HD Wallets Difference between a CKDpub and CKDpriv from the path notation

I' m still trying to grasp the conventions used in HD wallets, so I have a couple of questions:

1. What's the difference between CKDpub and CKDpriv from the path notation. What I know is the path just uses h or ' to denote difference between hardened and non-hardened dervivations but I don't see the difference between a CKDpub and CKDpriv by just seeing the path.

2. From this Ethereum standard derivation node /m/44'/60'/0'/0/0 ,how can someone get the extended public key and derive other public from that extended public key respecting those conventions.

3. f(parentExtendedPubKey, index ) = childPubKey --> address. How is this achieved and how can a private key that stayed in the HD wallet can later be used to unlock or spend those funds sent to that address generated through the parent public key ?

What's the difference between CKDpub and CKDpriv from the path notation

1.

CKDpub (public key child key derivation)

Derives a child pubkey with given extended pubkey (pubkey & chaincode) and child index. Only works for non-hardened derivation.

CKDpriv (private key child key derivation)

Derives a child private key with given extended privatekey (privkey & chaincode) and child index.

The keypath does not distinguish between private- and public-keys, so on that level there is no difference between CKDpub/CKDpriv.

Although, as you mentioned, to derive a hardened key – even if you only want to derive the public key – you need the corresponding extended private key.

Examples:

1. you can derive the extended pubkey at m/1 if you have the extended pubkey m
2. You can't derive the pubkey at m/1' with the extended pubkey m
3. You can derive the pubkey (and the privkey) at m/1' with the extended privatekey m

From this Ethereum standard derivation node /m/44'/60'/0'/0/0 ,how can someone get the extended public key and derive other public from that extended public key respecting those conventions.

You need the xpriv (extended private key) to derive /m/44'/60'/0', but further public child keys (like /m/44'/60'/0'/0 and /m/44'/60'/0'/0/0) can be derived with the xpub (extended public key at /m/44'/60'/0').

f(parentExtendedPubKey, index ) = childPubKey --> address. How is this achieved and how can a private key that stayed in the HD wallet can later be used to unlock or spend those funds sent to that address generated through the parent public key ?

Deriving a child public key – regardless if you have use the xpub or xpriv – result in the same public key. Just be aware that only the xpriv can derive hardened childkeys.

Assume you have derived the pubkey at m/10 with the xpub at m, you can later derive the according priv-key at m/10 with the xpriv at m.

Further thoughts

BIP44 was designed for hardware wallets and or cold storage. Ideally you should not mix non hardened key derivation (CKDpub) with the possibility to export child private keys. If you leak a xpub and a single child private key, you reveal all your keys.

• I was thinking about building an HD wallet and then send an extended pubk on the server to generate more addresses to receiving transactions. Ideally you should not mix non hardened key derivation (CKDpub) with the possibility to export child private keys. Does this mean we should only use only hardened keys ? How can the server generate hardened keys without private keys if the idea is to only export xpub ?
– Eddy
Commented Jun 13, 2018 at 20:33
• Using a server for child key derivation can be tricky... what if the server is hacked and an attacker sends back a forged address,... would that lead to that one may send funds to the attackers address? Commented Jun 18, 2018 at 10:32
What's the difference between CKDpub and CKDpriv from the path notation


1. CKDpub (public key child key derivation)

Derives a child pubkey with given extended pubkey (pubkey & chaincode) and child index. Only works for non-hardened derivation. CKDpriv (private key child key derivation)

Derives a child private key with given extended privatekey (privkey & chaincode) and child index.

The keypath does not distinguish between private- and public-keys, so on that level there is no difference between CKDpub/CKDpriv.

Although, as you mentioned, to derive a hardened key – even if you only want to derive the public key – you need the corresponding extended private key.

Examples:

you can derive the extended pubkey at m/1 if you have the extended pubkey m
You can't derive the pubkey at m/1' with the extended pubkey m
You can derive the pubkey (and the privkey) at m/1' with the extended privatekey m

From this Ethereum standard derivation node /m/44'/60'/0'/0/0 ,how can someone get the extended public key and derive other public from that extended public key respecting those conventions.


You need the xpriv (extended private key) to derive /m/44'/60'/0', but further public child keys (like /m/44'/60'/0'/0 and /m/44'/60'/0'/0/0) can be derived with the xpub (extended public key at /m/44'/60'/0').

f(parentExtendedPubKey, index ) = childPubKey --> address. How is this achieved and how can a private key that stayed in the HD wallet can later be used to unlock or spend those funds sent to that address generated through the parent public key ?


Deriving a child public key – regardless if you have use the xpub or xpriv – result in the same public key. Just be aware that only the xpriv can derive hardened childkeys.

Assume you have derived the pubkey at m/10 with the xpub at m, you can later derive the according priv-key at m/10 with the xpriv at m. Further thoughts

BIP44 was designed for hardware wallets and or cold storage. Ideally you should not mix non hardened key derivation (CKDpub) with the possibility to export child private keys. If you leak a xpub and a single child private key, you reveal all your keys. shareedit