How does "hierarchical deterministic wallet" work?

I'm reading Bitcoin and Cryptocurrency Technologies. This book talks about how "hierarchical deterministic wallet" works like this:

Here it says private key generation need "k, x, y", but where is x in the equation? I mean, for "y+H(k||i)", what does it have to do with the "x"?

Hierarchical Deterministic (HD) wallets are described in BIP-32. There are a number of technical aspects to this, so for the simplicity of this answer, I'll only talk about deriving a child private key from a parent private key, using non-hardened derivation.

To keep the syntax similar to your screenshot, let `y` be the parent private key, so that `g^y` is the parent public key. In BIP-32 HD, we don't just use `y` though, we also need the chain code for `y`. They call it a random value, but in practice it is computed in a deterministic way, so that it can be retrieved later. Let's call this `k`, as the purpose in the screenshot seems to be similar.

To derive child `i`, we compute (simplified):

``````I = HMAC-SHA512(k, g^y || i).
``````

where `k` is used as a secret to compute the HMAC function. In the screenshot they simply hashed the two together, which isn't best practice, but may be simpler to understand. They also left out `g^y`, so let's ignore that too.

This value `I` we computed is 512 bits long. Split it in half, and call the left 256 bits `L` and the right 256 bits `R`:

• `R` is the child chain code (which you can ignore if you like), used to derive children of this child and continue the chain.
• The child secret key is `y + L`.

Because your screenshot simply just computes a hash, you can think of it like directly computing `L` here without computing `R`. It is safe to say that `x` is a typo though. HD derivation only needs the chain code `k` and private key `y` to compute the child private keys.