2

Hierarchy deterministic wallets have a master public key. I fully understand elliptic curve's concept regarding to the private and public keys.
I also understand the concept that Maxwell described here to generate new public keys without knowing their corresponding private keys by only knowing the master public key. Based on Maxwell's idea if someone gets two of the children's public keys with some simple math can calculate the master public key which allows him to generate all of the user's future bitcoin addresses. So my question is

  1. Does HD wallet use the same mechanism explained by Maxwell to generate new public keys?
  2. How does an HD wallet protect its master public key?
Improve this question
1
  • 1
    I don't think I've never seen an HD wallet implementation that permitted the master public key to be determined from two child public keys.
    – David Schwartz
    Apr 15, 2015 at 6:57

2 Answers 2

Reset to default
3

In typical HD wallet implementations, some kind of hash of the master public key and the sequence number of the child key is added into the private portion of each child key. This makes the interval between private keys unpredictable to an attacker who does not know the master public key and thus the interval between public keys is likewise unpredictable. With this kind of implementation, no number of child public keys will reveal the master public key and there is no way to tell that accounts are part of the same family with only public information.

You can see the scheme I designed for Ripple here.

Improve this answer
0
0

As outlined here, non-hardened BIP32 wallets can be compromised if:

  1. The master public key is known
  2. A child private key is known

This is because the unknown (offset) - the index - can be brute forced since it's a field of 2^31.

Diagram from article

Hardened-keys use a master private key and an index >0x80000000 (2^31), denoted with prime notation, k'

Improve this answer
3
  • I don't think the OP is asking about BIP32. I made a post on meta about this: meta.bitcoin.stackexchange.com/questions/661/…
    – Nick ODell
    Apr 15, 2015 at 7:27
  • The offset is generated based on the master public key so if someone has the master public key a lager offset doesn't really help. Am I correct?
    – abeikverdi
    Apr 15, 2015 at 15:47
  • The offset is more like adding 12345 after a password. The "offset" isn't anything more than appended data. But essentially, yes, you're right. See the crack_bip32 function in pybitcointools
    – Wizard Of Ozzie
    Apr 15, 2015 at 19:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.