user4276: I've been using a pretty old version of Multibit classic and recently decided to upgrade. I tried out Multibit HD and Electrum and noticed that both have me set up a wallet with a "word seed". It's just a string of random words that is apparently used in an algorithm. The question is, what does it do exactly? Someone told me that it generates private keys for you, and all you need is that word seed and you will be able to restore/generate all your private keys. How does this work exactly? What algorithm is being use on the seed to generate the keys?
These words are apparently very important, as Multibit warns on their site:

To restore your wallet and recover your bitcoin, you must have your wallet words.
With your wallet words, you can recover your bitcoin. You must keep your wallet words safe, because anyone who knows your wallet words can steal your bitcoin.

The seed words seem to be a replacement for the private keys, based on what Multibit says about them. I'm personally quite attached to the idea of having my private keys, so why should I be content with this word seed instead? Some apparently think it's safe enough: Is 12-word seed phrase safe enough?, but is it usable enough?
These questions: Does a wallet containing multiple addresses have a single private key? and Why can the same 12 words produce different seeds in an Electrum wallet file? hint on what is happening here, but is lacking details. It seems the phrase is "hierarchical deterministic" wallets, hence the "HD" in "Multibit HD".
This question exactly articulates my concerns: Is it important to have an unencrypted backup of the private key?

user89688: Main answer to your main question in title: The string of words, known as the crypto wallet "recovery phrase", or "mnemonic words" or "seed words" are simply a human-readable format of the underlying machine-readable entropy - which is a large random number - used to create the crypto vault.
answer to your second and third question: The exact steps from seed to wallet addresses include the use of a hash function (HMAC) and key stretching with PBKDF2 with default values for the passphrase field. 
[Excerpt from BIP39 specification "To create a binary seed from the mnemonic, we use the PBKDF2 function with a mnemonic sentence (in UTF-8 NFKD) used as the password and the string "mnemonic" + passphrase (again in UTF-8 NFKD) used as the salt. The iteration count is set to 2048 and HMAC-SHA512 is used as the pseudo-random function. The length of the derived key is 512 bits (= 64 bytes)." ]
The BIP39 specification includes a notation scheme that uses a wordlist with 2048 values (with various languages supported) as a lookup table. 
The way this works is when creating a crypto vault a certain amount of underlying binary data is generated by the cryptographically-secure random number generator (CSPRNG) of the wallet software which gathers random bits from the user's device locally, such as 128 bits for a 12-word mnemonic recovery phrase. 
Those 12 words are simply a representation of the 128 bits + a 4-bit checksum (totaling 132 bits, based on 12 groups of 11 bits, where each group represents an 11-bit number in the list of 2048 11-bit numbers where each number correspond to a unique word on the list). So the words are just an easy way to recreate that number, as the words can more easily be handled (i.e write, recite, notate, store and otherwise deal with compared to writing or reciting a 132-bit binary number).

Another option for backup instead of the mnemonic (although not
suggested), as an alternative or complement is to back-up the initial
entropy, whether in binary or hex format, or whatever base format
suits you, so long as any leading zeroes are not lost.

For example, the following mnemonic below is based on the following entropy:
132 bits of initial entropy:  011001011001101110001010000000111011111110111011100000001100110111001101110000111100001110000011110101001011000011010101000001011100
Length of total bits: 132 bits divided into 12 groups of 11 bits
['01100101100', '11011100010', '10000000111', '01111111011', '10111000000', '01100110111', '00110111000', '01111000011', '10000011110', '10100101100', '00110101010', '00001011100']
Corresponding index values for each group (in base 10):
[812, 1762, 1031, 1019, 1472, 823, 440, 963, 1054, 1324, 426, 92]
Corresponding mnemonic based on BIP39 english wordlist:
grain sword liberty legal retreat group damage journey long pitch crystal argue

