2

We can use xpub (extended public key) if we want to generate a new public key (and further the address) on some insecure website for each new order without knowing the private key. We'll do this by using the parent's public key and the parent's chain code from the parent's extended public key, and incrementing the index for each new child key. The problem is that by discovering the private key of one child using the formula parentPrivateKey = childPrivateKey - L256bits % n, we can discover the parent's private key, and thus the private keys for all children in that branch.

So with a non-hardened derivative function, we have:

  1. (a) the possibility of deriving the public keys of children without knowing the private key of the parent
  2. (a) risk of theft of all funds by knowing the private key of one child

Hence the need for hardened derivation. It works in such a way that the child keys are derived using the private key instead of the public key. Thus, leaking the private key of one child will make it impossible to discover the private key of the parent and the private key of the other children. But also, this type of implementation makes it impossible to obtain the children's public keys without knowing the parent's private key.

So with the hardened derivative function we have:

  1. (b) impossibility of deriving children's public keys without the parents private key
  2. (b) there is no risk of theft of all assets by knowing one child's private key

My question is why do we have a hardened derivation when we can achieve the same effect (1 (b) and 2 (b) above) using an non-hardened derivation with a secret chain code. This will give us:

  1. impossibility of deriving children's public keys without the parent's private key; since the parent's chain code is required for that, and the chain code will be kept secret along with the parent's private key
  2. there is no risk of theft of all funds knowing the private key of one child; since the parent's chain code is secret, it will not be possible to make L256 bits from the parent's public key + parent's chain code + index

What's the point of a hardened key derivation when we can achieve the same effects using a non-hardened derivation while keeping the parent's chain code secret?

1 Answer 1

2

You're quite right that in theory, there is likely no difference between using BIP32 hardened derivation, and using a secret xpub (I won't say no difference with certainty, as I'm not sure a security proof of their equivalence is trivial).

In practice, however, I think there is a distinction: xpubs are often exposed to users, while derivation path choices are generally not made by the user. In that regard, having software that forces (or defaults to) hardened derivation steps for (parts of) the derivation path means that the responsibility for security is removed from the user, who may not understand the seriousness of keeping a "public key" secret.

4
  • What do you mean by "derivation path"? Like the paths defined by BIP44 that have the first three "successors" derived with a hardened derivation?
    – dassd
    Jul 18, 2023 at 21:22
  • Yes, the sequence of indexes to use, and whether they're hardened or not. Jul 18, 2023 at 21:27
  • Yes, but I'm not sure I understand how the derivation path relates to the end goals of using hardened or unhardened derivations? You mean in the sense that it's good to have because it increases security and the user doesn't even have to think about it, it's part of the software, otherwise they'd have to worry about the chain code?
    – dassd
    Jul 19, 2023 at 9:54
  • Not only think about - software would need to explain to users that the risks involved when xpubs are shared. Sometimes it's desirable (e.g. when watching others' wallets), but if combined with sharing private keys it suddenly leaks your entire wallet. This is a highly unintuitive property, and the reason why hardened derivation exists in the first place. To get the same security without hardening, you'd need to very carefully explain to users the risks involved. Using a separate derivation method avoids the need for users to understand the cryptographic properties of key derivation. Jul 19, 2023 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.