Crypto Pills #10: BIP32 Derivations In Depth
In modern cryptographic wallets, hierarchical deterministic (HD) wallets allow users to manage multiple addresses using a single seed phrase. Bitcoin Improvement Proposal 32 (BIP32) formalizes HD wallet key generation, introducing a system for generating multiple keys and addresses from a single root seed.
This article focuses on the mathematics underneath BIP32, particularly the key derivation formulas for both non-hardened and hardened derivations, shedding light on the cryptographic processes that make HD wallets both powerful and secure.
Details such as serialization formats, conventions, use cases and test vectors, check BIP 0032.
Quick Recap: Elliptic Curve Cryptography (ECC)
BIP32 key derivations are based on elliptic curve cryptography, specifically the secp256k1 curve, which Bitcoin uses. Check Crypto Pills #3 for more details.
This curve is defined by the equation y² = x³ + 7 (mod p) where p is a large prime number p = 2²⁵⁶ − 2³² − 977.
Points on this curve, denoted as P, represent public keys, while private keys are simply scalar values k in the range [1,n−1], where n is the order of the curve.
The points on an elliptic curve form a mathematical group. This means that there is a defined operation, point addition, denoted by ‘+’, that combines two points on the curve to produce another point on the curve. Point addition is associative, has an identity element (the “point at infinity”), and every point has an inverse. Point addition and point doubling (P₁ + P₁) are used to repeatedly add points to create scalar multiples of points, a process crucial for generating public keys from private keys.
Scalar multiplication is the operation of adding a point to itself multiple times.
Given a private key k, the public key K is computed by performing scalar multiplication on the curve K = k ⋅ G, where G is a generator point on secp256k1. This scalar multiplication forms the basis of public-private key relationships, as it is computationally efficient in one direction but difficult to reverse (the Discrete Log Problem).
Core Concepts of BIP32
BIP32 introduces the concept of extended keys and chain codes, which are essential for building hierarchical wallet structures.
Extended Keys
An extended key in BIP32 contains both a key (either private or public) and a chain code, which serves as additional entropy for key derivation. An extended private key can derive both extended private and public keys, whereas an extended public key can only derive (non-hardened) extended public keys.
Chain Code
The chain code is a 256-bit number derived from the seed along with the master key and helps in generating child keys. The chain code ensures that each key derivation is unique, even for identical parent keys.
In order to understand why, notice how the HMAC-SHA512 hash is used in BIP 0032: in all cases, the chain code is passed as the HMAC-SHA512 Key.
xpub and xpriv
The terms ‘xpub’ and ‘xpriv’ are common words used when referring to a extended public key and extended private key, respectively.
For details of the serialization format, check BIP 0032.
Child Key Derivations: Non-Hardened vs. Hardened
BIP32 defines two types of key derivations: non-hardened and hardened. Each type serves a distinct purpose and offers different security characteristics.
Non-hardened derivation allows for a flexible generation of public keys, which can be used to extend wallets without compromising the parent private key.
Get Guilherme Balena Versiani’s stories in your inbox
Join Medium for free to get updates from this writer.
Hardened derivation, on the other hand, adds an extra layer of security by ensuring that only the parent private key can produce child keys.
Non-Hardened Derivation
In non-hardened derivation, a child public key can be independently derived from its parent public key. This allows a third party with access to your xpub to generate as many receiving addresses as needed, while preserving privacy by not reusing addresses.
This method is typically used for deposits, as long as the derivation path is securely recorded so that the wallet owner, holding the corresponding xpriv, can later access and move the funds.
So for a given parent key Kₚₐᵣₑₙₜ (public) and kₚₐᵣₑₙₜ (private) we have:
- Public Child Key Calculation. For a child index i, the public child key Kᵢ is computed as Kᵢ = Kₚₐᵣₑₙₜ + Hash(Kₚₐᵣₑₙₜ ∥ i) ⋅ G where Hash(Kₚₐᵣₑₙₜ ∥ i) is derived using HMAC-SHA512 with the chain code as the key, ensuring that each index generates a unique offset for each child key.
- Private Child Key Calculation. Using the parent private key kₚₐᵣₑₙₜ, the private child key kᵢ is kᵢ = kₚₐᵣₑₙₜ + Hash(Kₚₐᵣₑₙₜ ∥ i) (mod n).
Why does it work?
- For simplicity, let's make bᵢ = Hash(Kₚₐᵣₑₙₜ ∥ i) obtaining that kᵢ = kₚₐᵣₑₙₜ + b (mod n) and Kᵢ = Kₚₐᵣₑₙₜ + bᵢ ⋅ G. So the child private key is just a second scalar in the same finite field.
- We know from the definitions that a public key is obtained by scalar multiplication of the secret k and the point generator G of the elliptic curve, or Kᵢ = kᵢ ⋅ G.
- Substituting, we have that Kᵢ = (kₚₐᵣₑₙₜ + b) ⋅ G.
- Which is the same as Kᵢ = (kₚₐᵣₑₙₜ ⋅ G) + (b ⋅ G).
- We know Kₚₐᵣₑₙₜ = kₚₐᵣₑₙₜ ⋅ G.
- So Kᵢ = Kₚₐᵣₑₙₜ + (b ⋅ G).
Hardened Derivation
Hardened derivation is used when additional security is needed, as it prevents deriving a private child key from a public extended key. This is essential for maintaining security when exposing public keys, as it stops any derivation of child private keys from an exposed public extended key.
For hardened derivation, the parent private key kₚₐᵣₑₙₜ is required:
- Private Child Key Calculation. For a child index i, the private child key kᵢ is computed as kᵢ = kₚₐᵣₑₙₜ + Hash(0x00 ∥ kₚₐᵣₑₙₜ ∥ i) (mod n) where 0x00 is a single byte to indicate the hardened derivation mode. Note it is the private key that is hashed: this formulation ensures that without knowing the parent private key, the child private key cannot be computed.
- Public Child Key Calculation. The hardened public child key Kᵢ can be computed only once the private child key kᵢ is obtained Kᵢ = kᵢ ⋅ G.
Security Implications of Hardened vs. Non-Hardened Derivations
The distinction between non-hardened and hardened derivations has practical security consequences:
Non-Hardened Derivations. Public extended keys can derive further public keys but cannot be used to derive private keys. This allows for “watch-only” wallets where public keys can be derived on a separate device, safeguarding private keys.
Hardened Derivations. Hardened derivations prevent deriving child private keys from public keys, creating an additional security layer. However, they necessitate knowledge of the private key for each derivation step, meaning a hardened-only path cannot support a public-only wallet view.
Conclusion
BIP32 key derivations enable flexible, secure wallet structures. The mathematical constructs of non-hardened and hardened paths provide users with choices on security and functionality.
Non-hardened derivations allow seamless address generation, ideal for watch-only wallets, while hardened derivations provide greater security in contexts where any public key exposure is a risk.
Understanding these mathematical foundations enriches the practical benefits of HD wallets, ensuring cryptographic resilience and operational flexibility.
