I was trying to understand the specs on CKD function from both the bip32 standard and Mastering Bitcoin book, I couldn't understand how a private key is derived from the left side of the extended key.

The book just says the right side becomes the chain code and the left side becomes the private key, after some research online I read someone using terms like tweaks and modulus n, G which are confusing me since they were not mentioned in the book and not so much in the specification itself.

Please help me clarify on how exactly a private key is derived from the left side of output, and the relationship with all those non mentioned parts like the modulus n (Which n?), tweak (??), multiply by G ( What's G?) since all these terms are not well documented.

  • N and G are fixed parameters of the secp256k1 curve. Specifically N=115792089237316195423570985008687907852837564279074904382605163141518161494337 and G=(55066263022277343669578718895168534326250603453777594175500187360389116729240, 32670510020758816978083085130507043184471273380659243275938904335757337482424) – Mike D Jun 12 '18 at 10:41

A private key is a number, a very big 256 bit number. You can do ordinary arithmetic on such numbers, for example addition modulo n, where n is the order of the curve (someone else will have to expand on that if needed). n is very close to but less than 2^256.

Here's a diagram of the child private key derivation:

enter image description here

The left 256 bits of the 512 bit hash is added modulo n to the parent private key. The sum, which is also a 256 bit number (because of modulo n), is the child private key. The sum of the parent private key and a seemingly random 256 bit number is a seemingly random 256 bit number, so that sum will function just fine as a private key.

  • All operations are modulo the curve order N not modulo 2^256 – Mike D Jun 12 '18 at 10:39
  • Thanks, @MikeD. Updated my answer accordingly. – Kalle Rosenbaum Jun 12 '18 at 11:06
  • From that image we can deduce that childPrivateKey= leftSideHash + parentPrivateKey ?. Correct me if I'm wrong. From that relation where's n or G used? – OvGeny Jun 12 '18 at 12:55
  • @TheOverloadGenius n is used in the addition (addition modulo n). It says "Normal addition" in the figure but it's actually "Normal addition modulo n". Maybe I should add that to the figure. G is not used at all in child private key derivation. It's only used when calculating a public key from a private key. – Kalle Rosenbaum Jun 12 '18 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.