24 votes
Accepted

Derivation of parent private key from non-hardened child

First we must understand how BIP 32 derives non-hardened private and public keys. From BIP 32, deriving a child private key from an extended parent private key: let I = HMAC-SHA512(Key = cpar, Data = ...
Andrew Chow's user avatar
  • 68.6k
10 votes
Accepted

BIP32 recommends a 256 bit seed. Why do most Bitcoin wallets only use a 128 bit seed?

The reasons for the 3 numbers: Bitcoin uses 256-bit ECDSA signatures. These require in the order of 2128 steps to find a private key from the public key is known. This is Bitcoin's security level: we ...
Pieter Wuille's user avatar
10 votes
Accepted

Is the Electrum seed compatible with other wallets?

There are different "backup-standards". Some use BIP39 (mnemonic) which lacks a flexible wordlist and versioning. It's used by KeepKey, Ledger, Trezor, Bitpay/Copay, etc. Electrum uses a ...
Jonas Schnelli's user avatar
8 votes
Accepted

How does the client know the number of keys and coins when recovering from a seed?

There is a so-called gap limit. In Electrum, it's 20 by default but can be changed. But if you changed it up, remember that! Preferably write it next to your wallet's seed. This means that the HD ...
UTF-8's user avatar
  • 3,224
5 votes

Derive new public keys from a public key?

Is there a kind of homomorphism between the set of private keys and public keys? Yes. You can think of f: G -> H being the function that derives a public key (i.e. something from the set of H) ...
Nick ODell's user avatar
  • 29.3k
4 votes
Accepted

Determining xprv from xpub and child private key

This recommendation comes directly from one of security considerations from the same document: Note however that the following properties does not exist: (...) Given a parent extended public key (...
Michał Zabielski's user avatar
4 votes
Accepted

How do HD wallets use mnemonic to recover all private keys?

mnemonics are the seed. you use that to get your private key. the rest of the story as you have pointed out, is about deriving child key pairs. The process is deterministic (as the letter D in HD), ...
Will Gu's user avatar
  • 368
4 votes
Accepted

Is there an easy way to tell if a public address was derived from an hd key?

Other than just deriving a ton of potential keys and checking whether they correspond to the address, no. There is no mathematical relation between keys in a HD keychain that allows you to determine ...
Andrew Chow's user avatar
  • 68.6k
3 votes

What is the meaning and application of the apostrophes in derivation paths of BIP32 / BIP44?

The apostrophes show whether or not that particular derivation is hardened. The difference been hardened and non-hardened keys is described in BIP32. See the wiki for some further detail. https://...
 mynt's user avatar
  • 106
3 votes

How do hierarchical deterministic wallets work transaction-wise?

how does the system associate the balance from several transactions (allocated to different derived public keys) to the same bitcoin "account" or master public key? The system must known ...
Penquin's user avatar
  • 671
3 votes

Deterministic wallet and address generation

Well, it's a deterministic wallet. There is a function f which for every n∈ℕ returns the nth address that will be produced. An address is basically a hash of a public key (we can neglect the rest it'...
UTF-8's user avatar
  • 3,224
3 votes
Accepted

What is the "hierarchical" about in Hierarchical Deterministic Wallets?

Hierarchy allows interesting use-cases. You could have a master company key m/0' and give out m/0'/0/0 to company-branch A and m/0'/0/1 to company branch B, etc. You could then allow audits by ...
Jonas Schnelli's user avatar
3 votes
Accepted

What are the best practices for managing empty, unwanted wallets?

First off, you should consider if you actually need to abandon your current seed phrase. Reasons for that include: Your seed phrase has been compromised. In this case you need to move your funds to a ...
Vojtěch Strnad's user avatar
2 votes
Accepted

Deterministic wallet and address generation

Here is a KISS answer. The Ledger uses BIP 32, 39, 44 technology as do many other similar harware wallet devices, e.g. Trezor, Keepkey. You should be free to use your hardware wallet across multiple ...
skaht's user avatar
  • 3,047
2 votes

For deterministic wallets, which key is better to give out?

