# Can I verify a sub public key came from it's parent public key in a HD wallet without involving any private keys?

I know I can sign a piece of text using a bitcoin private key to prove control over a public address but are there any operations I can perform to know if a public key submitted to me was derived from a parent public key if I do not have any private keys at my disposal?

I have looked at: https://github.com/richardkiss/pycoin and https://github.com/jmcorgan/bip32utils but have not yet found a way to do it.

Thank you for any input :)

• Yes I am but one specific use case in particular involving public key verification as described above, I'm hoping @Pieter Wuille (sipa) will see this question. Thank you for the link, I will check it out :) Commented Apr 28, 2015 at 1:10
• Right, but which one are you asking about? Commented Apr 28, 2015 at 1:12
• I'm only asking if it is possible to know that a child private key came from it's parent in the absence of any secret keys and what the method would be to do it. If this is BIP32 deterministic wallet then yes I suppose this is what I am asking about :) Commented Apr 28, 2015 at 1:19

Yes, you can, assuming that the child key isn't hardened, and you know the chain code of the parent public key and the index of the child. (Also known as the extended public key.)

Just compute

CKDpub((Kpar, cpar), i) → (Ki, ci)

Kpar is the parent public key, cpar is the chain code, i is the index, and Ki is the child public key

as defined here and compare it to the child key you were given.

• Woohoo, thanks so much :) Needing to know the index is a bit of a bummer though because if I didn't know it then I would be forced to generate each child key from index 0 until I found the matching one, Am I correct in assuming this or could the index number be embedded in the key somehow? Commented Apr 28, 2015 at 1:39
• @derrend You're correct. You only need to try 2^31 keys at most, though, so it's not too bad. Commented Apr 28, 2015 at 1:50
• reading again over the link you gave me earlier, is there a method of achievig this using 'gmaxwell's proposal' and would it be more efficient? Commented Apr 28, 2015 at 4:35
• @derrend 1) Yes 2) It's probably about the same in terms of speed and complexity. Commented Apr 28, 2015 at 4:38
• Can you link me to some info if possible, I'd be interested see how it's done :) Commented Apr 28, 2015 at 4:40