Seed (cryptography)

Computers can’t really roll dice. They calculate strictly by rule, and the same calculation always produces the same result. To still generate numbers that appear random, a program starts with a single initial value and calculates a long sequence of further numbers from it. This initial value is called a seed. From a small seed grows a large quantity of seemingly random numbers. And anyone who knows the seed gets exactly the same sequence when recalculating it.

Why the seed determines security

In cryptography, the science of encrypting data, secret keys are formed from random numbers. If the seed is poorly chosen, the key is poorly chosen too. An attacker then doesn’t need to try all possible keys. He only tries the likely seeds, and there are often frighteningly few of those.

This has happened repeatedly. Programs have used the current time in seconds as a seed. An attacker roughly knows the day, so only a few hundred thousand possibilities remain. A laptop tests those in minutes. The encryption was mathematically strong, the starting value weak — and with it the whole system.

With cryptocurrencies, the seed carries an even more direct responsibility. All the keys of a wallet are calculated from it. Whoever has the seed has the money.

Where good seeds come from

A good seed must not be predictable. That’s why operating systems collect genuine physical disorder for this purpose. Used, for example, are tiny time intervals between keystrokes, fluctuations in hard drive access, or electrical noise in special chips. Modern processors have their own components that extract randomness from such noise.

This collected disorder is called entropy. The operating system mixes it into a seed and passes it to a random number generator. This then stretches the short seed into as many random bits as needed. Programmers should therefore always request randomness from the operating system rather than concocting it themselves.

A second point is length. Common seeds are 128 or 256 bits long. That amounts to so many possibilities that trying them all fails even with all the computers in the world combined.

Where you encounter seeds

Most visibly in crypto wallets. When you create a new Bitcoin or Ethereum wallet, it shows you twelve or twenty-four English words. This seed phrase is nothing other than a 128- or 256-bit seed translated into more easily memorable words. All addresses and keys of the account are derived from it. That’s why you can use these words to fully restore your wallet on a new phone. And that’s why the rule applies: never photograph it, never type it into a cloud, never read it aloud to anyone. No genuine support team ever asks for it.

In the news, seeds usually come up when something has gone wrong. Reports about hacked wallets or crackable random number generators are almost always about seeds that were too weak.

There is also a harmless application of the same idea. With image generators and other AI tools, you can often enter a seed as a number. The same seed and the same input produce the same image. Here, predictability isn’t a flaw but a desired feature: it makes results reproducible. Video games also use this when they generate a world from a number and players exchange that number.