user61762: The process is depicted in this picture. Specifically, given that the root seed was derived using PBKDF2 (with 2048 rounds of hashing with HMAC-SHA256 already), why do we undergo an additional pass of HMAC-SHA512, besides for creating 512 bits of entropy? Why not just use SHA512 alone? I've asked here before and the answer I got was that the HMAC version is used to ensure unique generation of the key, but I don't know what that means. It seems for derivation of the master private key and chain node, the function is being used as a one-way hash function only, so why is a MAC being used? There is a single thing being encrypted, we are not additionally trying to guarantee authenticity on anything here, right?

user2306: 
Why not just use SHA512 alone?

I'm not sure. I think that would work fine. The only tricky detail would be that you need include the passphrase, too.

It seems for derivation of the master private key and chain node, the function is being used as a one-way hash function only, 

To be entirely accurate, you need more than a one-way function. For example, if the hash function always produced a hash that was divisible by 3, that would follow all of the properties of the hash function, but it would be weaker as a key derivation function.

user208: 
Specifically, given that the root seed was derived using PBKDF2 (with 2048 rounds of hashing with HMAC-SHA256 already), why do we undergo

and 

an additional pass of HMAC-SHA512, besides for creating 512 bits of entropy?

Those things come from different standards. BIP32 (which specifies going from masterkey to keys) came first. Various ways for constructing master keys/seeds are in use that came later; I assume you're referring to one of those.

61762: <p>The process is depicted in <a href="https://raw.githubusercontent.com/bitcoinbook/bitcoinbook/develop/images/mbc2_0509.png" rel="nofollow noreferrer">this</a> picture. Specifically, given that the root seed was derived using PBKDF2 (with 2048 rounds of hashing with HMAC-SHA256 already), why do we undergo an additional pass of HMAC-SHA512, besides for creating 512 bits of entropy? Why not just use SHA512 alone? I've asked here before and the answer I got was that the HMAC version is used to ensure unique generation of the key, but I don't know what that means. It seems for derivation of the master private key and chain node, the function is being used as a one-way hash function only, so why is a MAC being used? There is a single thing being encrypted, we are not additionally trying to guarantee authenticity on anything here, right?</p>
 2306: <blockquote>
  <p>Why not just use SHA512 alone?</p>
</blockquote>

<p>I'm not sure. I think that would work fine. The only tricky detail would be that you need include the passphrase, too.</p>

<blockquote>
  <p>It seems for derivation of the master private key and chain node, the function is being used as a one-way hash function only, </p>
</blockquote>

<p>To be entirely accurate, you need more than a one-way function. For example, if the hash function always produced a hash that was divisible by 3, that would follow <a href="https://en.wikipedia.org/wiki/Cryptographic_hash_function" rel="nofollow noreferrer">all of the properties</a> of the hash function, but it would be weaker as a key derivation function.</p>
 208: <blockquote>
  <p>Specifically, given that the root seed was derived using PBKDF2 (with 2048 rounds of hashing with HMAC-SHA256 already), why do we undergo</p>
</blockquote>

<p>and </p>

<blockquote>
  <p>an additional pass of HMAC-SHA512, besides for creating 512 bits of entropy?</p>
</blockquote>

<p>Those things come from different standards. BIP32 (which specifies going from masterkey to keys) came first. Various ways for constructing master keys/seeds are in use that came later; I assume you're referring to one of those.</p>
