37 votes
Accepted

ELI5: What's the difference between a child-key and a hardened child-key in BIP32

Essentially, a hardened child key is is computed with hash(parent private key + index), whereas a non-hardened child key is computed with hash(parent public key + index). So what practical ...
user avatar
  • 28.6k
32 votes

Key derivation in HD wallets using the extended private key vs hardened derivation

There's a lot of confusion here, mostly bits and pieces of the whole scheme that is Hierarchical Deterministic derivation, and finally two questions that seem to indicate missing some point about it. ...
user avatar
  • 1,794
19 votes
Accepted

What is the wallet "word seed" that is commonly used in popular wallets clients and what does it do?

With HD wallets, a single key can be used to generate an entire tree of key pairs. This single key serves as the "root" of the tree. The word seed is simply a more human-readable way of expressing ...
user avatar
  • 8,724
19 votes
Accepted

How are different addresses generated from the same private key?

Private and public key correspond to a point on the secp256k1 curve. They have a one-to-one relationship. The address is derived from the public key by performing a ripemd160 hash after a sha256 hash ...
user avatar
  • 62.3k
18 votes
Accepted

Derivation of parent private key from non-hardened child

First we must understand how BIP 32 derives non-hardened private and public keys. From BIP 32, deriving a child private key from an extended parent private key: let I = HMAC-SHA512(Key = cpar, Data = ...
user avatar
  • 60.4k
11 votes
Accepted

What BIP32 derivation path does Electrum use?

It uses m/0/<n> for receiving addresses, and m/1/<n> for change addresses. Here's some example bitcoinj code to generate receiving addresses from an extended public key. String ...
user avatar
  • 28.6k
11 votes
Accepted

difference between Master Public/private Key and Public/private Key?

With "Master public key" you probably refer to deterministic key derivation after bip32. The correct term is "Master extended private key" (acronym xpriv) and "Master extended public key" (acronym ...
user avatar
10 votes

Pros/Cons/Limitations of Mnemonic Phrases - BIP39

to answer the first part; generally speaking people will want to backup their whole wallet, not specific PKs. so using a HD wallet and making a backup of the seed (either the seed or a BIP39 mnemonic ...
user avatar
10 votes
Accepted

How to use NBitcoin for BIP32 wallets

when you are doing BitcoinAddress address1 = **pubKey**.Derive([some client data]).PubKey.GetAddress(Network.Main); You are getting the bitcoin address, but not the master public key. (ExtPubKey) A ...
user avatar
10 votes
Accepted

Best Practices for hardened keys in HD wallets?

The simple (and I believe correct) answer is: use hardened keys everywhere except where a need for watching-only wallets is perceived, e.g. below the "account" level. A watching only-wallet in this ...
user avatar
10 votes

How are different addresses generated from the same private key?

With Bitcoin, a single private key will have associated compressed and uncompressed private/public key pairs. Uncompressed public key addresses are larger in size than newer compressed public ...
user avatar
  • 2,917
10 votes
Accepted

Is the Electrum seed compatible with other wallets?

There are different "backup-standards". Some use BIP39 (mnemonic) which lacks a flexible wordlist and versioning. It's used by Ledger, Trezor, Bitpay/Copay, etc. Electrum uses a different – more ...
user avatar
9 votes

Best Practices for hardened keys in HD wallets?

It is possible for a custom implementation use hardened keys for all the leaf keys to enhance security in case of a single private key leak. This scheme will be incompatible with the standard ...
user avatar
9 votes

How are different addresses generated from the same private key?

Whenever you are attempting to explain Bitcoin to anyone, it makes a lot of sense to simply state that the derivation private key > public key > address is deterministic. However, if you are ...
user avatar
9 votes

How to get xpub or mpk(bip32) for my bitcoin core wallet?

Bitcoin Core (since 0.13) uses HD after BIP32 with only hardened private key derivation. Exporting the xpub would be useless, because other apps could not derive public keys (hardened derivation ...
user avatar
9 votes
Accepted

BIP32 recommends a 256 bit seed. Why do most Bitcoin wallets only use a 128 bit seed?

