# How Neo Implements Hierarchical Deterministic Wallets: BIP-32, BIP-39, and BIP-44 Standards Explained

> Discover how Neo implements hierarchical deterministic wallets using BIP32, BIP39, and BIP44 standards. Learn about mnemonic phrases, key derivation, and derivation paths for secure key management on Neo N3.

- Repository: [The Neo Project/neo](https://github.com/neo-project/neo)
- Tags: deep-dive
- Published: 2026-03-08

---

**Neo implements hierarchical deterministic wallets through three dedicated classes—`Mnemonic` for BIP-39 seed phrases, `ExtendedKey` for BIP-32 master and child key derivation, and `KeyPath` for BIP-44 derivation path parsing—enabling deterministic key generation and recovery across the Neo N3 blockchain.**

The `neo-project/neo` repository provides a complete, standards-compliant implementation of hierarchical deterministic (HD) wallets. By following BIP-32 for key derivation, BIP-39 for mnemonic seed generation, and BIP-44 for multi-account hierarchy, Neo ensures interoperability with modern wallet standards while using the NIST-approved Secp256r1 elliptic curve.

## BIP-39 Mnemonic Implementation: From Seed Phrase to 64-Byte Seed

### Mnemonic Generation and Validation

The `Mnemonic` class in [`src/Neo/Wallets/Mnemonic.cs`](https://github.com/neo-project/neo/blob/main/src/Neo/Wallets/Mnemonic.cs) handles the complete BIP-39 workflow. The `Mnemonic.Create(int bits = 128)` method generates cryptographically secure entropy (128–256 bits in multiples of 32) and maps it to a wordlist based on the current culture. The class implements `IReadOnlyList<string>`, allowing direct enumeration of the mnemonic words.

For recovery scenarios, `Mnemonic.Parse(string mnemonic)` validates the checksum and wordlist membership, ensuring only valid BIP-39 phrases are accepted.

### Seed Derivation via PBKDF2-HMAC-SHA512

The critical `Mnemonic.DeriveSeed(string passphrase = "")` method implements the BIP-39 seed generation algorithm:

- Uses **PBKDF2-HMAC-SHA512** with **2048 iterations**
- Salt construction: `"mnemonic" + passphrase`
- Output: **64-byte seed** ready for BIP-32 master key derivation

This implementation is tested in [`tests/Neo.UnitTests/Wallets/UT_Mnemonic.cs`](https://github.com/neo-project/neo/blob/main/tests/Neo.UnitTests/Wallets/UT_Mnemonic.cs), which validates the entropy-to-mnemonic-to-seed round-trip against official BIP-39 test vectors.

## BIP-32 Extended Key Derivation: Master Keys and Hierarchical Children

### Master Key Creation from BIP-39 Seed

The `ExtendedKey` class in [`src/Neo/Wallets/BIP32/ExtendedKey.cs`](https://github.com/neo-project/neo/blob/main/src/Neo/Wallets/BIP32/ExtendedKey.cs) transforms the 64-byte BIP-39 seed into a master extended key. The `ExtendedKey.Create(byte[] seed, ECCurve? curve = null)` method:

1. Computes `I = HMAC-SHA512(key: "Bitcoin seed", data: seed)`
2. Splits `I` into `IL` (32-byte master private key) and `IR` (32-byte chain code)
3. Constructs the `ExtendedKey` using Neo's default `Secp256r1` elliptic curve (or an optional override)

### Hardened vs. Non-Hardened Child Key Derivation

The `ExtendedKey.Derive(uint index)` method implements the complete BIP-32 child derivation algorithm:

**Data buffer construction (37 bytes):**
- **Hardened** (`index >= 0x80000000`): `0x00` prefix + 32-byte parent private key
- **Non-hardened**: Compressed parent public key (`PublicKey.EncodePoint(true)`)

**Derivation steps:**
1. Compute `I = HMAC-SHA512(ChainCode, data + index)`
2. Split into `IL` (child key material) and `IR` (child chain code)
3. Add `IL` to parent private key modulo curve order `n` (`AddModN`)
4. Validate `IL < n` and result is non-zero (BIP-32 requirements)
5. Return new `ExtendedKey` with child private key and chain code

This implementation is verified in [`tests/Neo.UnitTests/Wallets/BIP32/UT_ExtendedKey.cs`](https://github.com/neo-project/neo/blob/main/tests/Neo.UnitTests/Wallets/BIP32/UT_ExtendedKey.cs) against official BIP-32 test vectors.

## BIP-44 Path Parsing: Standard Hierarchical Deterministic Wallet Structure

### Parsing Derivation Paths with KeyPath

The `KeyPath` class in [`src/Neo/Wallets/BIP32/KeyPath.cs`](https://github.com/neo-project/neo/blob/main/src/Neo/Wallets/BIP32/KeyPath.cs) handles BIP-44 path parsing. The `KeyPath.Parse(string path)` method uses the regex pattern:

```

^\s*m(?:\s*/\s*(?<index>\d+)\s*(?<hardened>'?)\s*)*\s*$

```

**Parsing logic:**
- Validates the `m/` prefix (master)
- Extracts indices and hardened flags (`'`)
- Hardened indices are marked by OR-ing `0x80000000`
- Returns an immutable `KeyPath` object storing the index array

### Neo's Coin Type and Standard Paths

Neo uses **coin type 1024** in BIP-44 derivation paths. The standard structure follows:

```

m / 44' / 1024' / account' / change / address_index

```

- **44'**: Purpose (BIP-44)
- **1024'**: Neo's registered coin type
- **account'**: Account index (hardened)
- **change**: 0 for external, 1 for internal
- **address_index**: Sequential address index

The `KeyPath` class enables walking this hierarchy by providing the `Indices` property for iteration, as demonstrated in [`tests/Neo.UnitTests/Wallets/BIP32/UT_KeyPath.cs`](https://github.com/neo-project/neo/blob/main/tests/Neo.UnitTests/Wallets/BIP32/UT_KeyPath.cs).

