46

I've read BIP32, and I do understand it more or less.

Could someone please explain to me like I'm 5 years old what the difference between a child-key and a hardened child-key is?

I'm trying to add HD wallet generation to a service I'm building. I need to be completely informed about this before I dabble in it. Fret not, I'll be using Bitcore, so I won't be dabbling with the crypto directly.

Improve this question

1 Answer 1

Reset to default
42

Essentially, a hardened child key is is computed with hash(parent private key + index), whereas a non-hardened child key is computed with hash(parent public key + index).

So what practical consequences does this have?

With an extended public key, you can derive non-hardened child public keys. This is useful in situations where you want to accept payments without immediately being able to spend them. For example, if you had a website selling alpaca socks, your server could use an extended public key to accept payments without losing all of your money if it got hacked. So that's a reason why you might use non-hardened derivation.

With an extended private key, you can also derive hardened keys.

However, non-hardened public keys are weaker when an attacker has 1) the extended public key and 2) one of the non-hardened private keys that was derived from it. In that circumstance, the attacker can work out the private key of the extended public key, and therefore get every key that can be derived from that, hardened and non-hardened.

So what should your app use by default?

You should use non-hardened keys, and disable the ability to export private keys when that would allow an attacker to compromise other keys in the wallet. Even if an attacker gets ahold of one of the private keys, in situations where the attacker doesn't have access to the extended public key, non-hardened is equivalent to hardened security. In my mind, the features of non-hardened keys outweigh the added security of hardened keys.

However, if you don't need the features of non-hardened keys, then you should use hardened keys, because they're more secure.

Improve this answer
5
  • What can hardened keys be used for? What are their limitations.
    – Baz
    Jan 18, 2017 at 9:53
  • 2
    Hardened keys are useful whenever you don't need the ability to give someone a master public key, and have them know all addresses. For those cases, they have much better security properties than unhardened.
    – Pieter Wuille
    Jan 18, 2017 at 18:58
  • 4
    @PieterWuille how so? I don't think I get it. I want to make a service which generates bitcoin addresses which people can pay, and that I know I can spend from. With hardened addresses, I need a private key on this service, so if I get hacked, I lose all the money. With non-hardened addresses, there is no sensitive info on my service, so it can be hacked to no damage. I just need to store the private key safely anywhere.
    – MaiaVictor
    Sep 6, 2017 at 3:36
  • 1
    Yes, that's something you can only do with non-hardened keys.
    – Pieter Wuille
    Sep 6, 2017 at 6:16
  • How changing private key to public in the hash function makes derivation non-hardened? Or is it just a convention? There’s 0x00 prepended probably to make it look like a public key?
    – Jeiwan
    May 3, 2020 at 3:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.