How exactly can hardened keys work?? (HD Wallets!)

Question

After reading Chptr 5, Wallets, from the Bitcoin Book, I have some questions:

So I understand that the leak of an xpub+child priv key = compromised wallet.

1)How compromised is the wallet? Just from that leaked child down the tree or??

To solve this, we have hardened keys. However, one of the major ups of xpub keys is the ability to generate a bunch of addresses online, for an eCommerce or etc. Then we can offline, generate the child priv keys using the xpriv derivation.

2)So do we have to choose between this method and hardened keys? Or rather, using the eCommerce example, would all generated addresses be on the same level in the tree? Therefore allowing all of them to come from a hardened parent? I think in this scenario, it would minimize corruption to only that specific address correct? Also if the children came from a hardened parent, then each child from that parent would need to create one child under it with the xpub derivation?

3) Is the xpub derivation method even used?? What's the advantage of using it if everyone is worried about a compromised wallet? As stated above, it doesn't seem to be useful really?

If anyone has any good links to diagrams, that are not from the Bitcoin Book, that would be very helpful!

Answer 1

How compromised is the wallet? Just from that leaked child down the tree or??

With unhardened derivation, knowing the parent xpub, a child private key, and the index of the child allows for the parent xprv (private key) to be derived. This then allows for all of that parent's child private keys to be derived. Thus all of the funds associated with those child keys can be taken.

Derivation of parent private key from non-hardened child explains how that is done.

So do we have to choose between this method and hardened keys? Or rather, using the eCommerce example, would all generated addresses be on the same level in the tree? Therefore allowing all of them to come from a hardened parent?

Yes. Really the choice is between whether you want private keys to be on the machine that produces addresses. Hardened derivation requires the parent private key. If you are okay with the parent private key being on the same machine that produces addresses, then you can use hardened derivation.

However this is generally not recommended for public facing things like eCommerce stores. The machine running a website shouldn't have private keys, so you will have to use unhardened derivation.

Is the xpub derivation method even used?? What's the advantage of using it if everyone is worried about a compromised wallet? As stated above, it doesn't seem to be useful really?

Unhardened derivation is commonly used, and actually recommended. The risk is only if the parent xpub is leaked (which should really only happen if you give it out) and a child private key is leaked (which should only happen if you give it out). So long as you never give out private keys, then there is no issue. There's almost no reason to ever give out child private keys anyways, so this is never really a problem.