Cryptocurrency Wallets Guide — Hot, Cold, Hardware, and Multi-Sig

# HD wallet key derivation using BIP-32
import hashlib
import hmac

class HDWallet:
    """Simplified Hierarchical Deterministic Wallet (BIP-32)."""

    def __init__(self, seed: bytes):
        self.seed = seed
        self.master_key = self._derive_master_key()

    def _derive_master_key(self) -> dict:
        """Derive master private key and chain code from seed."""
        # BIP-32: HMAC-SHA512(key="Bitcoin seed", data=seed)
        hmac_result = hmac.new(
            b"Bitcoin seed",
            self.seed,
            hashlib.sha512
        ).digest()

        return {
            "private_key": hmac_result[:32],
            "chain_code": hmac_result[32:]
        }

    def derive_child_key(self, index: int) -> dict:
        """Derive a child key at the given index (unhardened)."""
        master = self.master_key

        # Serialize parent public key + index
        # In reality, this uses compressed public key + index
        data = master["private_key"] + index.to_bytes(4, 'big')

        hmac_result = hmac.new(
            master["chain_code"],
            data,
            hashlib.sha512
        ).digest()

        return {
            "private_key": hmac_result[:32],
            "chain_code": hmac_result[32:],
            "index": index
        }

    def master_public_key(self) -> str:
        """Return a hex representation of the master public key (simplified)."""
        return self.master_key["private_key"].hex()[:16] + "..."

# Example: Create wallet from random seed
import os
seed = os.urandom(64)  # 512-bit seed (real wallets use BIP-39 mnemonic)
wallet = HDWallet(seed)

print(f"Master key: {wallet.master_public_key()}")

child = wallet.derive_child_key(0)
print(f"Child key #0: {child['private_key'].hex()[:16]}...")

child2 = wallet.derive_child_key(1)
print(f"Child key #1: {child2['private_key'].hex()[:16]}...")

# BIP-39 seed phrase generation and validation
import hashlib
import hmac
from typing import List

# BIP-39 English wordlist (first 24 words for demonstration)
BIP39_WORDS = [
    "abandon", "ability", "able", "about", "above", "absent",
    "absorb", "abstract", "absurd", "abuse", "access", "accident",
    "account", "accuse", "achieve", "acid", "acoustic", "acquire",
    "across", "act", "action", "actor", "actress", "actual]
]

def generate_seed_phrase(entropy_bits: int = 128) -> List[str]:
    """Generate a BIP-39 seed phrase (simplified checksum)."""
    if entropy_bits not in [128, 160, 192, 224, 256]:
        raise ValueError("Entropy must be 128, 160, 192, 224, or 256 bits")

    # Generate random entropy
    entropy_bytes = os.urandom(entropy_bits // 8)

    # Compute checksum (first (entropy_bits/32) bits of SHA-256 hash)
    checksum_bits = entropy_bits // 32
    hash_bytes = hashlib.sha256(entropy_bytes).digest()
    checksum = hash_bytes[0] >> (8 - checksum_bits)

    # Combine entropy + checksum into bits, split into 11-bit indices
    entropy_int = int.from_bytes(entropy_bytes, 'big')
    entropy_int = (entropy_int << checksum_bits) | checksum

    total_bits = entropy_bits + checksum_bits
    word_count = total_bits // 11

    words = []
    for i in range(word_count):
        shift = total_bits - (i + 1) * 11
        index = (entropy_int >> shift) & 0x7FF
        # Use modulo since we only have a subset of the wordlist
        words.append(BIP39_WORDS[index % len(BIP39_WORDS)])

    return words

def phrase_to_seed(phrase: List[str], passphrase: str = "") -> bytes:
    """Convert BIP-39 mnemonic to seed using PBKDF2."""
    mnemonic = " ".join(phrase)
    # PBKDF2 with 2048 iterations
    seed = hashlib.pbkdf2_hmac(
        "sha512",
        mnemonic.encode("utf-8"),
        f"mnemonic{passphrase}".encode("utf-8"),
        2048
    )
    return seed

# Generate a 12-word seed phrase
import os
os.urandom = lambda x: b'\x01' * x  # deterministic for example
phrase = generate_seed_phrase(128)
print(f"Seed phrase ({len(phrase)} words): {' '.join(phrase)}")

seed = phrase_to_seed(phrase)
print(f"Seed (first 16 hex): {seed.hex()[:16]}...")

# Verify the phrase
phrase2 = phrase  # In real life, user re-enters
assert phrase == phrase2, "Phrases must match"
print("Phrase verified successfully!")

# Wallet security score calculator
def wallet_security_score(wallet_type: str, practices: dict) -> dict:
    """Calculate a security score for a wallet setup."""
    scores = {
        "software_hot": {"base": 30, "max": 60},
        "mobile": {"base": 40, "max": 65},
        "desktop": {"base": 45, "max": 70},
        "hardware": {"base": 75, "max": 95},
        "paper": {"base": 60, "max": 80},
        "multi_sig_2of3": {"base": 85, "max": 99},
    }

    if wallet_type not in scores:
        return {"error": "Unknown wallet type"}

    config = scores[wallet_type]
    score = config["base"]

    # Add points for good practices
    if practices.get("seed_phrase_backed_up"):
        score += 10
    if practices.get("no_screenshots"):
        score += 5
    if practices.get("firmware_updated"):
        score += 5
    if practices.get("pin_enabled"):
        score += 5
    if practices.get("passphrase_used"):
        score += 8
    if practices.get("no_cloud_backup"):
        score += 10
    if practices.get("verified_address_before_sending"):
        score += 3

    score = min(score, config["max"])
    return {
        "wallet_type": wallet_type,
        "score": score,
        "max_score": config["max"],
        "rating": "Excellent" if score >= 85 else
                  "Good" if score >= 65 else
                  "Fair" if score >= 45 else "Poor"
    }

# Example evaluations
hot_setup = {"seed_phrase_backed_up": True, "no_screenshots": False,
             "firmware_updated": False, "pin_enabled": True,
             "passphrase_used": False, "no_cloud_backup": False,
             "verified_address_before_sending": True}

hardware_setup = {"seed_phrase_backed_up": True, "no_screenshots": True,
                  "firmware_updated": True, "pin_enabled": True,
                  "passphrase_used": True, "no_cloud_backup": True,
                  "verified_address_before_sending": True}

print("Hot wallet score:", wallet_security_score("software_hot", hot_setup))
print("Hardware wallet score:", wallet_security_score("hardware", hardware_setup))