8

According to the documentation on bitcoin.org and the Mastering Bitcoin book, you can use an extended public key to create child public keys in HD wallets by combining the lefthand side of the hash output of the parent chain code + parent public key + index:

The seemingly-random 256 bits on the lefthand side of the hash output are used as the integer value to be combined with either the parent private key or parent public key to, respectively, create either a child private key or child public key

I understand how this lefthand side output can be combined with the parent private key to generate the child private key, which in turn can be used to generate a valid child public key.

How is it possible that the child public key generated by combining the hash output with the parent public key corresponds to the child private key generated separately by combining the same hash output with the parent private key?

I thought that in was impossible to generate a public key without knowing exactly what the private key was. How is the relationship between child private and public keys (K = k*G) maintained when they are generated separately in this way?.

0

3 Answers 3

4

Upon a bit more searching, I found the derivation for getting the child public key without the private key here:

child_private_key == (parent_private_key + lefthand_hash_output) % G
child_public_key == point( (parent_private_key + lefthand_hash_output) % G )
child_public_key == point(child_private_key) == parent_public_key + point(lefthand_hash_output)

In terms of K, k and G where prime denotes the child and h denotes the left-hand hash output:

k' = (k + h) % G
K' = point ( (k + h) % G)
K' = point (k')
K' = K + point(h)

Here are the exact implementation details from the BIP 32 documentation

1
  • You may want to mention that point() is the ECDSA public key creation function i.e. point(private_key) == public_key.
    – Flux
    Mar 28, 2020 at 13:33
3

How is the relationship between child private and public keys (K = k*G)

(a+b)*G = aG + bG

1
  • 1
    Thanks for answering! Its helpful to see how associative addition in elliptic curve math applies to generating the public key while using the private key. But I still don't understand how that generates a public key without using a private key. If a = [lefthand hash output] and b = [parent private key], I can see how that equation generates the public key, but how does that get me the child public key without the parent private key?
    – Seb
    Oct 31, 2017 at 15:13
2

There two ways to go from parent to child, non-hardened and hardened, the former allowing both (1) a parent private key -> child private key function and (2) a parent public key -> child public key function. (Hardened parent -> child relationship provides only function (1)).

If you look at :-

https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Child_key_derivation_CKD_functions

the function (1) is defined as follows :-

ki = IL + kpar (mod n)                               (A)

n being the order of the Elliptic Curve Group E for Bitcoin's ECDSA (which has parameters secp256k1) - E being generated by the generator (or 'base') point G in E.

E is the Elliptic Curve Group over the finite field Fp (prime p = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F), and consists of n elements (prime n = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141) (note n is proportionately slightly less than p).

The elements of E are elements of Fp x Fp, and are points on the discrete elliptic curve over Fp. E is an 'additive' abelian group, and we can define scalar multiplication of elements of E by integers. G in E being a generator means E equals the set of all scalar multiples of G, ie E = {dG: d an integer}, denoted <G >.

By definition a private key k is a 256 bit integer in the range [1, n - 1]. And the associated public key is K given by

K = kG                               (B)

In the above BIP32 document, the notation point(p) is used to mean pG :-

point(p) = pG                     (C)

Thus in particular :-

point(k) = K

It is straightforward that the above scalar multiplication operation in E satisfies the distributive law :-

(a + b)P = aP + bP                (D)

where a, b are integers and P is any point in E.

If we imagine for the moment the above equation (A) didn't have the 'mod n' part then it is just adding two integers so we deduce from (D) and (A) :-

kiG = ILG + kparG

But since G has order n, so that nG = 0, we can change the left hand side ki value so that ki is in the range [1, n - 1] (this is the 'mod n' part).

But this equation then just reads :-

Ki = ILG + Kpar                (E)

because of the above general relation K = kG between private key and public key, and because ki is now a valid private key in the range [1, n - 1].

(Notice if the above procedure produces an unsuitable ki, such as zero, then it is repeated with the next value of the index i).

If you now examine the above BIP32 document for "Public parent key -> public child key" it says :-

"The returned child key Ki is point(parse256(IL)) + Kpar"

which by the definition of 'point' in (C) above means a child public key of :-

Ki = ILG + Kpar              (F)

ie identical to the public key Ki of the child private key, as derived above at (E), as desired.

In short equation (A) just says add IL to the parent private key to get the child private key. This is just addition of two integers (mod n).

And equation (F) just says add ILG to the parent public key to get the child public key. This is an entirely different addition operation, namely 'point addition' on the elliptic curve group E.

The key to this working is that the 512 bit hash 'I' does not depend on the parent private key. With hardened child, the definition of 'I' is changed so it DOES depend on the parent private key, and thus a parent public key -> child public key function cannot be defined in this case.

1
  • Putting aside the associative maths, which seem to make sense i.e. equivalence between Equations (A) and (F), how is this equivalence real when the value of IL must be completely different in each of these cases - assuming IL is the left 256 bits of the HMAC hash of [parent private key + parent chain code + index] in Eq. (A) and left 256 bits of HMAC hash of [parent public key + parent chain code + index]? edit: I've since noted that the data hashed by HMAC is the exactly the same in both cases i.e. uses [public key + chain code + index] for generation of both private and public child keys, so
    – b0d
    May 24, 2022 at 4:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.