The following tool can be used for educational purposes with recovery phrases: https://iancoleman.io/bip39/ (note: I am a contributor to that tool on Github)
I think it is best to refer to the mnemonic words as the "keys" to the "crypto vault" (and not the private key to a wallet or wallet address, which is a different context where the private key is multiplied with a generator point to compute the public address, using elliptic curve cryptography). Again, a BIP39 crypto vault that uses BIP44 can contain multiple cryptocurrencies (accounts with different derivation paths) and where each cryptocurrency can contain up to 2 billion derived child address, from their extended public/private keys based on the HD wallet structure as per BIP32. 
Regarding your question about security/usability: In terms of whether a 12-word mnemonic is secure, we can measure that its maximum theoretic security in bits is at most 128-bits (using Claude Shannon's equation for entropy where (2048^12 = 2^132)-4 bits = 2^128), given the size of the initial entropy, and as the last 4 bits are deterministic we subtract that from the total bits that the mnemonic represents (as it is hash-based, which is a means to slow-down someone from brute-force trying random 12-words). 

Otherwise, removing just one bit will reduce security by one half, as
(2**127)*2 == 2**128, whereas, 128 bits of security is only the
square root of a 24-word mnemonic which has 256 bits of security
since (2**128)*(2**128) == 2**256.

In terms of whether these are secure enough, depends on the capabilities of an attacker. With Grover's algorithm running on a Quantum computer a search that would usually take n-time could be sped up to the square-root of n-time, thus a 128-bits of security could be reduced to 64 bits using classical computer security assumptions, whereas a 256-bit key under such a quantum attack could be reduced to 128-bits of security on a classical computer. There is also potential threats from Shor's algorithm running on a fast-enough quantum computer, as well as the quantum version of the elliptic curve factorization (ECM) known as GEECM, which could be applicable to bitcoin crypto vaults as well as private keys.
Regarding your question about HD wallets:
It isn't feasible to backup every possible private key in an HD Wallet, as there could be 2 billion of them per each supported cryptocurrency, each derived from the extended public/private parent keys (xPub and xPrv). Therefore, the mnemonics words serve as a major convenience for custody and recovery of those private/public keys as they can be easily derived starting from the mnemonic words or the underlying entropy that the words represent. And then the extended public/private keys can be used to recreate all the child private/public keys. 

user24974: With HD wallets, a single key can be used to generate an entire tree of key pairs.  This single key serves as the "root" of the tree.  The word seed is simply a more human-readable way of expressing the key used as the root, as it can be algorithmically converted into the root private key.  Those words, in that order, will always generate the exact same key.
That single key is not replacing all other private keys, but rather is being used to generate them.  All your addresses still have different private keys...but they can all be restored by a single key.
Compare this to non-deterministic wallets.  In a non-deterministic wallet, each key is randomly generated on its own accord, and they are not seeded from a common key.  Therefore, any backups of the wallet must store each and every single private key used as an address...as well as a buffer of 100 or so future keys that may have already been given out as addresses but not recieved payments yet.
A hierarchical deterministic wallet doesn't need to back up so much data.  The private keys to every address it has ever given out can be recalculated given the root key.  That root key, in turn, can be recalculated by feeding in the word seed.
Relevant BIPS:
https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki
https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki

