Why hardended xpub key cannot generate child public key?

Question

I'm trying to understand bip32 hardened mechanism, but I'm confused about it.

I got xpubKey from this site, and what I'm trying to do is demonstrate failure when trying to generate child pubkey from hardened xpubkey.

Here's my test details.

• network : bitcoin testnet
• mnemonic : dash axis fat pilot truly river guitar sea tonight popular type ill inmate quote upset
• parent path : m/44'

• parent xpubKey : tpubDA4h4NTsxqEXATU9dPS22ZVuBHd2jVketkP8RNhBZ6fMhW9WuMhrjf37qNmfmLQZoFreLmHf9LsTnvW2eJYx1fkzo7vVxsf7bKVixz2FjGw

• target child path : m/44'/0 (non regular, just for test)

and I wrote some js code, and I assumed to fail, but succeeded.

const bitcoinjs = require('bitcoinjs-lib');

const xpubKey = 'tpubDA4h4NTsxqEXATU9dPS22ZVuBHd2jVk...';

const parentNode = bitcoinjs.bip32.fromBase58(xpubKey, bitcoinjs.networks.testnet);

////////
// I THOUGHT BELOW WILL FAIL!
//////// 

// trying to get m/44'/0
const derived = parentNode.derive(0);

// result was valid public key for m/44'/0
console.log(derived.publicKey);

In my thought, if I have a valid xpubKey(hardened or not), means that I have a valid chain code and public key for current node (means that I can derive children).

So what's meaning of

Hardened public keys cannot derive any children?

FYI, I quoted that in this video (20:24).

Answer 1

Non-hardened parents effectively use the public key to derive their children, where hardened parents derive their children from the private key.

The derivation of a child private key from a non-hardened parent private key k uses the following hash function:

HMAC-SHA512(chainCode, point(k) || i)

We know that K = point(k), where K is the parent public key. Thus, if we only know K and not necessarily k, we are still able to derive the child key by replacing point(k) with K, and follow the regular process.

With hardened private keys, the hashing is done differently:

HMAC-SHA512(chainCode, 0x00 || k || i)

Here you can see that there is no possible way that you could compute this hmac without knowing k. Just knowing the public key K will not help.

---

It looks as though you need to use the deriveHardened function in bitcoinjs rather than plain derive.