If a single private key of the HD bitcoin account is compromised, is the whole HD account compromised?

Question

The subject pretty much asks it all. I asked the same question on the Mycelium web site but did not get an answer. An HD account can have multiple private keys. Suppose one of the previous private keys gets compromised (falls into hands of a hacker) and this private key has no bitcoins assigned to it. Would the hacker be able to re-create subsequent private keys based on this single one private key?

The question applies to Mycelium and all other HD accounts. Also, is there a standardized way how private keys are created or each wallet does it on its own?

This question is important to me since we see more and more bitcoin forks. To claim newly forked bitcoins I would need to import private key(s) into another wallet. Assuming the new wallet may be used to harvest my private keys and to spend bitcoins, I would like to move my bitcoins from my HD account from private_key1->public_key1->address1 to private_key2->public_key2->address2. If I now import private_key1 into a hacked wallet, the hacker cannot spend my bitcoins directly. But should I worry that he will be able to re-create private_key2 and therefore still be able to spend my bitcoins?

Answer 1

With just the private key, no.

However, if the attacker knows both a child private key and the xpub of the chain it is derived from, yes.

From BIP32:

One weakness that may not be immediately obvious, is that knowledge of a parent extended public key plus any non-hardened private key descending from it is equivalent to knowing the parent extended private key (and thus every private and public key descending from it). This means that extended public keys must be treated more carefully than regular public keys. It is also the reason for the existence of hardened keys, and why they are used for the account level in the tree. This way, a leak of account-specific (or below) private key never risks compromising the master or other accounts.

This means you should either never give out private keys, or treat xpubs are highly sensitive secret data.

When using hardened derivation, this problem doesn't exist, but they lack the ability to publicly derive addresses.