In the book named Mastering Bitcoin by Andreas, the author described the usage of derived child keys. One thing I noted was that he said(page 108),

The derivation function is a one-way function, the child key cannot be used to find the parent key. The child key also cannot be used to find any siblings.

And when he had come across the topic Hardened Child Key derivation he described the flaws of Non-Hardened Child Key derivation. He said(page 112),

Because the xpub contains the chain code, if a child private key is known, or somehow leaked, it can be used with the chain code to derive all the other child private keys. A single leaked child private key, together with a parent chain code, reveals all the private keys of all the children. Worse, the child private key together with a parent chain code can be used to deduce the parent private key.

What I can’t understand is why had the author initially stated that using child keys we cannot derive parent keys, and later stating that using child’s private key we can derive parent’s key.

Well, I’ve found one post which clearly explains the latter. But not the former. Can anyone explain what he meant in the former?

1 Answer 1


But not the former. Can anyone explain what he meant in the former?

A child key can refer to two different things: the child private key and the child public key. With just only one of these two things, you cannot determine the private or public keys of any parents or siblings. Just revealing one of those keys does not necessarily reveal any other information.

However, when a child private key AND the parent extended public key (so public key and chaincode) are revealed, we can derive the parent's private key. This requires more than just the child private key and cannot be done with a child public key.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.