Skip to main content
36 votes

Key derivation in HD wallets using the extended private key vs hardened derivation

There's a lot of confusion here, mostly bits and pieces of the whole scheme that is Hierarchical Deterministic derivation, and finally two questions that seem to indicate missing some point about it. ...
arubi's user avatar
  • 1,864
26 votes
Accepted

Derivation of parent private key from non-hardened child

First we must understand how BIP 32 derives non-hardened private and public keys. From BIP 32, deriving a child private key from an extended parent private key: let I = HMAC-SHA512(Key = cpar, Data = ...
Ava Chow's user avatar
  • 70.9k
21 votes
Accepted

How are different addresses generated from the same private key?

Private and public key correspond to a point on the secp256k1 curve. They have a one-to-one relationship. The address is derived from the public key by performing a ripemd160 hash after a sha256 hash ...
Murch's user avatar
  • 76k
19 votes
Accepted

What is the wallet "word seed" that is commonly used in popular wallets clients and what does it do?

With HD wallets, a single key can be used to generate an entire tree of key pairs. This single key serves as the "root" of the tree. The word seed is simply a more human-readable way of expressing ...
Jestin's user avatar
  • 8,812
13 votes
Accepted

XPRIV/XPUB type for P2TR

There is no ypub/zpub similar thing for Taproot. The recommendation is to use xpriv/xpub along with some extra information indicating that the script to create is Taproot, (e.g. with a tr() descriptor)...
Ava Chow's user avatar
  • 70.9k
12 votes

How to get xpub or mpk(bip32) for my bitcoin core wallet?

Bitcoin Core (since 0.13) uses HD after BIP32 with only hardened private key derivation. Exporting the xpub would be useless, because other apps could not derive public keys (hardened derivation ...
Jonas Schnelli's user avatar
11 votes
Accepted

difference between Master Public/private Key and Public/private Key?

With "Master public key" you probably refer to deterministic key derivation after bip32. The correct term is "Master extended private key" (acronym xpriv) and "Master extended public key" (acronym ...
Jonas Schnelli's user avatar
10 votes

How are different addresses generated from the same private key?

With Bitcoin, a single private key will have associated compressed and uncompressed private/public key pairs. Uncompressed public key addresses are larger in size than newer compressed public ...
skaht's user avatar
  • 3,077
10 votes
Accepted

Is the Electrum seed compatible with other wallets?

There are different "backup-standards". Some use BIP39 (mnemonic) which lacks a flexible wordlist and versioning. It's used by KeepKey, Ledger, Trezor, Bitpay/Copay, etc. Electrum uses a ...
Jonas Schnelli's user avatar
10 votes
Accepted

BIP32 recommends a 256 bit seed. Why do most Bitcoin wallets only use a 128 bit seed?

The reasons for the 3 numbers: Bitcoin uses 256-bit ECDSA signatures. These require in the order of 2128 steps to find a private key from the public key is known. This is Bitcoin's security level: we ...
Pieter Wuille's user avatar
9 votes

How are different addresses generated from the same private key?

Whenever you are attempting to explain Bitcoin to anyone, it makes a lot of sense to simply state that the derivation private key > public key > address is deterministic. However, if you are ...
Sven Williamson's user avatar
9 votes
Accepted

How Do HD Wallets Keep Track of all accounts?

In general, HD Wallets use the following logic for how many addresses to query, and when to stop: Start with account 0, generate gap limit number of addresses (usually 20) Check for any transactions ...
Raghav Sood's user avatar
  • 17.1k
8 votes
Accepted

How does the client know the number of keys and coins when recovering from a seed?

There is a so-called gap limit. In Electrum, it's 20 by default but can be changed. But if you changed it up, remember that! Preferably write it next to your wallet's seed. This means that the HD ...
UTF-8's user avatar
  • 3,224
8 votes
Accepted

How does BIP 39 mnemonic work?

Mnemonics are the private key separated in 12 words which joined together in the very same order produces the private key That is incorrect. A mnemonic represents an entropy that is passed to a ...
Ugam Kamat's user avatar
  • 7,417
8 votes

XPRIV/XPUB type for P2TR

The concept of an xpub originates from BIP32, where it denotes an extended public key, from which multiple child keys can be derived. At the time of BIP32, there was really only one address type ...
Pieter Wuille's user avatar
7 votes
Accepted

Can you detect that the addresses generated by an HD wallet came from a single wallet?

