What's the point of hardened derivation when we can achieve the same effect using non-hardened derivation with a secret parent chain code?

Question

We can use xpub (extended public key) if we want to generate a new public key (and further the address) on some insecure website for each new order without knowing the private key. We'll do this by using the parent's public key and the parent's chain code from the parent's extended public key, and incrementing the index for each new child key. The problem is that by discovering the private key of one child using the formula parentPrivateKey = childPrivateKey - L256bits % n, we can discover the parent's private key, and thus the private keys for all children in that branch.

So with a non-hardened derivative function, we have:

1. (a) the possibility of deriving the public keys of children without knowing the private key of the parent
2. (a) risk of theft of all funds by knowing the private key of one child

Hence the need for hardened derivation. It works in such a way that the child keys are derived using the private key instead of the public key. Thus, leaking the private key of one child will make it impossible to discover the private key of the parent and the private key of the other children. But also, this type of implementation makes it impossible to obtain the children's public keys without knowing the parent's private key.

So with the hardened derivative function we have:

1. (b) impossibility of deriving children's public keys without the parents private key
2. (b) there is no risk of theft of all assets by knowing one child's private key

My question is why do we have a hardened derivation when we can achieve the same effect (1 (b) and 2 (b) above) using an non-hardened derivation with a secret chain code. This will give us:

1. impossibility of deriving children's public keys without the parent's private key; since the parent's chain code is required for that, and the chain code will be kept secret along with the parent's private key
2. there is no risk of theft of all funds knowing the private key of one child; since the parent's chain code is secret, it will not be possible to make L256 bits from the parent's public key + parent's chain code + index

What's the point of a hardened key derivation when we can achieve the same effects using a non-hardened derivation while keeping the parent's chain code secret?

Answer 1

You're quite right that in theory, there is likely no difference between using BIP32 hardened derivation, and using a secret xpub (I won't say no difference with certainty, as I'm not sure a security proof of their equivalence is trivial).

In practice, however, I think there is a distinction: xpubs are often exposed to users, while derivation path choices are generally not made by the user. In that regard, having software that forces (or defaults to) hardened derivation steps for (parts of) the derivation path means that the responsibility for security is removed from the user, who may not understand the seriousness of keeping a "public key" secret.