Why is BIP32 not simply PublicKey multiplication?

Question

I understand that:

pubkey(a + b) = pubkey(a).combine(pubkey(b))

where a and b are secret keys. (See: https://crypto.stackexchange.com/q/83694/17505)

If, under the circumstances:

• Bob wants to pay Alice, by creating transaction output whose private key only Alice will know, yet whose public key different from Alice's public key.
• Alice publishes pubkey(alice_secret).
• Bob creates an one-use, random secret key x_secret.
• Bob publishes x_secret.

Do the following conditions hold?

• Only Alice can sign messages with the secret key (alice_secret + x_secret), as no-one else knows both secret keys.
• Anyone can verify such a message's signature using pubkey(alice_secret).combine(pubkey(x_secret)), as pubkey(x_secret) can be calculated from the published x_secret.

If so, why is BIP32 more complex than this?

Answer 1

The purpose of BIP32 is to provide a standard for hierarchical deterministic (HD) key derivation. BIP32 allows users to back up the initial secret of their wallet, and then reconstitute all derived addresses from this initial backup in the future.

The mechanism you describe is essentially an application of an Elliptic Curve Diffie-Hellman (ECDH) to establish a shared secret. It relies on foreign input and therefore (as described) does not fulfill this backup function—each new address requires the sender's secret to be retained for the address to be recoverable in the future.

A similar approach is in use for Monero's Stealth Addresses. AFAIU, Monero solved the backup concern by using OP_RETURN outputs on the Monero blockchain to establish the shared secret. This ensures that the recipient key is sufficient to rediscover the shared secrets when resyncing the blockchain. This comes with some trade-offs: finding all recipient keys is much slower (since the blockchain has to be parsed) instead of something that can be done with local data even on offline devices and each address creation adds more data to the blockchain.