5

I know I can sign a piece of text using a bitcoin private key to prove control over a public address but are there any operations I can perform to know if a public key submitted to me was derived from a parent public key if I do not have any private keys at my disposal?

I have looked at: https://github.com/richardkiss/pycoin and https://github.com/jmcorgan/bip32utils but have not yet found a way to do it.

Thank you for any input :)

Improve this question
4
  • Are you asking about BIP32 or deterministic type 2 wallets? See also: meta.bitcoin.stackexchange.com/questions/661/…
    – Nick ODell
    Apr 28, 2015 at 1:06
  • Yes I am but one specific use case in particular involving public key verification as described above, I'm hoping @Pieter Wuille (sipa) will see this question. Thank you for the link, I will check it out :)
    – derrend
    Apr 28, 2015 at 1:10
  • Right, but which one are you asking about?
    – Nick ODell
    Apr 28, 2015 at 1:12
  • I'm only asking if it is possible to know that a child private key came from it's parent in the absence of any secret keys and what the method would be to do it. If this is BIP32 deterministic wallet then yes I suppose this is what I am asking about :)
    – derrend
    Apr 28, 2015 at 1:19

1 Answer 1

Reset to default
8

Yes, you can, assuming that the child key isn't hardened, and you know the chain code of the parent public key and the index of the child. (Also known as the extended public key.)

Just compute

CKDpub((Kpar, cpar), i) → (Ki, ci)

Kpar is the parent public key, cpar is the chain code, i is the index, and Ki is the child public key

as defined here and compare it to the child key you were given.

Improve this answer
6
  • Woohoo, thanks so much :) Needing to know the index is a bit of a bummer though because if I didn't know it then I would be forced to generate each child key from index 0 until I found the matching one, Am I correct in assuming this or could the index number be embedded in the key somehow?
    – derrend
    Apr 28, 2015 at 1:39
  • 1
    @derrend You're correct. You only need to try 2^31 keys at most, though, so it's not too bad.
    – Nick ODell
    Apr 28, 2015 at 1:50
  • reading again over the link you gave me earlier, is there a method of achievig this using 'gmaxwell's proposal' and would it be more efficient?
    – derrend
    Apr 28, 2015 at 4:35
  • @derrend 1) Yes 2) It's probably about the same in terms of speed and complexity.
    – Nick ODell
    Apr 28, 2015 at 4:38
  • Can you link me to some info if possible, I'd be interested see how it's done :)
    – derrend
    Apr 28, 2015 at 4:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.