How to import a HD wallet from an extended private key

I'd like to export a derived private key from my Electrum HD wallet, and use it as a HD wallet master key in a Mycelium wallet.

I used bx to get the key like this (m/2'/0) (where m is the unencrypted xprv key extracted from default_wallet JSON):

$ cat m | bx hd-private --index 2 --hard \
        | bx hd-to-wif | qrencode -o - | feh -

And scanned the resulting QR code in Mycelium using the "Add Unrelated Account/Scan".

The wallet works, but it's treated as a "single-address" wallet, not a HD wallet. I presumed that the derived xprv can be used as a master key for deriving more keys, since it contains the chaincode. Is that not the case?

Also, the Mycelium "Add Unrelated Account" screen says that

Scan Bitcoin address, private key or HD-Account.

What format does "HD-Account" mean? Is it WIF?

UPDATE: To make it clear, the key thing I want is to have a HD account in Mycelium, whith a master key derived from my Electrum HD wallet.

The purpose of this is to have only one seed to ~~remember~~ store - the seed of the Electrum wallet. If my phone is lost, or my Mycelium wallet is compromised, I only have to derive it's master key again from my Electrum master key, reconstruct the wallet keys, take the money and run. And since the Mycelium master key is hardened, I don't have to worry about the rest of the tree being compromised, even if the master public key leaks.

Based on answers of Christopher Gurnee and Wizard of Ozzie, I could build a diagram to make it more clear:

Two-level HD wallet paths

UPDATE 2: Updated diagram to match Mycelium's behavior of treating imported extended private keys.

sevcsik

Posted 2015-04-21T10:29:27.877

Reputation: 163

Two quick comments on the updated question: (1) "The purpose of this is to have only one seed to remember"—I always cringe when I hear someone who say this, i.e. someone who thinks they have an infallible memory that's immune to change/disease/etc... I do hope you've considered this. (2) In the m/2'/44'/0'/..., why bother with the 44'/0' part? By starting with m/2', you're already nonstandard, you may as just well use something simpler like m/2'/c/i, yes? – Christopher Gurnee – 2015-04-21T21:36:32.637

I don't actually remember it, at least not for now :) but I was under the impression that mnemonics were introduced in the standard because they are easier for the human brain then a random number (which is much more efficient to store) – sevcsik – 2015-04-21T21:40:34.007

(2): I kept the she standard-ish pattern, because I cannot modify how does Mycelium derives the keys (besides modifying the code). The only derivation I have control over is the dashed line, all other derivation paths are hardcoded in the wallets. – sevcsik – 2015-04-21T21:42:58.780

Mnemonics were introduced because they're easier to write down, they were never intended to be easy to remember. I certainly can't remember mine ;-). Regarding (2): understood, I'll update my answer. – Christopher Gurnee – 2015-04-21T21:45:42.630

Ah, I see. I thought an integer should be easier to be written down, but now as I gave it a bit more thought, I see that having a predefined dictionaty makes it less prone to errors. – sevcsik – 2015-04-21T21:55:36.437

Answers

Response to clarified first part

You're pretty close, I suspect you want something simpler like this (and then typing in the xprv you extracted from an Electrum 2.x (unencrypted) wallet file):

bx hd-private --index 2 --hard | qrencode -o - | feh -

In particular, don't include the bx hd-to-wif step, that's probably what's tripping you up.

When you do the import/add-new-account in Mycelium (2.3.0+ required), make sure you're choosing the Advanced option, and then do the scan.

Once you're done, the resulting keys/addresses will be along a path of m/2'/c/i.[1]

If you ever need to do a recovery (i.e. if you lose your phone), you can import the same xprv you imported into Mycelium into a new wallet in Electrum (using the restore wallet option). It may not be documented, but Electrum 2.x will also accept an xprv during a restore, and then it will generate the same c/i path that Mycelium uses for imported xprvs.

I haven't tested any of this though... please test it out before relying on it!

