<p>Yes, you can, assuming that the child key isn't hardened, and you know the chain code of the parent public key and the index of the child. (Also known as the extended public key.)</p>
<p>Just compute</p>
<blockquote>
<p>CKDpub((K<sub>par</sub>, c<sub>par</sub>), i) → (K<sub>i</sub>, c<sub>i</sub>)</p>
<p>K<sub>par</sub> is the parent public key, c<sub>par</sub> is the chain code, i is the index, and K<sub>i</sub> is the child public key</p>
</blockquote>
<p>as defined <a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#public-parent-key--public-child-key" rel="noreferrer">here</a> and compare it to the child key you were given.</p>

CC BY-SA 3.0
2015-04-28T01:39:57.683Z
Woohoo, thanks so much :) Needing to know the index is a bit of a bummer though because if I didn't know it then I would be forced to generate each child key from index 0 until I found the matching one, Am I correct in assuming this or could the index number be embedded in the key somehow?
derrend
CC BY-SA 3.0
2015-04-28T01:50:03.207Z
@derrend You're correct. You only need to try 2^31 keys at most, though, so it's not too bad.
Nick ODell
CC BY-SA 3.0
2015-04-28T04:35:29.803Z
reading again over the link you gave me earlier, is there a method of achievig this using 'gmaxwell's proposal' and would it be more efficient?
derrend
CC BY-SA 3.0
2015-04-28T04:38:25.900Z
@derrend 1) Yes 2) It's probably about the same in terms of speed and complexity.
Nick ODell
CC BY-SA 3.0
2015-04-28T04:40:03.233Z
Can you link me to some info if possible, I'd be interested see how it's done :)
derrend
CC BY-SA 3.0
2015-04-28T05:15:11.357Z
@derrend This is the best resource I know of: https://bitcointalk.org/index.php?topic=19137.0
Nick ODell
CC BY-SA 3.0
2015-04-28T01:26:29.407Z
2015-04-28T01:26:29.407Z
2020-06-16T11:10:03.350Z
Nick ODell
<p>I know I can sign a piece of text using a bitcoin private key to prove control over a public address but are there any operations I can perform to know if a public key submitted to me was derived from a parent public key if I do not have any private keys at my disposal?</p>

<p>I have looked at:
<a href="https://github.com/richardkiss/pycoin" rel="nofollow">https://github.com/richardkiss/pycoin</a> and 
<a href="https://github.com/jmcorgan/bip32utils" rel="nofollow">https://github.com/jmcorgan/bip32utils</a>
but have not yet found a way to do it.</p>

<p>Thank you for any input :)</p>

CC BY-SA 3.0
2015-04-28T01:06:16.077Z
Are you asking about BIP32 or deterministic type 2 wallets? See also: http://meta.bitcoin.stackexchange.com/questions/661/what-should-hd-wallet-mean
Nick ODell
CC BY-SA 3.0
2015-04-28T01:10:14.443Z
Yes I am but one specific use case in particular involving public key verification as described above, I'm hoping @Pieter Wuille (sipa) will see this question. Thank you for the link, I will check it out :)
derrend
CC BY-SA 3.0
2015-04-28T01:12:09.063Z
Right, but which one are you asking about?
Nick ODell
CC BY-SA 3.0
2015-04-28T01:19:02.363Z
I'm only asking if it is possible to know that a child private key came from it's parent in the absence of any secret keys and what the method would be to do it. If this is BIP32 deterministic wallet then yes I suppose this is what I am asking about :)
derrend
<wallet><private-key><public-key><bip32-hd-wallets>
Can I verify a sub public key came from it's parent public key in a HD wallet without involving any private keys?
derrend
# Can I verify a sub public key came from it's parent public key in a HD wallet without involving any private keys?

(Asked by: username_0 on 2015-04-28)

I know I can sign a piece of text using a bitcoin private key to prove control over a public address but are there any operations I can perform to know if a public key submitted to me was derived from a parent public key if I do not have any private keys at my disposal?

I have looked at:
<https://github.com/richardkiss/pycoin> and
<https://github.com/jmcorgan/bip32utils>
but have not yet found a way to do it.

Thank you for any input :)

**Tags:** wallet, private-key, public-key, bip32-hd-wallets

> **Comments:**
> **username_1**: Are you asking about BIP32 or deterministic type 2 wallets? See also: http://meta.bitcoin.stackexchange.com/questions/661/what-should-hd-wallet-mean  
> **username_0**: Yes I am but one specific use case in particular involving public key verification as described above, I'm hoping @Pieter Wuille (sipa) will see this question. Thank you for the link, I will check it out :)  
> **username_1**: Right, but which one are you asking about?  
> **username_0**: I'm only asking if it is possible to know that a child private key came from it's parent in the absence of any secret keys and what the method would be to do it. If this is BIP32 deterministic wallet then yes I suppose this is what I am asking about :)  

---

## 1 answers

### Answer by username_1 on 2015-04-28. Score: 8 | Accepted answer

Yes, you can, assuming that the child key isn't hardened, and you know the chain code of the parent public key and the index of the child. (Also known as the extended public key.)

Just compute

> CKDpub((Kpar, cpar), i) → (Ki, ci)
>
> Kpar is the parent public key, cpar is the chain code, i is the index, and Ki is the child public key

as defined [here](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#public-parent-key--public-child-key) and compare it to the child key you were given.

> **Comments:**
> **username_0**: Woohoo, thanks so much :) Needing to know the index is a bit of a bummer though because if I didn't know it then I would be forced to generate each child key from index 0 until I found the matching one, Am I correct in assuming this or could the index number be embedded in the key somehow?  
> **username_1**: @username_0 You're correct. You only need to try 2^31 keys at most, though, so it's not too bad.  
> **username_0**: reading again over the link you gave me earlier, is there a method of achievig this using 'gmaxwell's proposal' and would it be more efficient?  
> **username_1**: @username_0 1) Yes 2) It's probably about the same in terms of speed and complexity.  
> **username_0**: Can you link me to some info if possible, I'd be interested see how it's done :)  
> **username_1**: @username_0 This is the best resource I know of: https://bitcointalk.org/index.php?topic=19137.0  

---

