I heard Michael Flaxman say that if an attacker obtains your xpub key as well as any one of your child private keys, they can calculate your master private key?
Why is this not a huge deal? Where are the cryptographic math gods to come up with a better non-reversible algorithm?
Simply put, it does not appear that a generic solution to this problem is possible within the realm of discrete logarithm based cryptography.
Solutions exist, but they would require a different type of cryptographic construction (like pairing based cryptography), which would introduce additional security assumptions (and mean a different signature scheme than ECDSA/Schnorr would need to be used).
It is however a known problem, and explained in the original BIP (disclaimer: I'm the author). The (admittedly, only partial) solution was the hardened derivation mode, which breaks this ability to compute the parent private key from parent public key and child private key. Unfortunately, it also breaks the ability to derive child public keys without access to the parent private keys.
Of course, the most powerful defense is never sharing any private keys with any other party at all.
