When the Master Private Key and the Master Public Key are generated, can I disclose the chain code as say BIP32? If not, how can is possible verify a child public key with public parameters?

This is an important question for me because it's necessary give the possibility to verify the generated child public key to another user in my scenario.

Could the Master Private Key generated by using a random integer 0< k < n where n is the curve group order?


You can share an extended public key (xpub key), and the recipient will be able to generate child pubkeys (and thus, verify and child pubkeys provided to them). An extended public key is defined as (K,c), where K is the parent public key, and c is the chain code.

Keep in mind: anyone with the xpub key will not only be able to verify that an address you give them is derived from the xpub key, they will be able to derive all addresses related to the xpub key themselves. Depending on the situation, this may be a privacy concern.

Worth mentioning: for most applications you should not share a master extended public key. Instead, you should share an extended public key that is located at a deeper level of the derivation tree. It may also be worth looking at the benefits of using a hardened key derivation scheme, so you can create a firewall at a certain derivation depth, meaning an attacker will not be able to work back past that level in case your system is compromised.

  • So basically an Master Private Key (k) could be 0<k<n, and a Master Public Key kG where G is a point on the choosed curve. Right? – CipherX Feb 23 '18 at 7:04
  • @CipherX To create a master extended private key, you should closely follow the BIP32 standard to ensure compatibility with other wallet implementations. As for what values a private key can be, the bitcoin wiki has some good info. Copied from that page: ...any 256-bit number from 0x1 to 0xFFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFE BAAE DCE6 AF48 A03B BFD2 5E8C D036 4140 is a valid private key. The range of valid private keys is governed by the secp256k1 ECDSA standard used by Bitcoin. – chytrik Feb 24 '18 at 6:35

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.