No. All addresses generated by HD derivation are indistinguishable to someone who does not know the parent's master key (the private one for hardened derivation, the public one for normal derivation)....
Pieter Wuille's user avatar
7 votes

Where can I view my HD wallet seed in bitcoin core 13.2

To get the extended private masterkey itself (not a seed), you can use the dumpwallet command and provide it with a filename to dump your keys to. The extended master key will be at the top of the ...
meshcollider's user avatar
  • 11.9k
7 votes

How many combinations are there from the BIP32 mnemonic list?

BIP 32 is not a mnemonic specification, so it has 0 possible combinations. I assume you are talking about BIP 39. In that case there are are 2048^12 combinations for 12 word mnemonics, 2048^18 for 18 ...
Ava Chow's user avatar
  • 70.9k
7 votes
Accepted

How are Electrum addresses connected to my private key?

how did Electrum create a new address? Electrum, and most modern wallets are Hierarchical Deterministic (HD) Wallets. They derive a series of private-keys from the "master private-key". If ...
RedGrittyBrick's user avatar
7 votes
Accepted

musig2 with BIP-32 style nonce chain

I wonder, could the public nonce list be generated from a chain code in the same manner that BIP-32 allows a list of public keys to be generated? Absolutely not. (private) nonces need to be entirely ...
Pieter Wuille's user avatar
7 votes
Accepted

Is it possible to identify UTXOs signed by HD wallets?

Almost every wallet today uses HD key derivation. You'd need to go back to software from 2016 or earlier to find any that don't. So I'd say your question is moot. That said, there certainly are ...
Pieter Wuille's user avatar
7 votes

How (un)safe is it to use non-random seed words?

There is a lot to unwrap here. I'll go over the points that need addressing, most important first: Don't try to invent your own cryptographic scheme If you read the manual to your wallet, it most ...
Vojtěch Strnad's user avatar
6 votes
Accepted

Does Bitcoin Core support HD wallet?

Update: As of bitcoin-core 13.0, core uses HD wallets by default.
gdoober's user avatar
  • 226
6 votes

What BIP32 derivation path does Electrum use for Multisig?

Electrum uses BIP45. m / purpose' / cosigner_index / change / address_index Example for non-change of the first cosigner and first address: m / 45' / 0 / 0 / 0 See: https://bitcointalk.org/index....
Jonas Schnelli's user avatar
6 votes
Accepted

How to restore Bitcoin Core HD wallet private keys by master key?

Unfortunately, Bitcoin Core itself does not provide methods to generate private keys from master key. However, there are libraries that can produce correct keys from xprv string (chain m/iH/0/k with ...
talalai88's user avatar
  • 151
6 votes

If a single private key of the HD bitcoin account is compromised, is the whole HD account compromised?

With just the private key, no. However, if the attacker knows both a child private key and the xpub of the chain it is derived from, yes. From BIP32: One weakness that may not be immediately ...
Pieter Wuille's user avatar
6 votes

Why are there multiple input addresses in one transaction and are they linkable to one single address?

The bunch of input addresses (usually) come from a single HD wallet. That's one possibility. It could also be that they come from a non-HD wallet, so that they correspond to a bunch of independently ...
Nate Eldredge's user avatar
6 votes
Accepted

a few questions about how HD wallet works

1) ...How's my total UTXO calculated?... Each node calculates it's own UTXO set, there is no single 'global UTOX set'. You may own some subset of the UTXOs, but there is no pooling. If you receive ...
chytrik's user avatar
  • 18.3k
6 votes

How to generate public and private key pairs from the 12 seed words in python

Please try the following demo, and the result is same with https://iancoleman.io/bip39/. $ python3.6 test.py {'addr': '1A9vZ4oPLb29szfRWVFe1VoEe7a2qEMjvJ', 'coin': 'BTC', 'mnemonic_words': 'aware ...
debug's user avatar
  • 161
6 votes
Accepted

What's the difference between xpub and bpub?

bpub appears to be the extended private key prefix for the Blockcypher testnet. Bitcoin addresses and private keys usually have a prefix to help differentiate the network/type of key. The original ...
Raghav Sood's user avatar
  • 17.1k

Only top scored, non community-wiki answers of a minimum length are eligible