<p>I don't know where you found this formula, here is <a href="https://github.com/NicolasDorier/NBitcoin/blob/master/NBitcoin/Key.cs#L181" rel="nofollow">the code</a> to derivate a childkey, the BIP is <a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki" rel="nofollow">here</a>, it does not look like your formula, but I'll try to respond to some of your questions.</p>

<pre><code>I just got a little confused about this. Is s the mnemonic seed that user knows? which generates the private keys.
</code></pre>

<p>A mnemonic seed is just a sentence that permit you to get the master key with (optionally) a password. A master key is the real important piece of information, a mnemonic is only a way to generate one that can be write it down in words.</p>

<pre><code>Secondly a service provider only needs to know sG to calculate the user's next address. Am I right?
</code></pre>

<p>Your formula does not look like what is in the BIP, so I can't really comment on that.</p>

<pre><code>And lastly more importantly I am just wondering whether it is possible to calculate the master private key (seed) if an attacker or service provider gets one child's private key address?
</code></pre>

<p>Yes, if all the children in the path to the leaked private are non-hardened keys AND the root HD PubKey leaked. I explain that P 35 of <a href="https://aois.blob.core.windows.net/public/Blockchain%20Programming%20in%20CSharp.pdf" rel="nofollow">my book</a>.</p>

<pre><code>A non-hardened key can “climb” the hierarchy.
Non-hardened key should only be used for categorizing accounts that belongs to a single control. 
</code></pre>

CC BY-SA 3.0
2015-04-09T05:41:47.867Z
Thanks for your answer. I know what a mnemonic seed is. I'm not referring to the exact implementation of BIP32. Whats important for me here is that how we can generate the next public key without knowing the private key of the next public key. I am referring to this post"https://bitcointalk.org/index.php?topic=19137.msg239768#msg239768" by gmaxwell who proposed the idea of HD wallets. Thats what the formula says which I mentioned. Is that incorrect?
abeikverdi
CC BY-SA 3.0
2015-04-09T05:45:48.227Z
I've never heard about hardened keys. How can you harden it to stop people from climbing back to the root? I definitely love to read your book, but can you explain that to me in summary?
abeikverdi
CC BY-SA 3.0
2015-04-09T14:42:23.477Z
You can take a look at [the implementation](https://github.com/NicolasDorier/NBitcoin/blob/master/NBitcoin/Key.cs#L181). The condition "(nChild >> 31) == 0" means "is non hardened".

You can see that when it is non hardened, the child key is derived from the public key, while if it hardened, it is derived from private key. This means that if it is not hardened, you can go back in the hierarchy if you know the parent public key. As I am doing [here](https://github.com/NicolasDorier/NBitcoin/blob/master/NBitcoin/BIP32/ExtKey.cs#L201)

The post on bitcointalk is outdated compared to the bip.
Nicolas Dorier
CC BY-SA 3.0
2017-04-20T12:42:46.337Z
@NicolasDorier Actually, you didn't explain it in the book. You just stated the fact without any explanation. :-)
woky
CC BY-SA 3.0
2015-04-06T13:15:01.047Z
2015-04-06T13:15:01.047Z
Nicolas Dorier
<p>HD wallets as described <a href="https://en.bitcoin.it/wiki/Deterministic_wallet" rel="nofollow">here</a> are built based on a master seed and a master public key as follows:</p>

<pre><code>PK.b = PK.a + sG
SK.b = SK.a + s
</code></pre>

<ol>
<li>I just got a little confused about this. Is <code>s</code> the mnemonic seed that
user knows? which generates the private keys. </li>
<li>Secondly a service
provider only needs to know <code>sG</code> to calculate the user's next address.
Am I right? </li>
<li>And lastly more importantly I am just wondering whether it is possible to
calculate the master private key (seed) if an attacker or service provider gets one child's private key address?</li>
</ol>

CC BY-SA 3.0
2015-03-09T15:14:38.037Z
The link you give doesn't define the notation PK.a and so on.
Nate Eldredge
CC BY-SA 3.0
2015-03-11T03:57:59.353Z
@NateEldredge precisely you can look at this [link](https://bitcointalk.org/index.php?topic=19137.msg239768#msg239768)
abeikverdi
CC BY-SA 3.0
2015-03-14T04:15:30.723Z
@abeikverdi I don't see that notation on the first page of the thread you link, and I don't see it in a search of the forums.
Nick ODell
CC BY-SA 3.0
2015-03-24T08:34:29.587Z
@NickODell PK.a refers to the public key of a and SK.a refers to the private key of a. G is the generator point and s I suppose is the secret that is used to generate next keys. In HD wallets as you know we can generate new key pairs by adding the private key with a secret s. Anyone without knowing your private key by knowing a "master public key" can generate your next public key. Does this "master public key" refer to sG here?
abeikverdi
CC BY-SA 3.0
2015-03-24T09:15:49.600Z
@abeikverdi What you're saying doesn't describe BIP32. Are you asking about BIP32, or some other HD wallet system?
Nick ODell
CC BY-SA 3.0
2015-03-25T07:49:47.863Z
I was assuming that this is the description of BIP32 for HD wallets. Can you tell me at which part I'm wrong?
abeikverdi
CC BY-SA 3.0
2015-04-09T07:13:06.447Z
@NickODell Alright I found the reason for this confusion. The thing that I am referring to is currently called deterministic wallet type 2 which was proposed by Maxwell which eventually was used as the initial idea of BIP32 proposed by Pieter Wuille. It kinda makes more sense now to me.
abeikverdi
<private-key><bip32-hd-wallets>
HD wallets with an exposed child private key
abeikverdi
# HD wallets with an exposed child private key

