3

I have been reading about Account Extended Private Key and Account Extended Public Key that derives from the Master Private Key and Master Public Key, but I still have some question about their security.

I read that Account Extended Private Key should be kept private because if others got hold of it, they could sign the transaction with the key, effectively stealing your cryptocurrency. How does this work exactly? Is there an application that I can import other's Account Extended Private Key and send certain amount to my other wallet's address?

Also, I read that Account Extended Public Key should be kept private as well because exposing it to others allow them to go through the transactions. How does this work? Is there an application that I can import to view the transaction history?

Improve this question

1 Answer 1

Reset to default
2

I read that Account Extended Private Key should be kept private because if others got hold of it, they could sign the transaction with the key, effectively stealing your cryptocurrency. How does this work exactly?

Also, I read that Account Extended Public Key should be kept private as well because exposing it to others allow them to go through the transactions. How does this work?

Extended keys allow for private and public keys to be derived from them. This is done using the algorithm described in BIP 32.

Your Account Extended Private Key is used to derive child private keys which are the actual private keys for your addresses. If someone gets ahold of this extended private key, they can derive all of your private keys and thus spend your Bitcoin.

Your Account Extended Public Key can be used to derive all of the child public keys in a similar way to how the Account Extended Private Key can be used to derive all of the child private keys. Knowing the public keys means that the addresses can be derived and thus anyone who has your Account Extended Public Key will know all of your addresses. They can thus observe every single transaction you receive and make.

Is there an application that I can import other's Account Extended Private Key and send certain amount to my other wallet's address?

Is there an application that I can import to view the transaction history?

You can import extended keys (public or private) into Electrum which will scan the blockchain for transactions related to child keys derived from those extended keys.

Improve this answer
4
  • You said Account Extended Private/Public Key is used to derive the private/public key for my addresses used to receive/send cryptocurrency. I was wondering if it's Account Extended Keys -> Address Keys or Account Extended Keys -> BIP32 Extended Keys -> Address Keys?
    – Carol Ward
    Apr 16, 2019 at 19:10
  • 1
    Account extended key is not really a thing. It just means it's a BIP 32 extended key derived from a master extended private key at the account level in accordance to BIP 44. Usually it's the key derived from the master key at m/44'/0'/0'. So it's really BIP 32 extended key (which you call account extended key) -> BIP 32 extended key (the key for whether the child keys are change or not) -> child keys (address keys).
    – Andrew Chow ♦
    Apr 16, 2019 at 19:25
  • ohhh, I got it! If you don't mind, I have 1 more question. Then in order to see the transaction of the account, I just need to import the BIP 32 extended key (the account extended key), not extended key for the change, right? I just imported the BIP 32 extended key (account extended key), and I don't see any transaction history. Does it not show a previous transaction? only future ones?
    – Carol Ward
    Apr 16, 2019 at 19:39
  • Electrum derives both normal receiving addresses and change addresses, so just importing your account extended key is fine. As for why your transactions don't appear, I don't know. Electrum will rescan and pull transactions from the blockchain, so they should appear. It may be that your addresses are not derived at the derivation paths that Electrum is using.
    – Andrew Chow ♦
    Apr 17, 2019 at 1:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.