I've been reading about BIP32 HD wallet and it's implementation and came across a few questions regarding the possible known "attack" vector of leaked private child keys and known
xpub parent key leading to the discovery of the parent private key.
Given the following path of an HD wallet:
m is the master node derived from a seed,
b, p, c being indexed nodes in different depths.
Imagine that a server is watching and creating receiving
c addresses from
xpub. If one of
c's node's private key gets leaked and the server gets hacked, thus revealing
xpub to the attacker, the attack could now generate
xpriv and with that, all of
c's node's private and public address could be derived by the attacker (hardened
c nodes included).
First question: If
p was a hardened node, could the attacker still calculate its private key from it's
xpub and a child's private key ?
Second question: Could the attacker "climb up" the depth (calculate parent's
p all the way over to
m after calculating
xpriv from the leaked
c key and
xpub ? Would a hardened
p make a difference here ?
Third question: If a private key from
c's depth was leaked and the attacker knew
xpub, could the attacker calculate
m's private key or does the exploit only permits calculating the direct parent of a leaked child ?
Bonus question: Could anyone give actual use cases for using one or more hardened nodes in a path ?