# KEZ Mnemonic — canonical test vectors

These vectors are ground truth that **all three implementations
(Rust, Node, Python) MUST match byte-for-byte**. Generated from
the Rust and Node implementations, which have already been verified
to agree (see `mnemonics` branch commit `0058d9b`).

## Semantics

- **24-word phrase** → entropy IS the 32-byte Ed25519 seed (bijection).
- **12-word phrase** → 16-byte entropy → 32-byte seed via
  `SHA-256("kez-bip39-12-v1" || entropy)`.
  Domain tag bytes: `0x6b, 0x65, 0x7a, 0x2d, 0x62, 0x69, 0x70, 0x33, 0x39, 0x2d, 0x31, 0x32, 0x2d, 0x76, 0x31` (15 bytes, UTF-8 of "kez-bip39-12-v1").

Wordlist: BIP-39 English (the canonical 2048-word list).

## Vectors

### V1 — 24-word, all-zero entropy

```
phrase:  abandon abandon abandon abandon abandon abandon abandon abandon
         abandon abandon abandon abandon abandon abandon abandon abandon
         abandon abandon abandon abandon abandon abandon abandon art
seed:    0000000000000000000000000000000000000000000000000000000000000000
pubkey:  3b6a27bcceb6a42d62a3a8d02a6f0d73653215771de243a63ac048a18b59da29
```

### V2 — 12-word, all-zero entropy

```
phrase:  abandon abandon abandon abandon abandon abandon abandon abandon
         abandon abandon abandon about
seed:    09451c0f06588db78205e32a793536e15ae263c8f9ee6d14f5c6fd82b8bd20da
pubkey:  9403c32e0d3b4ce51105c0bcac09a0d73be0cca98a6bf7b3cd434651be866d70
```

### V3 — 12-word, non-trivial entropy

```
phrase:  legal winner thank year wave sausage worth useful legal winner
         thank yellow
seed:    9df434a2bd5dc767ee949d8ab95ca09c4ebbb88cefc3d0b1523f6b2a744ca824
pubkey:  cc99d06b15ccb83a5ca43f25dd3d27f50638c1c6fbe3a822352da3e07156ce03
```

## What "pubkey" means here

`pubkey` is the 32-byte Ed25519 public key (hex) derived from the seed
above via the standard Ed25519 keypair derivation (the same as
`ed25519-dalek` / `@noble/curves/ed25519`). The KEZ identity string is
`ed25519:<pubkey>`.

## Implementation crib

Both Rust and Node load the **raw entropy** from the BIP-39 phrase
(not the BIP-39 PBKDF2-derived 64-byte seed). 24-word entropy is 32
bytes and is used directly as the seed. 12-word entropy is 16 bytes
and is hashed once with the domain tag to produce the 32-byte seed.

This deliberately differs from how hardware wallets use the same
phrases (which feed the PBKDF2 64-byte seed into BIP-32 derivation).
KEZ has one identity per phrase, no derivation tree.