I know I can sign a piece of text using a bitcoin private key to prove control over a public address but are there any operations I can perform to know if a public key submitted to me was derived from a parent public key if I do not have any private keys at my disposal?

I have looked at: https://github.com/richardkiss/pycoin and https://github.com/jmcorgan/bip32utils but have not yet found a way to do it.

Thank you for any input :)

  • Are you asking about BIP32 or deterministic type 2 wallets? See also: meta.bitcoin.stackexchange.com/questions/661/… – Nick ODell Apr 28 '15 at 1:06
  • Yes I am but one specific use case in particular involving public key verification as described above, I'm hoping @Pieter Wuille (sipa) will see this question. Thank you for the link, I will check it out :) – derrend Apr 28 '15 at 1:10
  • Right, but which one are you asking about? – Nick ODell Apr 28 '15 at 1:12
  • I'm only asking if it is possible to know that a child private key came from it's parent in the absence of any secret keys and what the method would be to do it. If this is BIP32 deterministic wallet then yes I suppose this is what I am asking about :) – derrend Apr 28 '15 at 1:19

Yes, you can, assuming that the child key isn't hardened, and you know the chain code of the parent public key and the index of the child. (Also known as the extended public key.)

Just compute

CKDpub((Kpar, cpar), i) → (Ki, ci)

Kpar is the parent public key, cpar is the chain code, i is the index, and Ki is the child public key

as defined here and compare it to the child key you were given.

  • Woohoo, thanks so much :) Needing to know the index is a bit of a bummer though because if I didn't know it then I would be forced to generate each child key from index 0 until I found the matching one, Am I correct in assuming this or could the index number be embedded in the key somehow? – derrend Apr 28 '15 at 1:39
  • @derrend You're correct. You only need to try 2^31 keys at most, though, so it's not too bad. – Nick ODell Apr 28 '15 at 1:50
  • reading again over the link you gave me earlier, is there a method of achievig this using 'gmaxwell's proposal' and would it be more efficient? – derrend Apr 28 '15 at 4:35
  • @derrend 1) Yes 2) It's probably about the same in terms of speed and complexity. – Nick ODell Apr 28 '15 at 4:38
  • Can you link me to some info if possible, I'd be interested see how it's done :) – derrend Apr 28 '15 at 4:40

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.