Response to original first part

(this is mostly irrelevant to the clarified question)

To answer the first part of your question:

An Electrum 2.x extended master private key can be directly imported imported into Mycelium for Android (version 2.3.0+), no conversions or path derivations are required. It will result in the same list of addresses being generated in both Electrum 2.x and Mycelium. It turns out you were just overthinking the problem ;-)

This means you can just run qrencode -o - | feh - and paste your extracted xprv directly in.

More details on inter-wallet compatibility can be found here: https://bitcointalk.org/index.php?topic=1000544.0. For your specific case of exporting/importing an xprv, you can look at the third tab in the referenced spreadsheet.

Incidentally, the reason they are compatible isn't obvious. Both use BIP-32, however (as Wizard Of Ozzie already pointed out) Mycelium uses a path of m/44'/0'/a'/c/i, whereas Electrum 2.x uses a path of m/c/i.[1]

What makes them compatible is that Electrum 2.x exports the master key at the root position, however Mycelium assumes that the key was exported at the m/44'/0'/a' position. Mycelium then derives keys by appending an additional c/i path to the imported key, which is the exact same c/i path with Electrum appends to it's root key (m). A diagram might be more clear: Electrum 2.x: m/c/i Mycelium: m/44'/0'/0'/c/i ^^ key being exported/imported

[1]:
a = account index
c = 0 for external, 1 for internal (change)
i = key/address index
' means hardened

Christopher Gurnee

Posted 2015-04-21T10:29:27.877

Reputation: 2 263

Thanks for the elaborate explanation, you made it much clearer how the two trees differ. However, what you're suggesting seems like exactly the opposite of what I want :)

This would work if I wanted to maket my Electrum HD wallet as a "sub-wallet" of Mycelium, but I want it the other way. The point being Electrum is on my home deskop, while Mycelium is on my phone, making it more fragile. I want to be able to recover the latter wallet using my Electrum seed. I edited the question to make this more clear. – sevcsik – 2015-04-21T21:07:02.180

About importing the private key to Mycelium: the problem is I don't know how to do that :) If I scan the xprv in Mycelium, it adds it as an unrelated, single-key wallet (I guess that feature is for importing cold storage). It looks like the only way to start a new HD wallet is to generate a mnemonic seed from entropy, or supply the mnemonics by hand. I see no option to import a master private key instead of generating one from a seed. – sevcsik – 2015-04-21T21:12:17.760

Thanks for the help! Indeed, the hd-to-wif part was that degraded my extended key to a "simple" key. Omitting that step, I could import it correctly. – sevcsik – 2015-04-21T23:18:23.897

"and then typing in the xprv you exported from Electrum 2.x" - I didn't find an option to export the xprv from the GUI, so I extracted it from the wallet JSON file. That had the xprv prefix in place. – sevcsik – 2015-04-21T23:27:08.183

You're right, "exported" was the wrong word, I'll update the answer for future reference. – Christopher Gurnee – 2015-04-21T23:30:09.577

@sevcsik Check my forked pybitcointools. It's basically pbkdf2 with passphrase="13 words in lower case as a string of bytes", salt = b"electrum + password", 2048 rounds with sha512 and 64 byte key length.

– Wizard Of Ozzie – 2015-04-22T02:42:58.270

@WizardOfOzzie Be sure to check the mnemonic's checksum in your code to maintain compatibility with Electrum 2 (and to discourage using your code for brainwallet creation): https://github.com/spesmilo/electrum/blob/6cff7a284ad666a8e77bd127a9fa65fb018ae574/lib/bitcoin.py#L148-L152

– Christopher Gurnee – 2015-04-22T13:42:08.707

@WizardOfOzzie: thanks, I'll check it. @ChristopherGurnee: I tested your howto about importing the sub-wallet from the derived xprv to Electrum, and it works like charm! – sevcsik – 2015-04-22T21:54:54.463

Mycelium uses: m/44'/0'/0'/0 (see this bip39 site). That means /0'/0 (it's BIP44 notation, where m/44'/0'/ means Bitcoin (44), mainnet (0').

