Tell me more ×
Bitcoin Stack Exchange is a question and answer site for Bitcoin crypto-currency enthusiasts. It's 100% free, no registration required.
up vote 5 down vote favorite

Scenario:

  1. Create a deterministic wallet and a larger number of private keys and associated bitcoin addresses on a safe (e.g. offline) computer.
  2. Backup the seed securely. Store the private keys securely (e.g. on a piece of paper).
  3. Note addresses and send Bitcoins to a number of different addresses. (They are now in cold storage.)
  4. When needed, take one of the private keys and import it from an online wallet (e-wallet, cellphone, etc.) (This includes the risk of the private key getting stolen by malware or the e-wallet operator. However, such a theft would only apply to a small amount, not your total fortune.)

If one private key of a deterministic wallet gets compromised (known to an advisory), are the other keys (and the seed) still secure?

By design, this is not the case for the electrum deterministic wallet and the developers are aware of this. How about other deterministic wallets, e.g. Armory?

share|improve this question
Jan, in the comments above/below might have misunderstood why they are doing something that looks like key = seed + hash(sequence). See here for more info: bitcointalk.org/index.php?topic=19137.0 They are basically using a property of ECC keys. The thing outside the hash function is not the seed but a public key when generating public keys and a private key when generating private keys. (note: I don't have commenting karma) – Alok Apr 28 at 16:48

3 Answers

up vote 6 down vote accepted

The proposed standard for hierarchical deterministic wallets (see BIP 32) is designed to allow this (and more).

It is not yet implemented, but several authors of clients have agreed to adopt it, once it becomes final.

share|improve this answer
1  
Towards the end of your link, they acknowledge "Alan Reiner for the implementation of this scheme in Armory [...]." Does this mean that current versions of Armory do already use this scheme (or something cryptographically equivalent)? – Jan Jan 11 at 12:58
up vote 2 down vote

Had the same need and could not find easy to use solutions so I ended up rolling my own. I am new to bitcoin and crypto so use with care:

https://github.com/pavlos-christoforou/bitcoin

share|improve this answer
up vote 0 down vote

It all depends on how your deterministic wallet was created, if it's somthing hash based it would be secure. What you need is that it is impossible to discover the seed with the actual private keys, so it must use an one way function (i.e. hash function).

And in general compromising a private key in a wallet does not comprise the rest of the wallet.

share|improve this answer
That's what I was thinking. However, after reading the electrum source code, I realized that you have to be wary: They use something like KEY = SEED + HASH(sequence), making it possible in some circumstances to calculate SEED. – Jan Jan 11 at 9:29
1  
Just an idea: would KEY=HASH(SEED + offset) work also? That way neither SEED nor the other addresses would be guessable. – cdecker Jan 11 at 11:45
@cdecker I would think so, but don't take my word for it. Better implement a scheme that has been reviewed by cryptography experts. – Jan Jan 11 at 13:00
@cdecker Yes this is something that would be secure because you hash the seed along with another parameter, thus changing the whole resultant hash. – Gopoi Jan 11 at 22:57
@Jan If electrum use this way I would not recommend it for any use the seed is compromised in all the private key which is awful from my consideration. – Gopoi Jan 11 at 22:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.