When using a hardware wallet, how do I know that the change address is one that I own?

Question

When signing a transaction on my coldcard, I see a change address that is not listed (at least on the first 30 addresses) on my coldcard. I believe coldcard would only allow me to sign a transaction to a change back address that I own, but how do I know that I own this? It's not listed on the addresses list, maybe possibly because the change back is generated in another way so it does not waste my pre-generated addresses.

Answer 1

Generally payment addresses and change addresses are drawn from separate key derivation chains (cfr. BIP32, which suggests using derivation paths ending in .../0/* for payment addresses and .../1/* for change addresses). There are multiple reasons for this:

• Change addresses can function with lower gap limits (number of unused addresses between used ones), as you're always creating the outputs yourself immediately after choosing them, while payment addresses can remain unused as long as a payment is outstanding. That said, in practice, it appears most systems use identical gap limits for both.
• Separating the paths means it is possible to reveal to e.g. an auditor your incoming payments without revealing the outgoing ones. While possible, I have not heard about anyone using this possibility in practice.

If the hardware wallet is telling you what the total sent amount is, it means it performed analysis that the change is in fact change. Otherwise it would be treated as outgoing money.