The second question is referring to ...

importing a watch only address
importing a non-HD WIF
Importing a master key not generated by mycelium

Wizard Of Ozzie

Posted 2015-04-21T10:29:27.877

Reputation: 4 535

Thanks for making the second part clear. Does that mean that I cannot create a new HD wallet using a master key that was derived from an other HD wallet?

Is this a problem with my understanding of how HD wallets work, or is it just that this feature is missing from Mycelium? – sevcsik – 2015-04-21T12:01:52.180

@sevcsik I'm having trouble getting an imported "correct horse battery staple" testnet import working using https://dcpos.github.io/bip39/

– Wizard Of Ozzie – 2015-04-22T02:35:27.060

Long story short, you can obtain Electrum v1.0 or v.20 seed words from BIP 39 seed words, but not the other way around. The reason this is the case is because BIP 32 technology is not invertible. This is because of sha512 hashing that occurs at each HD path level, especially for paths involving hardened keys. However, Electrum v1.0 seed words are invertible.

Below is a working example that borrows from monero-xmr-bip-3944-technology that mapped BIP 39 seed words for HD wallets to Electrum seed words used by Monero. Instead the example is adapted for Bitcoin.

1. For "radar blur cabbage chef fix engine embark joy scheme fiction master release" BIP 39 seed words, the m/44'/0'/0' key can be calculated as follows:

% echo "radar blur cabbage chef fix engine embark joy scheme fiction master release" | bx mnemonic-to-seed -p "" | bx hd-new | bx hd-private -d -i 44 | bx hd-private -d -i 0 | bx hd-private -d -i 0 xprv9zJMgYvMuqqeogCbj1DtgnaQnGhtR111ifRFS4iq2pBswCmv6fSSLNUSLZF4fjeqFxzSPbJmzJ31UpgWPgypQHP7avzVsoWfKVZQkTXmfYu

2. Associated 256-bit secp256k1 private key can be extracted as follows:

% echo xprv9zJMgYvMuqqeogCbj1DtgnaQnGhtR111ifRFS4iq2pBswCmv6fSSLNUSLZF4fjeqFxzSPbJmzJ31UpgWPgypQHP7avzVsoWfKVZQkTXmfYu | bx hd-to-ec eb82feb0611375043cc53ddf7a89dc8bfed730f1ddf0ad8eb457cedc05eabe63

3. Calculating associated compressed Bitcoin WIF Keys:

% echo eb82feb0611375043cc53ddf7a89dc8bfed730f1ddf0ad8eb457cedc05eabe63 | sed 's/$/01/' | bx base58check-encode -v 128

L57WpCjtCCBrkwmjXSua7nusuQyHWE9pRkwJB16DvjcbwdzuHJ7W

4. Computing corresponding 25 Electrum v1.0 seed words:

% echo eb82feb0611375043cc53ddf7a89dc8bfed730f1ddf0ad8eb457cedc05eabe63 | ./bytes_to_words

biweekly espionage waking bicycle hounded imitate wayside nocturnal jolted imagine value knowledge nozzle bids android orders afield nineteen ponies tawny rarest subtly shipped code tawny

5. Demonstrates Electrum v1.0 words are invertible:

% echo "biweekly espionage waking bicycle hounded imitate wayside nocturnal jolted imagine value knowledge nozzle bids android orders afield nineteen ponies tawny rarest subtly shipped code tawny" | ./inverse_mnemonics eb82feb0611375043cc53ddf7a89dc8bfed730f1ddf0ad8eb457cedc05eabe63

Code for bytes_to_words and inverse_mnemonics is available at https://github.com/skaht/XMR.

For obtaining Electrum v2.0 words, see corresponding electrum-new and electrum-to-seed commands.

skaht

Posted 2015-04-21T10:29:27.877

Reputation: 2 588