Problem
NEP-645 shipped ML-DSA-65 access keys, but there's no standard way to derive them from a seed phrase. Wallets are already inventing their own: Nightly derives the ML-DSA-65 seed from the BIP-39 seed with a proprietary domain-separated KDF, so recovery only works inside Nightly. And once a Ledger app generates keys a certain way, we're stuck supporting that derivation forever.
For ed25519 everyone landed on SLIP-0010 + coin type 397'. Nobody (no chain, no standards body) has ratified an equivalent for ML-DSA yet.
Format
We looked at the prior art and settled on the construction from satoshilabs/slips#1968. Quantus's QIP-0002 and the Lattice HD Wallets paper (which proves the construction secure) arrived at the same thing independently:
- Master node:
HMAC-SHA512(key = "ML-DSA-65 seed", data = BIP-39 seed)
- Children: the standard SLIP-0010 hardened-only step. Unhardened derivation is mathematically impossible for ML-DSA.
- The 32-byte node secret is the FIPS 204 seed ξ, fed to
ML-DSA.KeyGen_internal
- Default path
m/44'/397'/index', same as our ed25519 convention
Deliverable
A wallet-standard NEP (Type: Wallet Standard, Requires: 645) that specifies the above, with test vectors. slips#1968 ships vectors validated against the NIST ACVP ML-DSA-keyGen-FIPS204 known-answer tests, so an implementation can be checked against those directly.
Once the NEP PR is open: comment on slips#1968 as an adopting chain, and loop in Nightly on a migration path.
Problem
NEP-645 shipped ML-DSA-65 access keys, but there's no standard way to derive them from a seed phrase. Wallets are already inventing their own: Nightly derives the ML-DSA-65 seed from the BIP-39 seed with a proprietary domain-separated KDF, so recovery only works inside Nightly. And once a Ledger app generates keys a certain way, we're stuck supporting that derivation forever.
For ed25519 everyone landed on SLIP-0010 + coin type
397'. Nobody (no chain, no standards body) has ratified an equivalent for ML-DSA yet.Format
We looked at the prior art and settled on the construction from satoshilabs/slips#1968. Quantus's QIP-0002 and the Lattice HD Wallets paper (which proves the construction secure) arrived at the same thing independently:
HMAC-SHA512(key = "ML-DSA-65 seed", data = BIP-39 seed)ML-DSA.KeyGen_internalm/44'/397'/index', same as our ed25519 conventionDeliverable
A wallet-standard NEP (Type: Wallet Standard, Requires: 645) that specifies the above, with test vectors. slips#1968 ships vectors validated against the NIST ACVP
ML-DSA-keyGen-FIPS204known-answer tests, so an implementation can be checked against those directly.Once the NEP PR is open: comment on slips#1968 as an adopting chain, and loop in Nightly on a migration path.