How to use UTXO of xpub derived addresses?

Question

I'm new in Bitcoin, this is something I'm confused with.

If we are deriving children, i.e. public keys, from xpub, without private keys, for the purpose of receiving outputs, how are we able to spend UTXO if we don't have private key?

In this example: https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch05.asciidoc#using-an-extended-public-key-on-a-web-store xpub is set up on server to generate public keys to receive money on e-commerce website. But how do we access that money if we don't have private keys?

Answer 1

Gabriel’s HD wallet offers a much better solution through the ability to derive public child keys without knowing the private keys. Gabriel can load an extended public key (xpub) on his website, which can be used to derive a unique address for every customer order. Gabriel can spend the funds from his Trezor, but the xpub loaded on the website can only generate addresses and receive funds.

The link you mentioned describes how you can use XPUB to get new address for each order on your website and the address will belong to your wallet setup maybe on a hardware wallet or elsewhere to spend.

But how do we access that money if we don't have private keys?

You don't access it on the web store but you access it using hardware wallet or maybe wallet setup on a different machine etc.

You can try this with btcpayserver

Answer 2

In deterministic derivation schemes such as BIP-32, the essence of a wallet is reduced to two pieces of information: a private key and a derivation rule. We call these two in combination an xPriv or extended private key. Similarly, an extended public key (xPub) consists of the corresponding public key and another derivation rule. We can easily find the public key from the private key. What about the derivation rule, though?

In the standard¹ case, the derivation rules are simple arithmetic with large numbers. Let's look at an example. Let k be the main private key, the derivation rule k' = k + 1, g the generator, and the public key K = k•g. So, when we derive the second key in the chain k' we observe

k'•g = (k+1)•g = k•g + g = K + g = K'

which means that when the private keys are a scalar series created per additions of 1, the corresponding public keys would be a series of elliptic curve points derived by additions of the generator g. So, we have both the main public key and a derivation rule by which we can find any subkey from it!

What does that have to do with your question? In the example you link to, Gabriel uses the described relationship between his xPub and his xPriv to keep the private key offline, and to only deploy the xPub on his online system. This allows Gabriel to generate addresses as needed for the webshop, but keeps the private keys from being exposed to a potentially breachable online system. When Gabriel wants to spend some funds he received, he generates the transaction with the watch-only wallet and signs it offline by deriving the corresponding private keys with his hardware wallet as needed.

---

^{¹ There are also derivation rules that do not allow public keys to be derived from the main public key, e.g. by using a step of hashing in the derivation. Such "hardened" schemes require access to the main private key to derive additional addresses.}