# HD Wallet Child Private Key Derivation Function

I was trying to understand the specs on CKD function from both the bip32 standard and Mastering Bitcoin book, I couldn't understand how a private key is derived from the left side of the extended key.

The book just says the right side becomes the chain code and the left side becomes the private key, after some research online I read someone using terms like tweaks and modulus n, G which are confusing me since they were not mentioned in the book and not so much in the specification itself.

Please help me clarify on how exactly a private key is derived from the left side of output, and the relationship with all those non mentioned parts like the modulus n (Which n?), tweak (??), multiply by G ( What's G?) since all these terms are not well documented.

• N and G are fixed parameters of the secp256k1 curve. Specifically `N=115792089237316195423570985008687907852837564279074904382605163141518161494337` and `G=(55066263022277343669578718895168534326250603453777594175500187360389116729240, 32670510020758816978083085130507043184471273380659243275938904335757337482424)` Jun 12, 2018 at 10:41

A private key is a number, a very big 256 bit number. You can do ordinary arithmetic on such numbers, for example addition modulo n, where n is the order of the curve (someone else will have to expand on that if needed). n is very close to but less than 2^256.

Here's a diagram of the child private key derivation: The left 256 bits of the 512 bit hash is added modulo n to the parent private key. The sum, which is also a 256 bit number (because of modulo n), is the child private key. The sum of the parent private key and a seemingly random 256 bit number is a seemingly random 256 bit number, so that sum will function just fine as a private key.

• All operations are modulo the curve order N not modulo 2^256 Jun 12, 2018 at 10:39
• Thanks, @MikeD. Updated my answer accordingly. Jun 12, 2018 at 11:06
• From that image we can deduce that childPrivateKey= leftSideHash + parentPrivateKey ?. Correct me if I'm wrong. From that relation where's n or G used?
– Eddy
Jun 12, 2018 at 12:55
• @TheOverloadGenius n is used in the addition (addition modulo n). It says "Normal addition" in the figure but it's actually "Normal addition modulo n". Maybe I should add that to the figure. G is not used at all in child private key derivation. It's only used when calculating a public key from a private key. Jun 12, 2018 at 13:33