7

Suppose you have a possibly compromised system, which you do not trust enough to stores your private keys on.

Is there some process where you can generate unique bitcoin addresses within the system, that does not contain a private key?

To clarify:

You have a web server that clients use to make orders. You want to create a unique bitcoin address per purchase. In addition, you don't want the server to contain your bitcoin private keys - an attacker gaining access to the server shouldn't be able to touch your bitcoins.

Improve this question
5
  • I've no idea what are you talking about.
    – o0'.
    Mar 5, 2013 at 13:05
  • @Lohoris - I was missing the word "without" in the title. Added clarification in the question body.
    – ripper234
    Mar 5, 2013 at 14:20
  • Much better now, I'd like to have an answer too.
    – o0'.
    Mar 5, 2013 at 14:54
  • @Lohoris - I think my answer is not bad, but I open to other suggestions.
    – ripper234
    Mar 5, 2013 at 15:07
  • 1
    I was doubtful since you said "I guess", and I was waiting for someone to eventually confirm it can be done, as you guessed ;)
    – o0'.
    Mar 5, 2013 at 15:11

7 Answers 7

Reset to default
4

Yes

I love how all the upvoted answers talk about multisig or electrum but the one answer that mentions HD wallets is at -1.

HD wallets allow you to do this.

TL;DR Derivations per level on an HD wallet use 3 portions in 2 different hashes. 1 hash requires the parent public key and parent chain code (summed together creating the parent extended public key) and the other hash requires the parent private key and the left half of the output of the 1st hash.

Confused? The diagram at the bottom oughta help. At the end of the day, the private keys used to sign are derived from the chain of private keys all the way from the ECDSA key. If you only derive from the extended public key (public key + chain code) then you can derive as many addresses as your heart desires without giving up the private key. Minus the chain code and you're unable to generate many addresses (chain code gives up privacy AKA ability to derive many valid addresses)

enter image description here

Improve this answer
1
  • Indeed! This is the best answer.
    – ripper234
    Aug 17, 2018 at 15:19
2

You should generate the keys in a secured environment and then move only the public parts to the server which you don't trust. Keep the private ones secured - you need these for spending.

Improve this answer
1
  • 1
    This doesn't allow the insecure server to generate an arbitrary number of addresses without communication with the secure server.
    – Meni Rosenfeld
    Mar 5, 2013 at 16:15
2

Multisig can be used for it, but is overkill and requires P2SH to be usable as phrased.

What you do need has been sometimes referred to as "EC magic". Both private keys and public keys are a sort of numbers which can be added, and the public key corresponding to the sum of private keys is the sum of public keys.

So in the secure server you'll have a private key d1. The insecure server will have the corresponding public key P1, and for every customer it will generate a private key d2 and corresponding P2. The public key is P1+P2; d2 can be sent to the secure server, which will calculate the private key d1+d2.

Schemes based on multiplication rather than addition are also possible.

Improve this answer
1
  • This is the right way to do this. It works because EC's private key to public key conversion behaves like multiplication and G(X + Y) = G(X) + G(Y). So given G(X), but not X, you can pick a random Y, and calculate G(X) + G(Y) (which is also G(X+Y) and thus a public key) but not X + Y (the corresponding private key). If you store Y and G(X+Y), you have a public key and enough information to compute the private key only if given X (which you store on another machine). (Ripple's account families work this way.)
    – David Schwartz
    Mar 6, 2013 at 7:23
2

Electrum seedless wallets for a desktop http://electrum.org and Electrum POS system for servers https://github.com/kangasbros/electrumpos

For desktop is really easy to setup, just restore from your Master Public Key and you'll get a seedless wallet without private keys but with the privilege of creating new addresses.

For servers you need to install Electrum pos system, see it in action here http://acceptbit.com

Improve this answer
0

I believe multisig can be used to implement this - keep only one part of the pair on the system, and use it to generate addresses. I don't know whether multisig support exists in the popular packages implementing bitcoin, but it's one direction that would work.

You'll only be able to spend them using both keys, which are stored only on the secure system.

Improve this answer
0
0

Armory enables exactly what you're looking to do with its Watching Wallet. Because of its deterministic nature, you can generate unlimited public keys which you can assign to each customer while the private keys sit safely on an offline computer somewhere.

Improve this answer
0

You can play with BIP32 here: http://bip32.org/ With Bitcoin Master Private Key you can generate Derived Private Key(s) and Derived Public Key(s). With Derived Public Key you can generate Bitcoin addresses. With Derived Private Key you can later generate private keys to move Bitcoin from those addresses.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.