kerl was unsafe and they switched to SHA-3?
– w00t
Dec 11, 2017 at 22:24
• The unsafe one is called Curl. Kerl is just convert-trinary-to-binary, then SHA-3, then convert-back-to-trinary
– mihi
Dec 12, 2017 at 21:48
• The "private key" part is not accurate. The subseed is hashed two times with Kerl, and then just squeezed (see keccak algorithm) to get the resulting blocks. Jan 23, 2018 at 23:09