21
votes
Accepted
Derivation of parent private key from non-hardened child
First we must understand how BIP 32 derives non-hardened private and public keys.
From BIP 32, deriving a child private key from an extended parent private key:
let I = HMAC-SHA512(Key = cpar, Data = ...
- 66.4k
10
votes
Accepted
Is the Electrum seed compatible with other wallets?
There are different "backup-standards".
Some use BIP39 (mnemonic) which lacks a flexible wordlist and versioning. It's used by KeepKey, Ledger, Trezor, Bitpay/Copay, etc.
Electrum uses a ...
- 5,982
9
votes
Accepted
BIP32 recommends a 256 bit seed. Why do most Bitcoin wallets only use a 128 bit seed?
The reasons for the 3 numbers:
Bitcoin uses 256-bit ECDSA signatures. These require in the order of 2128 steps to find a private key from the public key is known. This is Bitcoin's security level: we ...
- 95.9k
8
votes
Accepted
How does the client know the number of keys and coins when recovering from a seed?
There is a so-called gap limit. In Electrum, it's 20 by default but can be changed. But if you changed it up, remember that! Preferably write it next to your wallet's seed.
This means that the HD ...
- 3,204
5
votes
Derive new public keys from a public key?
Is there a kind of homomorphism between the set of private keys and public keys?
Yes. You can think of f: G -> H being the function that derives a public key (i.e. something from the set of H) ...
- 29.1k
4
votes
Accepted
Determining xprv from xpub and child private key
This recommendation comes directly from one of security considerations from the same document:
Note however that the following properties does not exist:
(...) Given a parent extended public key (...
- 356
4
votes
Accepted
How do HD wallets use mnemonic to recover all private keys?
mnemonics are the seed. you use that to get your private key.
the rest of the story as you have pointed out, is about deriving child key pairs. The process is deterministic (as the letter D in HD), ...
- 368
4
votes
Accepted
Is there an easy way to tell if a public address was derived from an hd key?
Other than just deriving a ton of potential keys and checking whether they correspond to the address, no. There is no mathematical relation between keys in a HD keychain that allows you to determine ...
- 66.4k
3
votes
Deterministic wallet and address generation
Well, it's a deterministic wallet. There is a function f which for every n∈ℕ returns the nth address that will be produced.
An address is basically a hash of a public key (we can neglect the rest it'...
- 3,204
3
votes
What is the meaning and application of the apostrophes in derivation paths of BIP32 / BIP44?
The apostrophes show whether or not that particular derivation is hardened.
The difference been hardened and non-hardened keys is described in BIP32.
See the wiki for some further detail. https://...
- 106
3
votes
How do hierarchical deterministic wallets work transaction-wise?
how does the system associate the balance from several transactions (allocated to different derived public keys) to the same bitcoin "account" or master public key?
The system must known ...
- 671
3
votes
Accepted
Problems generating addresses using bip32
addrgen author here!
Addrgen was created before Electrum was BIP-0032 compatible and thus it used different master public keys and derivation method.
Please check the following PHP implementation ...
- 121
3
votes
Accepted
What is the "hierarchical" about in Hierarchical Deterministic Wallets?
Hierarchy allows interesting use-cases.
You could have a master company key m/0' and give out m/0'/0/0 to company-branch A and m/0'/0/1 to company branch B, etc.
You could then allow audits by ...
- 5,982
3
votes
Accepted
What are the best practices for managing empty, unwanted wallets?
First off, you should consider if you actually need to abandon your current seed phrase. Reasons for that include:
Your seed phrase has been compromised. In this case you need to move your funds to a ...
- 4,854
2
votes
Accepted
Deterministic wallet and address generation
Here is a KISS answer.
The Ledger uses BIP 32, 39, 44 technology as do many other similar harware wallet devices, e.g. Trezor, Keepkey. You should be free to use your hardware wallet across multiple ...
- 3,007
2
votes
For deterministic wallets, which key is better to give out?
You give out a single address, as with a normal wallet. The master private key and master public key are both for use locally and should never be shared with any party, especially not the former.
- 15.3k
2
votes
Do I need to secure my Master Public Key generated from an Electrum wallet?
The xpubkey (your master public key) is not something you need to export.
What you need to store is your seed value for the Electrum wallet. With this it can regenerate you the xpubkey.
The xpubkey ...
- 3,855
2
votes
Accepted
Bitcoin Address Workflow on Spend Leftovers
It appears that the wallet moved my funds to a new address in my wallet.
That is normal and desirable behavior. See How does change work in a bitcoin transaction?
Should a wallet always move the ...
- 23k
2
votes
How do non-deterministic wallets violate the principle of address reuse?
The text indeed doesn't make it's case clear, but the idea is that random key generation makes for inconvenient backups. The more keys you generate, the more frequently you will have to back up the ...
- 1,824
2
votes
Is auditing a BIP32 tree only possible if it is non-hardened?
That is correct, you can only do this with non-hardened derivation. Only non-hardened derivation can use the master public key to derive all of the public keys. With hardened derivation, you must have ...
- 66.4k
2
votes
How to list all addresses in a deterministic wallet?
How many keys can be generated by a deterministic wallet?
Effectively infinitely many. The same as a non-deterministic wallet which just keeps generating random private keys. There is a limit, 2^256, ...
- 66.4k
2
votes
Accepted
What does "deal with collisions" mean in the context of BIP32 fingerprints?
The fingerprint could be used as a unique identifier for a key (it is based on the longer hash160 of the key which is frequently used as a unique identifier). However because it is only 4 bytes long, ...
- 66.4k
2
votes
Accepted
Correct Approach for Payments on Multiple Addresses
Short answer: check out BTCPay, it does what you ask. You don't have to create your own server to use it, you can just create an account on an existing instance, for example this one should be fine to ...
- 593
2
votes
Accepted
Recovering an Hierarchical Deterministic wallet
You need to ensure they use the same derivation path. If there are a lot of unused addresses generated you may need to increase the gap limit.
- 23k
2
votes
Accepted
Are hierarchical deterministic Keys secure even against their children?
No. The computation from children from a parent is like a hash (and involves hashes). It doesn't matter how many children someone sees, they cannot compute the parent key. They cannot even tell which ...
- 95.9k
2
votes
What are the best practices for managing empty, unwanted wallets?
You bring up issues I had not considered.
Which lead me to conclude the Seed Recovery phrase (mnemonic + passphrase if used) should be retained.
If non-standard derivation paths, big address gaps etc ...
- 405
1
vote
funds in hd wallet
How to check the balance of each address or how we can look for balance?
You will have to scan the blockchain and find the UTXOs that are locked with your addresses in the locking script. You can ...
- 7,213
1
vote
Trying to understand parent fingerprint in HD wallets
Can't use comments because of reputation, but both the question and the answer is saying that the fingerprint is based on private key. It should be the hash160 of the PUBLIC key. for even if you are ...
- 11
1
vote
Accepted
Trying to understand parent fingerprint in HD wallets
It's ripemd160(sha256(parentpriv)) also known as hash160(parentpriv) source. There is also a python implementation here
- 3,469
1
vote
Understanding a Wallet Restore
The various private and public keys are all derived from that master seed.
- 51.3k
Only top scored, non community-wiki answers of a minimum length are eligible