4276: <p>I've been using a pretty old version of Multibit classic and recently decided to upgrade. I tried out Multibit HD and Electrum and noticed that both have me set up a wallet with a &quot;word seed&quot;. It's just a string of random words that is apparently used in an algorithm. The question is, what does it do exactly? Someone told me that it generates private keys for you, and all you need is that word seed and you will be able to restore/generate all your private keys. How does this work exactly? What algorithm is being use on the seed to generate the keys?</p>
<p>These words are apparently very important, as <a href="https://multibit.org/help/hd0.1/restore-wallet.html" rel="noreferrer">Multibit warns on their site</a>:</p>
<blockquote>
<p>To restore your wallet and recover your bitcoin, you must have your wallet words.</p>
<p>With your wallet words, you can recover your bitcoin. You must keep your wallet words safe, because anyone who knows your wallet words can steal your bitcoin.</p>
</blockquote>
<p>The seed words seem to be a replacement for the private keys, based on what Multibit says about them. I'm personally quite attached to the idea of having my private keys, so why should I be content with this word seed instead? Some apparently think it's safe enough: <a href="https://bitcoin.stackexchange.com/questions/38512/is-12-word-seed-phrase-safe-enough">Is 12-word seed phrase safe enough?</a>, but is it usable enough?</p>
<p>These questions: <a href="https://bitcoin.stackexchange.com/questions/18102/does-a-wallet-containing-multiple-addresses-have-a-single-private-key">Does a wallet containing multiple addresses have a single private key?</a> and <a href="https://bitcoin.stackexchange.com/questions/20482/why-can-the-same-12-words-produce-different-seeds-in-an-electrum-wallet-file">Why can the same 12 words produce different seeds in an Electrum wallet file?</a> hint on what is happening here, but is lacking details. It seems the phrase is &quot;hierarchical deterministic&quot; wallets, hence the &quot;HD&quot; in &quot;Multibit HD&quot;.</p>
<p>This question exactly articulates my concerns: <a href="https://bitcoin.stackexchange.com/questions/42200/is-it-important-to-have-an-unencrypted-backup-of-the-private-key">Is it important to have an unencrypted backup of the private key?</a></p>
 89688: <p><strong>Main answer to your main question in title:</strong> The string of words, known as the crypto wallet "recovery phrase", or "mnemonic words" or "seed words" are simply a human-readable format of the underlying machine-readable entropy - which is a large random number - used to create the crypto vault.</p>

<p><strong>answer to your second and third question:</strong> The exact steps from seed to wallet addresses include the use of a hash function (HMAC) and key stretching with PBKDF2 with default values for the passphrase field. </p>

<p><code>[Excerpt from BIP39 specification "To create a binary seed from the mnemonic, we use the PBKDF2 function with a mnemonic sentence (in UTF-8 NFKD) used as the password and the string "mnemonic" + passphrase (again in UTF-8 NFKD) used as the salt. The iteration count is set to 2048 and HMAC-SHA512 is used as the pseudo-random function. The length of the derived key is 512 bits (= 64 bytes)." ]</code></p>

<p>The BIP39 specification includes a notation scheme that uses a wordlist with 2048 values (with various languages supported) as a lookup table. </p>

<p>The way this works is when creating a crypto vault a certain amount of underlying binary data is generated by the cryptographically-secure random number generator (CSPRNG) of the wallet software which gathers random bits from the user's device locally, such as 128 bits for a 12-word mnemonic recovery phrase. </p>

<p>Those 12 words are simply a representation of the 128 bits + a 4-bit checksum (totaling 132 bits, based on 12 groups of 11 bits, where each group represents an 11-bit number in the list of 2048 11-bit numbers where each number correspond to a unique word on the list). So the words are just an easy way to recreate that number, as the words can more easily be handled (i.e write, recite, notate, store and otherwise deal with compared to writing or reciting a 132-bit binary number).</p>

<ul>
<li>Another option for backup instead of the mnemonic (although not
suggested), as an alternative or complement is to back-up the initial
entropy, whether in binary or hex format, or whatever base format
suits you, so long as any leading zeroes are not lost.</li>
</ul>

<p>For example, the following mnemonic below is based on the following entropy:</p>

<pre><code>132 bits of initial entropy:  011001011001101110001010000000111011111110111011100000001100110111001101110000111100001110000011110101001011000011010101000001011100
Length of total bits: 132 bits divided into 12 groups of 11 bits
['01100101100', '11011100010', '10000000111', '01111111011', '10111000000', '01100110111', '00110111000', '01111000011', '10000011110', '10100101100', '00110101010', '00001011100']
Corresponding index values for each group (in base 10):
[812, 1762, 1031, 1019, 1472, 823, 440, 963, 1054, 1324, 426, 92]
Corresponding mnemonic based on BIP39 english wordlist:
grain sword liberty legal retreat group damage journey long pitch crystal argue
</code></pre>

<p>The following tool can be used for educational purposes with recovery phrases: <a href="https://iancoleman.io/bip39/" rel="nofollow noreferrer">https://iancoleman.io/bip39/</a> (note: I am a contributor to that tool on Github)</p>

