2

As I currently understand, there exist two methods for extending keys in a hierarchical deterministic wallet: regular derivation, and hardened derivation. Hardened derivation essentially “breaks the chain,” adding security because through normal derivation, a leaked child private key, along with the chain code, could be used to derive any parent private keys through subtraction.

Normal child private key derivation would happen like this: Take the HMAC-SHA512 hash of the parent public key, parent chain code, and index number. The first 256 bits are added to the parent private key to derive the child private key, and the other 256 bits are the child chain code. Using this, an adversary who possesses a child private key and the chain code could use subtraction to find the parent private key. And hardened derivation is similar, but the parent private key is used as input to the hashing function so it can’t be reversed, even if the chain code is known. The disadvantage is that a parent private key is required to generate child public keys, eliminating the possibility of a “receive only” machine having access to public keys only.

My question is, why is reversible arithmetic (addition of the parent private key and output from the hashing function) used instead of a “one way” function such as elliptic curve addition or others?

Improve this question

1 Answer 1

Reset to default
2

My question is, why is reversible arithmetic (addition of the parent private key and output from the hashing function) used instead of a “one way” function such as elliptic curve addition or others?

To allow public derivation.

This means that it is possible to give someone a parent extended key (public key + chain code), and they can derive all public keys in the chain.

If the final secret key is computed by a one-way function directly, no equivalent operations exists with public keys to compute the public version of the result.

Improve this answer
2
  • We have equations like this, where hash is the first half of the HMAC-SHA512 hash, K, k are parent keys and K1, k1 are children. K+hash = K1, k+hash = k1. There is no one directional arithmetic operation that would allow the same to be true?
    – Ivan G.
    Dec 8, 2017 at 21:12
  • No, this is provably impossible with just elliptic curve based derivations. The constructions you will come up with will either be insecure, or impossible to do without the private keys.
    – Pieter Wuille
    Dec 8, 2017 at 22:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.