The reasons for the 3 numbers: Bitcoin uses 256-bit ECDSA signatures. These require in the order of 2128 steps to find a private key from the public key is known. This is Bitcoin's security level: we ...
user avatar
8 votes
Accepted

How does the client know the number of keys and coins when recovering from a seed?

There is a so-called gap limit. In Electrum, it's 20 by default but can be changed. But if you changed it up, remember that! Preferably write it next to your wallet's seed. This means that the HD ...
user avatar
  • 3,144
7 votes

HMAC "Bitcoin Seed" for BIP32

It is specified in BIP32 (https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki). The SHA512-HMAC function is reused because it is already part of the standard elsewhere, but it takes a key ...
user avatar
7 votes
Accepted

How do I view the extended public key in Electrum?

How do I view my extended public key? Go to Wallet > Master Public Keys, and copy the text that starts with xpub What are the consequences of giving my extended public key to someone? They can ...
user avatar
  • 28.6k
7 votes
Accepted

How to import a HD wallet from an extended private key

Response to clarified first part You're pretty close, I suspect you want something simpler like this (and then typing in the xprv you extracted from an Electrum 2.x (unencrypted) wallet file): bx hd-...
user avatar
7 votes
Accepted

Can I verify a sub public key came from it's parent public key in a HD wallet without involving any private keys?

Yes, you can, assuming that the child key isn't hardened, and you know the chain code of the parent public key and the index of the child. (Also known as the extended public key.) Just compute CKDpub(...
user avatar
  • 28.6k
7 votes
Accepted

How can I watch all addresses under HD wallet?

Full disclosure: I'm BlockCypher's Developer Advocate. We have a series of HD Wallet Endpoints that we recently released that might suit your needs; you can read more about it here: http://dev....
user avatar
7 votes
Accepted

Can you detect that the addresses generated by an HD wallet came from a single wallet?

No. All addresses generated by HD derivation are indistinguishable to someone who does not know the parent's master key (the private one for hardened derivation, the public one for normal derivation)....
user avatar
7 votes

Where can I view my HD wallet seed in bitcoin core 13.2

To get the extended private masterkey itself (not a seed), you can use the dumpwallet command and provide it with a filename to dump your keys to. The extended master key will be at the top of the ...
user avatar
  • 11.3k
7 votes
Accepted

How does BIP 39 mnemonic work?

Mnemonics are the private key separated in 12 words which joined together in the very same order produces the private key That is incorrect. A mnemonic represents an entropy that is passed to a ...
user avatar
  • 6,898
7 votes
Accepted

How are Electrum addresses connected to my private key?

how did Electrum create a new address? Electrum, and most modern wallets are Hierarchical Deterministic (HD) Wallets. They derive a series of private-keys from the "master private-key". If ...
user avatar
6 votes
Accepted

Multi Sig Sub Keys

Yes, it's called HDM (Hierarchical-Deterministic-Multisig). There's no standard, per se, and the main proponent (to the best of my knowledge) is/has been Vitalik Buterin, of Ethereum/Bitcoin Magazine ...
user avatar
6 votes

Recovering a HD wallet from a partial seed phrase

(The language used in this post is Python) Breadwallet uses BIP39 to generate the 128-bit master seed from the 12-word mnemonic. The master seed is then used to generate a set of wallets/accounts ...
user avatar
6 votes

What BIP32 derivation path does Electrum use for Multisig?

Electrum uses BIP45. m / purpose' / cosigner_index / change / address_index Example for non-change of the first cosigner and first address: m / 45' / 0 / 0 / 0 See: https://bitcointalk.org/index....
user avatar
6 votes
Accepted

How to restore Bitcoin Core HD wallet private keys by master key?

Unfortunately, Bitcoin Core itself does not provide methods to generate private keys from master key. However, there are libraries that can produce correct keys from xprv string (chain m/iH/0/k with ...
user avatar
  • 151

Only top scored, non community-wiki answers of a minimum length are eligible