I've been reading about BIP32 HD wallet and it's implementation and came across a few questions regarding the possible known "attack" vector of leaked private child keys and known xpub
parent key leading to the discovery of the parent private key.
Given the following path of an HD wallet:
m/b/p/c
Where m
is the master node derived from a seed, b, p, c
being indexed nodes in different depths.
Imagine that a server is watching and creating receiving c
addresses from p
's xpub
. If one of c
's node's private key gets leaked and the server gets hacked, thus revealing xpub
to the attacker, the attack could now generate p
's xpriv
and with that, all of c
's node's private and public address could be derived by the attacker (hardened c
nodes included).
First question: If p
was a hardened node, could the attacker still calculate its private key from it's xpub
and a child's private key ?
Second question: Could the attacker "climb up" the depth (calculate parent's xpriv
) from p
all the way over to m
after calculating p
's xpriv
from the leaked c
key and p
's xpub
? Would a hardened b
or p
make a difference here ?
Third question: If a private key from c
's depth was leaked and the attacker knew m
's xpub
, could the attacker calculate m
's private key or does the exploit only permits calculating the direct parent of a leaked child ?
Bonus question: Could anyone give actual use cases for using one or more hardened nodes in a path ?