2

I'm confused by a statement in https://bitcoin.org/en/developer-guide#hardened-keys

"For this reason, the chain code part of an extended public key should be better secured than standard public keys"

I'm confused because I thought the chain code was an intrinsic and easily deciphered part of an extended public key. For example the top answer here explains how to derive the chain code from any extended public key:

Key derivation in HD wallets using the extended private key vs hardened derivation

So how exactly is one supposed to obey the advice from bitcoin.org to "secure" this chain code when it's openly exposed in the public key itself? Does a "hardened" public key not likewise expose its chain code?

2 Answers 2

4

The idea is that you shouldn't reveal the extended public key (and thus the chaincode) unless you want people to be able to know all of your addresses and potentially recover the extended private key. It should be considered semi-secret; more secret than just the public key itself, but less secret than the private key.

Knowing the extended public key allows someone to know what all of your addresses are, so you lose security. But it does not allow them to know the private keys except in certain circumstances. Because of the extended private key could be derived from the extended public key, you shouldn't give out the extended public key.

However there are few use cases where others do need to know the extended public key, and if you avoid the insecure case, it is safe and secure to reveal the extended public key. You just need to be extra careful in the future to avoid revealing a child key.

2
  • "it does not allow them to know the private keys except in certain circumstances" what circumstances?
    – Antoni
    Feb 2, 2022 at 11:04
  • @Antoni If keys were derived from an xpub using unhardened derivation, and a child private key is known along with the parent xpub, the parent xprv can be derived. Doing this requires knowledge of the chaincode, but that is available in the xpub.
    – Andrew Chow
    Feb 2, 2022 at 16:04
3

You can have your answer by considering why chaincode exists?

It exists to add entropy. If you read this answer you will find out that if any of your child-private-key leaks, chaincode can enable private key discovery of keys up the tree, including the master.

So it is part of a secret and hence a secret most definitely.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.