7

The subject pretty much asks it all. I asked the same question on the Mycelium web site but did not get an answer. An HD account can have multiple private keys. Suppose one of the previous private keys gets compromised (falls into hands of a hacker) and this private key has no bitcoins assigned to it. Would the hacker be able to re-create subsequent private keys based on this single one private key?

The question applies to Mycelium and all other HD accounts. Also, is there a standardized way how private keys are created or each wallet does it on its own?

This question is important to me since we see more and more bitcoin forks. To claim newly forked bitcoins I would need to import private key(s) into another wallet. Assuming the new wallet may be used to harvest my private keys and to spend bitcoins, I would like to move my bitcoins from my HD account from private_key1->public_key1->address1 to private_key2->public_key2->address2. If I now import private_key1 into a hacked wallet, the hacker cannot spend my bitcoins directly. But should I worry that he will be able to re-create private_key2 and therefore still be able to spend my bitcoins?

6

With just the private key, no.

However, if the attacker knows both a child private key and the xpub of the chain it is derived from, yes.

From BIP32:

One weakness that may not be immediately obvious, is that knowledge of a parent extended public key plus any non-hardened private key descending from it is equivalent to knowing the parent extended private key (and thus every private and public key descending from it). This means that extended public keys must be treated more carefully than regular public keys. It is also the reason for the existence of hardened keys, and why they are used for the account level in the tree. This way, a leak of account-specific (or below) private key never risks compromising the master or other accounts.

This means you should either never give out private keys, or treat xpubs are highly sensitive secret data.

When using hardened derivation, this problem doesn't exist, but they lack the ability to publicly derive addresses.

  • Jeez, I wish I could understand what you have just said :-) – Mr Z Nov 28 '17 at 3:04
  • Based on how I understand it. The best would be to create new HD2. Move funds from HD1 to HD2. Import the HD1 seed into new walled, claim the new coins. The problem is I have mixed feeling abandoning HD1 for which I remember the seed and getting myself into a situation where now I have a new seed and eventually getting myself into the position where I can mess up the seeds :-( Is it only me or other people have this issue as well? – Mr Z Nov 28 '17 at 3:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.