What is the purpose of the different types of extended keys, as well as some of its other elements?

Question

I have a few questions about the extended public/private key, i.e. the purpose of its elements.

Namely, according to the BIP32 standard, the "format" of the extended key is as follows:

[ magic ][ depth ][ parent fingerprint ][ key index ][ chain code ][ key ]

However, what we actually need when generating new child keys is only the chain code and the key (private or public). What is the role of other elements within a given format. I understand that the magic gives the ability to recognize that it is an extended key after encoding with Base58, but even in that case exists a different types of extended keys (zpub/zpriv, ypub/ypriv). I can understand that all those "properties" can help people understand where that key is potentially located within the tree and what we can use it for. For example, if it is XPUB, then we know that we should use BIP44 and how to derive all other keys from it. Since the derivation path according to BIP44 is as follows:

m / purpose' / coin_type' / account' / change / address_index

... if the depth is 2, then we would know that we should use a hardened derivation and that we cannot use XPUB of this key to derive the child public keys since they are hardened. Also, since it is XPUB, we know that all keys derived from this key will only be used for P2PKH. On the other hand, if it was ZPUB/ZPRIV, we would know that we should follow BIP84 as well as the purpose of those keys. And so on...

So, it is clear to me how we, as humans, would use all the elements from the extended key (although it is not clear to me what the parent fingerprint will do for us). Do wallets also interpret extended keys this way? For example, if XPUB/XPUB gets to them, they will know that they follow the BIP44 standard and what the leaf nodes of its derivation path are for (P2PKH), if ZPUB/ZPRIV comes they follow BIP88 and so on. Is that the purpose of the different types of extended keys (different "values" for magic)?

Can someone tell me something more on this topic? What are all those fields for (different forms of magic, depth, etc.)? Is it so that the wallets know how to generate all the other keys, what are the keys for, and so on, or do they also have some other purpose?

Answer 1

For example, if it is XPUB, then we know that we should use BIP44 and how to derive all other keys from it.

That's not correct. An xpub just identifies a extended public key and its ancestry. It says nothing about how to derive further elements.

Also, since it is XPUB, we know that all keys derived from this key will only be used for P2PKH.

That's not correct either. xpubs (as defined in BIP32) say nothing about the address type to use. ypub/zpub were defined independently, later, in unrelated standards, for a different purpose, and are only supported by some software. At some point, there was a perceived need to convey address type information in the same string as the public key, so people defined ypub/zpub/... and various other variations which (ab)use the magic value to try to convey that.

I believe this was, and is, a mistake; it is the wrong place to put this information, for two reasons:

• With Bitcoin script technology evolving, we need ever new formats, despite the keys being the same (resulting in a plethora of magic bytes today).
• In the context of multisig, you inherently need multiple public keys anyway, as they come from distinct sources, so a "higher" level of information "around" the keys is needed regardless.

Output descriptors serve this purpose of metadata about how keys are to be used now, but are a lot more recent. For example, addresses for receiving would be written as descriptors which just list the derivation paths explicitly:

• For BIP44, pkh(xpub.../44'/0'/0'/0/*)
• For BIP49, sh(pkh(xpub.../49'/0'/0'/0/*))
• For BIP84, wpkh(xpub.../84'/0'/0'/0/*)
• For a 2-of-2 P2WSH multisig, wsh(multi(2,xpub1/.../*,xpub2/.../*))
• etc

(Disclaimer: I authored BIP32 which defines xpubs, and contributed to the output descriptor format, so I am possibly biased on this topic)

Is that the purpose of the different types of extended keys (different "values" for magic)?

The parent fingerprint and the level is there so wallets can recognize implicit derivation steps.

Say you have a wallet which knows the private key to m/a/b. If it is given an xpub for m/a/b/c (which contains the fingerprint for m/a/b and the index c), it can derive the xprv for m/a/b/c by looking up the xprv for m/a/b using the fingerprint as lookup key, and computing its child c.

In retrospect, I'm not sure it was necessary to put this information in the xpub, and I don't know if it's actually used for this purpose. BIP32 was written in 2012-2013, and the Bitcoin world has changed a lot since then.