(Asked by: username_0 on 2015-03-09)

HD wallets as described [here](https://en.bitcoin.it/wiki/Deterministic_wallet) are built based on a master seed and a master public key as follows:

```
PK.b = PK.a + sG
SK.b = SK.a + s

```

1. I just got a little confused about this. Is `s` the mnemonic seed that
   user knows? which generates the private keys.
2. Secondly a service
   provider only needs to know `sG` to calculate the user's next address.
   Am I right?
3. And lastly more importantly I am just wondering whether it is possible to
   calculate the master private key (seed) if an attacker or service provider gets one child's private key address?

**Tags:** private-key, bip32-hd-wallets

> **Comments:**
> **username_1**: The link you give doesn't define the notation PK.a and so on.  
> **username_0**: @username_1 precisely you can look at this [link](https://bitcointalk.org/index.php?topic=19137.msg239768#msg239768)  
> **username_2**: @username_0 I don't see that notation on the first page of the thread you link, and I don't see it in a search of the forums.  
> **username_0**: @username_2 PK.a refers to the public key of a and SK.a refers to the private key of a. G is the generator point and s I suppose is the secret that is used to generate next keys. In HD wallets as you know we can generate new key pairs by adding the private key with a secret s. Anyone without knowing your private key by knowing a "master public key" can generate your next public key. Does this "master public key" refer to sG here?  
> **username_2**: @username_0 What you're saying doesn't describe BIP32. Are you asking about BIP32, or some other HD wallet system?  
> **username_0**: I was assuming that this is the description of BIP32 for HD wallets. Can you tell me at which part I'm wrong?  
> **username_0**: @username_2 Alright I found the reason for this confusion. The thing that I am referring to is currently called deterministic wallet type 2 which was proposed by Maxwell which eventually was used as the initial idea of BIP32 proposed by Pieter Wuille. It kinda makes more sense now to me.  

---

## 1 answers

### Answer by username_3 on 2015-04-06. Score: 3

I don't know where you found this formula, here is [the code](https://github.com/username_3/NBitcoin/blob/master/NBitcoin/Key.cs#L181) to derivate a childkey, the BIP is [here](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki), it does not look like your formula, but I'll try to respond to some of your questions.

```
I just got a little confused about this. Is s the mnemonic seed that user knows? which generates the private keys.

```

A mnemonic seed is just a sentence that permit you to get the master key with (optionally) a password. A master key is the real important piece of information, a mnemonic is only a way to generate one that can be write it down in words.

```
Secondly a service provider only needs to know sG to calculate the user's next address. Am I right?

```

Your formula does not look like what is in the BIP, so I can't really comment on that.

```
And lastly more importantly I am just wondering whether it is possible to calculate the master private key (seed) if an attacker or service provider gets one child's private key address?

```

Yes, if all the children in the path to the leaked private are non-hardened keys AND the root HD PubKey leaked. I explain that P 35 of [my book](https://aois.blob.core.windows.net/public/Blockchain%20Programming%20in%20CSharp.pdf).

```
A non-hardened key can “climb” the hierarchy.
Non-hardened key should only be used for categorizing accounts that belongs to a single control. 

```

> **Comments:**
> **username_0**: Thanks for your answer. I know what a mnemonic seed is. I'm not referring to the exact implementation of BIP32. Whats important for me here is that how we can generate the next public key without knowing the private key of the next public key. I am referring to this post"https://bitcointalk.org/index.php?topic=19137.msg239768#msg239768" by gmaxwell who proposed the idea of HD wallets. Thats what the formula says which I mentioned. Is that incorrect?  
> **username_0**: I've never heard about hardened keys. How can you harden it to stop people from climbing back to the root? I definitely love to read your book, but can you explain that to me in summary?  
> **username_3**: You can take a look at [the implementation](https://github.com/username_3/NBitcoin/blob/master/NBitcoin/Key.cs#L181). The condition "(nChild >> 31) == 0" means "is non hardened".  You can see that when it is non hardened, the child key is derived from the public key, while if it hardened, it is derived from private key. This means that if it is not hardened, you can go back in the hierarchy if you know the parent public key. As I am doing [here](https://github.com/username_3/NBitcoin/blob/master/NBitcoin/BIP32/ExtKey.cs#L201)  The post on bitcointalk is outdated compared to the bip.  
> **username_4**: @username_3 Actually, you didn't explain it in the book. You just stated the fact without any explanation. :-)  

---

