According to the Armory site the Public Keys needed for the Bitcoin addresses can be generated without having access to the Private Keys, which ideally are stored on a completely different computer.
What mathematical property allows public keys to be generated without having the matching private keys? I take it they are seeded by the chain code somehow, so the chain code is the stored in the watch only copy of the wallet, while the chain code + root key make up the private wallet, right?
ECDSA can be thought of as a special form of mathematics where division is, for all practical purposes, impossible. Public keys are formed from private keys by multiplication -- the public key is multiplied by the generator G. Because of the properties of multiplication, new public keys can be generated by an entity that doesn't know the corresponding private key.
First, a master public/private keypair is generated (master, G(master)). The master private key, master, is stored securely. The master public key, G(master)) is used to generate new public keys as follows:
A new public/private key pair is generated. X, G(X)
The public key is added to the master public key. G(X) + G(master)
This new public key can now be used.
To generate the corresponding private key, the private key generated in step 1 is added to the master private key to form X + master. This works as the private key becauseG(X + Master) = G(X) + G(master) (distributive property of multiplication). Thus the public key corresponding to the sum of the two private keys is the same as the sum of the two public keys.
You can pretty easily show that producing X + master without knowing master or forging a signature of G(X + master) with only X and G(master) is as difficult as breaking ECDSA itself. So this scheme is as secure as any other method of using ECDSA.
