Someone suggested that deterministic wallets shoud try to use a standard key generation algorithm.
https://bitcointalksearch.org/topic/m.688099Since you have not released the initial version, may I suggest to use the same key generation algorithm
that is already used in Electrum? This would allow users to use the same seed in both clients.
see
http://ecdsa.org/electrumIt is much more difficult to change this after you have released your software.
Luckily, I have made sure I have a separate version number just for wallets, so I can do exactly what you suggest. Obviously, if I upgraded, old wallets would not be convertable but would still work. Only new wallets would be transferable, which is fine... (users can upgrade if they want it).
However, I'm not clear what your deterministic algorithm is...? Do you use the DHSS method that allows you to compute the deterministic addresses
without the private keys? I have been looking at the Electrum website, but didn't see how it is done. So far I haven't seen anyone else implement the determinism this way, and thus I would have no choice but to use my own method. Armory is critically dependent on the ability of watching-only wallets to be able to generate the public key chain without needing private keys.
For reference, the algorithm I use is not terribly complicated. The 32-byte "chaincode" is kept with the wallet (and actually stored with each key in the wallet). You chain addresses via:
a = hash256(PubKey65(i)) XOR chaincode
PrivKey(i+1) = a*PrivKey(i)
The magic is in the ECC math, so you can continue the chain with public keys only:
a = hash256(PubKey65(i)) XOR chaincode
PubKey(i+1) = EC_Multiply(a, PubKey(i))
The chaincode is simply extra entropy added to the determinism (i.e. salt), but not entirely necessary. I might revert, in the future, to making the chiancode deterministically generated from the root private key, so that you only need 256 bits (root private key) to recover the wallet, not 512 bits.
Btw, I really like your technique for converting entropy into dictionary words. That's pretty slick! I never considered the possibility that a user would try to memorize their keys, or even write it down by hand, but that certainly makes it possible! (because I will never generate a wallet with less than 256 bits of entropy, that's a lot of write/memorize).