Recovering your Ledger Enterprise Master Seed
In this article we describe how the Ledger Enterprise master seed is computed from the three shared-owners’ individual seeds, and how you can recover it at any time from the three shared-owner recovery phrases.
Details of the procedure are provided mainly for transparency and educational purposes. In case of recovery, it is highly recommended to recompute your master seed offline on a Ledger Nano device, following the procedure described here.
Summary
In recovery scenarios, the Ledger Enterprise master seed and master key can be recomputed from the three Shared Owners recovery phrases using open source tools and can be used to reseed another wallet.
Generation of BIP39 seeds from shared-owner PSDs
During the key ceremony, each Shared Owner’s PSD generates a unique 256-bit entropy sequence using the device’s True Random Number Generator. Following BIP39, each 256-bit entropy sequence is encoded into a 24-word recovery phrase that is displayed on the device and stored by the shared-owner on a cryptosteel for recovery scenarios. A unique 512-bit BIP39 seed is then derived from each Shared Owner’s 256-entropy sequence using the PBKDF2 algorithm.
Remark: As part of BIP39, when applying PBKDF2 to derive a seed, an optional passphrase can be provided as input to the algorithm. During the Ledger Enterprise workspace’s derivation process, no passphrases are used.
For a single seed wallet, at this stage the wallet master key would finally be derived from the BIP39 seed using the HMAC-512 algorithm. For Ledger Enterprise, the process is slightly different and the next section describes how the Ledger Enterprise master seed is derived from the three shared-owners’ individual seeds.
Deriving master seed fragments
Three master seed fragments are derived from the three Shared Owner individual seeds using BIP32:
Each shared owner 512-bit BIP39 seed is first derived into a master key following the BIP32 standard.
A master seed fragment is then obtained from each shared-owner BIP32 master key by computing the 512-bit derived key corresponding to the custom derivation path m/VLT’/KEY’.
Combining master seed fragments
Finally, the three derived master seed fragments are XORed together to produce the Ledger Enterprise unique master seed.
Remark: The XOR operation is performed on the Ledger Enterprise’s HSM after the three Shared Owners’ seeds have been transferred from the PSDs to the HSM through a secure cryptographic channel. This ensures that the master seed is kept secret, and that it never leaves the secure enclave of the HSM.
The Ledger Enterprise master seed is then used to compute the BIP32 Ledger Enterprise master key that corresponds to the root key of the wallet used to derive all accounts’ keys and addresses.
Remark: Because of the key derivation and the fact that PBKDF2 is a one way function, we cannot go backward and encode the Ledger Enterprise master seed into a BIP39 24-word recovery phrase.
Recomputing the Ledger Enterprise master seed and master key
Using the steps presented above, it is possible to recompute manually the Ledger Enterprise master seed from the shared-owners’ recovery phrases using open source libraries such as bip-utils.
Ledger also provides an open-source tool that can be used to directly recompute the Ledger Enterprise master seed and master key from the three recovery phrases.
Security recommendations
Again, it is not recommended to recompute your master seed yourself, and we advise following the default recovery procedure that uses a Nano S device (a recovery procedure is also possible with a Nano S Plus, as explained here). This method ensures that your master seed is generated offline and protected in the secure environment of the Nano device.
In case you need to recompute your master seed yourself, for example to re-seed another wallet, it is recommended to run the recovery operations offline, on an air-gap computer, and to never reconnect this machine until your funds have been fully transferred to a new cold wallet.
Last updated