I'm reading Bitcoin and Cryptocurrency Technologies. This book talks about how "hierarchical deterministic wallet" works like this:

enter image description here

Here it says private key generation need "k, x, y", but where is x in the equation? I mean, for "y+H(k||i)", what does it have to do with the "x"?

1 Answer 1


Hierarchical Deterministic (HD) wallets are described in BIP-32. There are a number of technical aspects to this, so for the simplicity of this answer, I'll only talk about deriving a child private key from a parent private key, using non-hardened derivation.

To keep the syntax similar to your screenshot, let y be the parent private key, so that g^y is the parent public key. In BIP-32 HD, we don't just use y though, we also need the chain code for y. They call it a random value, but in practice it is computed in a deterministic way, so that it can be retrieved later. Let's call this k, as the purpose in the screenshot seems to be similar.

To derive child i, we compute (simplified):

I = HMAC-SHA512(k, g^y || i).

where k is used as a secret to compute the HMAC function. In the screenshot they simply hashed the two together, which isn't best practice, but may be simpler to understand. They also left out g^y, so let's ignore that too.

This value I we computed is 512 bits long. Split it in half, and call the left 256 bits L and the right 256 bits R:

  • R is the child chain code (which you can ignore if you like), used to derive children of this child and continue the chain.
  • The child secret key is y + L.

Because your screenshot simply just computes a hash, you can think of it like directly computing L here without computing R. It is safe to say that x is a typo though. HD derivation only needs the chain code k and private key y to compute the child private keys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.