11

According to the Armory site the Public Keys needed for the Bitcoin addresses can be generated without having access to the Private Keys, which ideally are stored on a completely different computer.

What mathematical property allows public keys to be generated without having the matching private keys? I take it they are seeded by the chain code somehow, so the chain code is the stored in the watch only copy of the wallet, while the chain code + root key make up the private wallet, right?

| improve this question | |
  • Could you please give a link to the page you're referring to, and name the section of the page the comment is in? – Highly Irregular Oct 3 '12 at 21:39
11

ECDSA can be thought of as a special form of mathematics where division is, for all practical purposes, impossible. Public keys are formed from private keys by multiplication -- the public key is multiplied by the generator G. Because of the properties of multiplication, new public keys can be generated by an entity that doesn't know the corresponding private key.

First, a master public/private keypair is generated (master, G(master)). The master private key, master, is stored securely. The master public key, G(master)) is used to generate new public keys as follows:

  1. A new public/private key pair is generated. X, G(X)

  2. The public key is added to the master public key. G(X) + G(master)

  3. This new public key can now be used.

To generate the corresponding private key, the private key generated in step 1 is added to the master private key to form X + master. This works as the private key because
G(X + Master) = G(X) + G(master) (distributive property of multiplication). Thus the public key corresponding to the sum of the two private keys is the same as the sum of the two public keys.

You can pretty easily show that producing X + master without knowing master or forging a signature of G(X + master) with only X and G(master) is as difficult as breaking ECDSA itself. So this scheme is as secure as any other method of using ECDSA.

| improve this answer | |
  • In the example you give, X is some sort of incrementing value, so that the two wallet are generating the same series of Xs? – Eyal Apr 29 '13 at 21:16
  • It can be done that way. One way is to derive X from G(master) by appending an integer to it and then hashing. – David Schwartz Apr 29 '13 at 23:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.