<p>I think it is best to refer to the mnemonic words as the "keys" to the "crypto vault" (and not the private key to a wallet or wallet address, which is a different context where the private key is multiplied with a generator point to compute the public address, using elliptic curve cryptography). Again, a BIP39 crypto vault that uses BIP44 can contain multiple cryptocurrencies (accounts with different derivation paths) and where each cryptocurrency can contain up to 2 billion derived child address, from their extended public/private keys based on the HD wallet structure as per BIP32. </p>

<p><strong>Regarding your question about security/usability:</strong> In terms of whether a 12-word mnemonic is secure, we can measure that its maximum theoretic security in bits is at most 128-bits (using Claude Shannon's equation for entropy where (2048^12 = 2^132)-4 bits = 2^128), given the size of the initial entropy, and as the last 4 bits are deterministic we subtract that from the total bits that the mnemonic represents (as it is hash-based, which is a means to slow-down someone from brute-force trying random 12-words). </p>

<ul>
<li>Otherwise, removing just one bit will reduce security by one half, as
<code>(2**127)*2 == 2**128</code>, whereas, 128 bits of security is only the
square root of a 24-word mnemonic which has 256 bits of security
since <code>(2**128)*(2**128) == 2**256</code>.</li>
</ul>

<p>In terms of whether these are secure enough, depends on the capabilities of an attacker. With <a href="https://en.wikipedia.org/wiki/Grover%27s_algorithm" rel="nofollow noreferrer">Grover's algorithm</a> running on a Quantum computer a search that would usually take n-time could be sped up to the square-root of n-time, thus a 128-bits of security could be reduced to 64 bits using classical computer security assumptions, whereas a 256-bit key under such a quantum attack could be reduced to 128-bits of security on a classical computer. There is also potential threats from Shor's algorithm running on a fast-enough quantum computer, as well as the quantum version of the <a href="https://en.wikipedia.org/wiki/Lenstra_elliptic-curve_factorization#Quantum_version_(GEECM)" rel="nofollow noreferrer">elliptic curve factorization</a> (ECM) known as GEECM, which could be applicable to bitcoin crypto vaults as well as private keys.</p>

<p><strong>Regarding your question about HD wallets:</strong></p>

<p>It isn't feasible to backup every possible private key in an HD Wallet, as there could be 2 billion of them per each supported cryptocurrency, each derived from the extended public/private parent keys (xPub and xPrv). Therefore, the mnemonics words serve as a major convenience for custody and recovery of those private/public keys as they can be easily derived starting from the mnemonic words or the underlying entropy that the words represent. And then the extended public/private keys can be used to recreate all the child private/public keys. </p>
 24974: <p>With <a href="https://en.bitcoin.it/wiki/Deterministic_wallet" rel="noreferrer">HD wallets</a>, a single key can be used to generate an entire <a href="https://en.wikipedia.org/wiki/Tree_(data_structure)" rel="noreferrer">tree</a> of key pairs.  This single key serves as the "root" of the tree.  The word seed is simply a more human-readable way of expressing the key used as the root, as it can be algorithmically converted into the root private key.  Those words, in that order, will always generate the exact same key.</p>

<p>That single key is not <em>replacing</em> all other private keys, but rather is being used to <em>generate</em> them.  All your addresses still have different private keys...but they can all be restored by a single key.</p>

<p>Compare this to non-deterministic wallets.  In a non-deterministic wallet, each key is randomly generated on its own accord, and they are not seeded from a common key.  Therefore, any backups of the wallet must store each and every single private key used as an address...as well as a buffer of 100 or so future keys that may have already been given out as addresses but not recieved payments yet.</p>

<p>A hierarchical deterministic wallet doesn't need to back up so much data.  The private keys to every address it has ever given out can be recalculated given the root key.  That root key, in turn, can be recalculated by feeding in the word seed.</p>

<p>Relevant BIPS:</p>

<p><a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki" rel="noreferrer">https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki</a>
<a href="https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki" rel="noreferrer">https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki</a></p>
