ECDSA can be thought of as a special form of mathematics where division is, for all practical purposes, impossible. Public keys are formed from private keys by multiplication -- the public key is multiplied by the generator G
. Because of the properties of multiplication, new public keys can be generated by an entity that doesn't know the corresponding private key.
First, a master public/private keypair is generated (master
, G(master)
). The master private key, master
, is stored securely. The master public key, G(master)
) is used to generate new public keys as follows:
A new public/private key pair is generated. X
, G(X)
The public key is added to the master public key. G(X) + G(master)
This new public key can now be used.
To generate the corresponding private key, the private key generated in step 1 is added to the master private key to form X + master
. This works as the private key because
G(X + Master) = G(X) + G(master)
(distributive property of multiplication). Thus the public key corresponding to the sum of the two private keys is the same as the sum of the two public keys.
You can pretty easily show that producing X + master
without knowing master
or forging a signature of G(X + master)
with only X
and G(master)
is as difficult as breaking ECDSA itself. So this scheme is as secure as any other method of using ECDSA.