ERC-601 Ethereum deterministic wallet hierarchy (Ethereum hierarchy for deterministic wallets)
Final · Accounts & wallets · created 2017-04-13
Defines a key derivation path scheme designed specifically for Ethereum, for deterministic wallets that generate multiple addresses from a single seed. It is a standard that makes all wallets generate addresses by the same rules.
Why it is needed
A deterministic wallet generates multiple addresses from a single secret value called a seed, according to fixed rules (the derivation path). However, at the time this standard appeared, Ethereum clients and wallets each used different derivation paths, and some even violated BIP44, the existing standard that defines paths starting with m/44'. The result was confusion and incompatibility between wallet implementations. In some cases, funds created in one wallet could not be accessed from another wallet, and in others users had to be asked for the derivation path directly, which hurt usability. In addition, BIP44 was designed with blockchains based on transaction outputs (UTXO), like Bitcoin, in mind, so it does not fit Ethereum, which uses an account model. This standard therefore proposes a new deterministic wallet hierarchy tailored to Ethereum's own requirements.
In depth
Four-level path structure and hardened derivation
Four levels are defined on top of the BIP32 path: m / purpose' / subpurpose' / EIP' / wallet'. The apostrophe (') in the path marks BIP32 hardened derivation, and this standard uses hardened derivation at all four levels. Each level has its own meaning, described in the items below.
purpose is 43, subpurpose is 60
purpose is fixed to the constant 43 and indicates that this key derivation is for cryptocurrencies other than Bitcoin. subpurpose is 60, the SLIP-44 code assigned to Ethereum. Both levels use hardened derivation.
The EIP level is the number of the EIP that defines the rest of the path
The EIP level holds the number of the EIP that specifies the rest of the BIP32 derivation path. A path that follows this standard's specification uses the number assigned to this EIP. Hardened derivation is used at this level as well. This allows different EIPs to define their own path rules under the same prefix.
The wallet level and account creation rules
The wallet level divides a wallet into distinct user identities, so a single wallet can have multiple public identities. Accounts are numbered in order starting from 0, this number is used as the child index in BIP32 derivation, and hardened derivation is applied. Software must block creation of a new account if the previous account has no transaction history (that is, its address has never been used). Also, after importing a seed from outside, it must discover all accounts that were used.
Why a new hierarchy was created instead of m/44'/60'
The existing convention is to use the 'Ethereum' coin type with paths that start with m/44'/60'/*. However, the authors argue that this approach still assumes UTXO-based coins, so it fits Ethereum poorly and creates compromises in standardization, usability and security. They therefore proposed an entirely new hierarchy for Ethereum-family chains.
Compatibility with existing software
Because a new derivation path is added, existing software must support this scheme in addition to the existing ones. The authors consider that Ethereum's wallet derivation paths are already in a confusing state, so the additional confusion would be relatively small and could greatly improve the situation in the long run. For applications that use mnemonics, they said they will submit a separate draft EIP describing how to avoid compatibility problems when moving to the new path. Test cases are TBD and there is no implementation yet.