How to get Private Keys for the corresponding HD generated Child Public Keys?

Question

If we take a look at the Mastering Bitcoin book by Antonopoulos it is explained how to derive child keys as described in BIP-32: From this image it is easily visible that we can use parent public key to derive child private and public key. Moreover, we can also use this method: This method is very convenient if we want to leave our parent private key at some safe/remote cold storage and only derive public keys. Using this procedure we also do not derive any child private keys so we are also safe there.

Now my question is, once we eventually decide we want to spend the funds, how do we generate corresponding child private keys? From the diagrams above, we can see that both methods are almost exactly the same, except one crucial difference: in the second method the child key which we would previously in the first method consider as PRIVATE, here we consider as PUBLIC key - it just seems as we just give the resulting left-256 bits different meaning. If it is like that, then how to we get child private key?

Speaking of that, I am also curious if there is a way to get only public key using hardened derivation?

Thanks!

Answer 1

in the second method the child key which we would previously in the first method consider as PRIVATE, here we consider as PUBLIC key - it just seems as we just give the resulting left-256 bits different meaning. If it is like that, then how to we get child private key?

No, the diagram does not show all of the specific steps. In particular, it is missing the step where the point for the left-256 bits is computed. It is clearer if you read BIP 32 itself.

The trick is that adding two private keys together result in a private key whose public key is the same as adding the two public keys for those private keys.

In both cases, the data that is hashed is the same, so the result of the hash is also the same. The difference is that in the public derivation, the point (i.e. public key) for the left 256 bits is computed, and added to the public key of the parent. For private derivation, the left 256 bits is added directly to the private key of the parent. Given the previous fact about adding two keys, the result is that the derived private key is the private key for the derived public key.

Speaking of that, I am also curious if there is a way to get only public key using hardened derivation?

No, and that is by design.