## Complete Implementation Example: Creating a Neo HD Wallet

This example demonstrates the full workflow from mnemonic generation to address derivation using Neo's hierarchical deterministic wallet implementation:

```csharp
using Neo.Wallets;
using Neo.Wallets.BIP32;
using System;
using System.Globalization;

// 1️⃣ Generate a BIP-39 mnemonic (English wordlist)
var mnemonic = Mnemonic.Create();                 // ← 12-word phrase
Console.WriteLine($"Mnemonic: {mnemonic}");

// 2️⃣ Derive 64-byte seed from mnemonic (empty passphrase)
byte[] seed = mnemonic.DeriveSeed();             // PBKDF2-HMAC-SHA512, 2048 iterations

// 3️⃣ Create master BIP-32 extended key from seed (uses Secp256r1)
var masterKey = ExtendedKey.Create(seed);        // master private key + chain code

// 4️⃣ Parse BIP-44 derivation path for Neo (coin_type = 1024)
var path = KeyPath.Parse("m/44'/1024'/0'/0/0");

// 5️⃣ Derive child key by walking the path
ExtendedKey child = masterKey;
foreach (uint index in path.Indices)
{
    child = child.Derive(index);                 // hardened or non-hardened derivation
}

// 6️⃣ Convert to Neo wallet account (NEP-6 format)
var account = new Neo.Wallets.WalletAccount(child.PrivateKey);
Console.WriteLine($"NEO Address: {account.Address}");

```

## Summary

- **BIP-39 Implementation**: The `Mnemonic` class in [`src/Neo/Wallets/Mnemonic.cs`](https://github.com/neo-project/neo/blob/main/src/Neo/Wallets/Mnemonic.cs) generates human-readable seed phrases and derives 64-byte seeds using PBKDF2-HMAC-SHA512 with 2048 iterations.

- **BIP-32 Key Derivation**: The `ExtendedKey` class in [`src/Neo/Wallets/BIP32/ExtendedKey.cs`](https://github.com/neo-project/neo/blob/main/src/Neo/Wallets/BIP32/ExtendedKey.cs) creates master keys from seeds using HMAC-SHA512("Bitcoin seed") and implements hardened/non-hardened child derivation with Secp256r1 curve mathematics.

- **BIP-44 Path Parsing**: The `KeyPath` class in [`src/Neo/Wallets/BIP32/KeyPath.cs`](https://github.com/neo-project/neo/blob/main/src/Neo/Wallets/BIP32/KeyPath.cs) parses standard derivation paths like `m/44'/1024'/0'/0/0`, handling hardened indices (marked with `'` and OR'd with `0x80000000`).

- **Neo-Specific Parameters**: Uses coin type **1024** for BIP-44 and the **Secp256r1** elliptic curve (instead of Bitcoin's Secp256k1) while maintaining full BIP-32 algorithm compatibility.

## Frequently Asked Questions

### What elliptic curve does Neo use for HD wallet derivation?

Neo uses the **Secp256r1** curve (also known as P-256) for all HD wallet operations, as implemented in `ExtendedKey.Create()`. This differs from Bitcoin's implementation which uses Secp256k1, but the BIP-32 derivation mathematics remain identical—only the curve parameters change.

### How does Neo handle hardened derivation paths?

In `ExtendedKey.Derive()`, hardened indices (values ≥ `0x80000000` or marked with `'` in path strings) trigger a different data buffer construction: the method prepends `0x00` followed by the 32-byte parent private key instead of using the compressed parent public key. This ensures child keys cannot be derived from public information alone, protecting against certain attack vectors when sharing extended public keys.

### Can I import a Bitcoin HD wallet mnemonic into Neo?

Yes, you can import a BIP-39 mnemonic generated by Bitcoin wallets into Neo, and it will produce valid Neo addresses. However, because Neo uses **coin type 1024** (vs. Bitcoin's 0) and **Secp256r1** curve (vs. Secp256k1), the derived private keys and addresses will differ entirely from the Bitcoin equivalents. You must use Neo's specific derivation path (`m/44'/1024'/...`) to generate compatible Neo N3 addresses.

### Where are the HD wallet unit tests located in the Neo repository?

The HD wallet test suite is distributed across three main locations in `tests/Neo.UnitTests/Wallets/`: **UT_Mnemonic.cs** validates BIP-39 mnemonic generation and seed derivation; **UT_ExtendedKey.cs** (in the `BIP32` subdirectory) verifies BIP-32 master key creation and child derivation against standard test vectors; and **UT_KeyPath.cs** tests BIP-44 path parsing and hardened index handling.