You give out a single address, as with a normal wallet. The master private key and master public key are both for use locally and should never be shared with any party, especially not the former.
Claris's user avatar
  • 15.4k
2 votes

Do I need to secure my Master Public Key generated from an Electrum wallet?

The xpubkey (your master public key) is not something you need to export. What you need to store is your seed value for the Electrum wallet. With this it can regenerate you the xpubkey. The xpubkey ...
MaxSan's user avatar
  • 3,855
2 votes

How to list all addresses in a deterministic wallet?

How many keys can be generated by a deterministic wallet? Effectively infinitely many. The same as a non-deterministic wallet which just keeps generating random private keys. There is a limit, 2^256, ...
Andrew Chow's user avatar
  • 68.6k
2 votes
Accepted

Bitcoin Address Workflow on Spend Leftovers

It appears that the wallet moved my funds to a new address in my wallet. That is normal and desirable behavior. See How does change work in a bitcoin transaction? Should a wallet always move the ...
Nate Eldredge's user avatar
2 votes

How do non-deterministic wallets violate the principle of address reuse?

The text indeed doesn't make it's case clear, but the idea is that random key generation makes for inconvenient backups. The more keys you generate, the more frequently you will have to back up the ...
arubi's user avatar
  • 1,854
2 votes

Is auditing a BIP32 tree only possible if it is non-hardened?

That is correct, you can only do this with non-hardened derivation. Only non-hardened derivation can use the master public key to derive all of the public keys. With hardened derivation, you must have ...
Andrew Chow's user avatar
  • 68.6k
2 votes
Accepted

What does "deal with collisions" mean in the context of BIP32 fingerprints?

The fingerprint could be used as a unique identifier for a key (it is based on the longer hash160 of the key which is frequently used as a unique identifier). However because it is only 4 bytes long, ...
Andrew Chow's user avatar
  • 68.6k
2 votes
Accepted

Correct Approach for Payments on Multiple Addresses

Short answer: check out BTCPay, it does what you ask. You don't have to create your own server to use it, you can just create an account on an existing instance, for example this one should be fine to ...
Sosthène's user avatar
  • 623
2 votes
Accepted

Recovering an Hierarchical Deterministic wallet

You need to ensure they use the same derivation path. If there are a lot of unused addresses generated you may need to increase the gap limit.
RedGrittyBrick's user avatar
2 votes
Accepted

Are hierarchical deterministic Keys secure even against their children?

No. The computation from children from a parent is like a hash (and involves hashes). It doesn't matter how many children someone sees, they cannot compute the parent key. They cannot even tell which ...
Pieter Wuille's user avatar
2 votes

What are the best practices for managing empty, unwanted wallets?

You bring up issues I had not considered. Which lead me to conclude the Seed Recovery phrase (mnemonic + passphrase if used) should be retained. If non-standard derivation paths, big address gaps etc ...
HansBKK's user avatar
  • 415
1 vote
Accepted

What are the consequences from the leak of xpub and child private key?

If the above two keys are leaked, then your master private key at the account level (m/44'/60'/4') can be back-calculated. That means, any private key (both receiving and change) that you derive from ...
Ugam Kamat's user avatar
  • 7,348
1 vote
Accepted

Deterministic - BIP32 Derivation Gap Limit

The BIP44 gap limit approach is a weak or even broken concept for recovering BIP32 based wallets. It makes an assumption about the use case of a BIP44/BIP32 based wallet. The default limit of 20 (some ...
Jonas Schnelli's user avatar
1 vote

Hierarchical Deterministic (HD) Importing Funds

Is there a neat way to pull in all funds that derive from a "master key". Or, have I misunderstood deterministic benefits - am I trying achieve a non existent feature? If you import your master key (...
Raghav Sood's user avatar
1 vote

funds in hd wallet

How to check the balance of each address or how we can look for balance? You will have to scan the blockchain and find the UTXOs that are locked with your addresses in the locking script. You can ...
Ugam Kamat's user avatar
  • 7,348
1 vote

Trying to understand parent fingerprint in HD wallets

Can't use comments because of reputation, but both the question and the answer is saying that the fingerprint is based on private key. It should be the hash160 of the PUBLIC key. for even if you are ...
Jim Hansson's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible