We are able to use xpub (prolonged public key) if we wish to generate a brand new public key (and additional the handle) on some insecure web site for every new order with out figuring out the non-public key. We’ll do that through the use of the dad or mum’s public key and the dad or mum’s chain code from the dad or mum’s prolonged public key, and incrementing the index for every new baby key. The issue is that by discovering the non-public key of 1 baby utilizing the system parentPrivateKey = childPrivateKey - L256bits % n, we will uncover the dad or mum’s non-public key, and thus the non-public keys for all youngsters in that department.
So with a non-hardened spinoff perform, we’ve:
- (a) the potential of deriving the general public keys of kids with out figuring out the non-public key of the dad or mum
- (a) threat of theft of all funds by figuring out the non-public key of 1 baby
Therefore the necessity for hardened derivation. It really works in such a approach that the kid keys are derived utilizing the non-public key as a substitute of the general public key. Thus, leaking the non-public key of 1 baby will make it unattainable to find the non-public key of the dad or mum and the non-public key of the opposite youngsters. But in addition, this kind of implementation makes it unattainable to acquire the youngsters’s public keys with out figuring out the dad or mum’s non-public key.
So with the hardened spinoff perform we’ve:
- (b) impossibility of deriving youngsters’s public keys with out the mother and father non-public key
- (b) there is no such thing as a threat of theft of all belongings by figuring out one kid’s non-public key
My query is why do we’ve a hardened derivation once we can obtain the identical impact (1 (b) and a couple of (b) above) utilizing an non-hardened derivation with a secret chain code. This may give us:
- impossibility of deriving youngsters’s public keys with out the dad or mum’s non-public key; for the reason that dad or mum’s chain code is required for that, and the chain code will probably be stored secret together with the dad or mum’s non-public key
- there is no such thing as a threat of theft of all funds figuring out the non-public key of 1 baby; for the reason that dad or mum’s chain code is secret, it is not going to be attainable to make L256 bits from the dad or mum’s public key + dad or mum’s chain code + index
What is the level of a hardened key derivation once we can obtain the identical results utilizing a non-hardened derivation whereas holding the dad or mum’s chain code secret?