I understand that:

pubkey(a + b) = pubkey(a).combine(pubkey(b))

where a and b are secret keys. (See: https://crypto.stackexchange.com/q/83694/17505)

If, under the circumstances:

  • Bob wants to pay Alice, by creating transaction output whose private key only Alice will know, yet whose public key different from Alice's public key.
  • Alice publishes pubkey(alice_secret).
  • Bob creates an one-use, random secret key x_secret.
  • Bob publishes x_secret.

Do the following conditions hold?

  • Only Alice can sign messages with the secret key (alice_secret + x_secret), as no-one else knows both secret keys.
  • Anyone can verify such a message's signature using pubkey(alice_secret).combine(pubkey(x_secret)), as pubkey(x_secret) can be calculated from the published x_secret.

If so, why is BIP32 more complex than this?

  • BIP32 is hierarchical deterministic key derivation. What you describe is not deterministic, but relies on foreign data. Could you elaborate how the two fulfill the same or a similar purpose? (Or is that your question?)
    – Murch
    Apr 24, 2021 at 11:52
  • Thanks, I think you've answered my question. What I am describing is not deterministic, but instead a way for Bob to Pay Alice in a way that Alice can receive the funds, but using a different public key for each transaction. If you rephrase your comment as an answer, I'll accept it.
    – fadedbee
    Apr 24, 2021 at 13:20

1 Answer 1


The purpose of BIP32 is to provide a standard for hierarchical deterministic (HD) key derivation. BIP32 allows users to back up the initial secret of their wallet, and then reconstitute all derived addresses from this initial backup in the future.

The mechanism you describe is essentially an application of an Elliptic Curve Diffie-Hellman (ECDH) to establish a shared secret. It relies on foreign input and therefore (as described) does not fulfill this backup function—each new address requires the sender's secret to be retained for the address to be recoverable in the future.

A similar approach is in use for Monero's Stealth Addresses. AFAIU, Monero solved the backup concern by using OP_RETURN outputs on the Monero blockchain to establish the shared secret. This ensures that the recipient key is sufficient to rediscover the shared secrets when resyncing the blockchain. This comes with some trade-offs: finding all recipient keys is much slower (since the blockchain has to be parsed) instead of something that can be done with local data even on offline devices and each address creation adds more data to the blockchain.

  • Paynyms uses BIP 47 to generate addresses by the shared secret of the sender's payment code and the receiver's payment code. Includes OP_RETURN transaction as well mentioned in this answer: bitcoin.stackexchange.com/a/54753
    – user103136
    Apr 24, 2021 at 15:42
  • BIP47 was not well received, and is discouraged from being implemented.
    – Murch
    Apr 25, 2021 at 11:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.