<p>Recommend reading <a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#serialization-format" rel="nofollow noreferrer">BIP-0032</a>, and specifically serialization format.</p>
<p>The private key is a scalar value of 32 bytes (256 bits).</p>
<p>The public key is a point on the elliptic curve, a point is an XY value. This is called an uncompressed public key. It is prefixed with <code>0x04</code>. An uncompressed public key is 65 bytes.</p>
<p>For efficiency we simply represent the public key as an X value since the Y value can be derived easily. This is called a compressed public key. However for any X value there could be two Y values, as such we need to store a value to represent the sign of Y (or evenness). For even Y value we prefix <code>0x02</code>, for odd Y value we prefix <code>0x03</code>. A compressed public key is 33 bytes (see <a href="https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch04.asciidoc#compressed-public-keys" rel="nofollow noreferrer">Chapter 4 in Mastering Bitcoin</a>).</p>
<p>For HD, we have a private HD key and a public HD key. The serialization format from BIP-32 is as follows.</p>
<ul>
<li>4 byte: version bytes (mainnet: 0x0488B21E public, 0x0488ADE4 private; testnet: 0x043587CF public, 0x04358394 private)</li>
<li>1 byte: depth: 0x00 for master nodes, 0x01 for level-1 derived keys, ....</li>
<li>4 bytes: the fingerprint of the parent's key (0x00000000 if master key)</li>
<li>4 bytes: child number. This is ser32(i) for i in xi = xpar/i, with xi the key being serialized. (0x00000000 if master key)</li>
<li>32 bytes: the chain code</li>
<li>33 bytes: the public key or private key data (serP(K) for public keys, 0x00 || ser256(k) for private keys)</li>
</ul>
<p>Typically the important part (for recovery purposes and generating other keys) is the chain code (32 bytes = 256 bits) and the public / private key (33 bytes).</p>
<p>The book says 512 or 513 bits because the extended private key is <code>256 chain code bits || 256 private key bits</code> (512), and the extended public key is <code>256 chain code bits || 1 evenness bit || 256 public key bits</code> (513).</p>
<p>Since computers storage works in bytes, the 1 bit for evenness is represented as a whole byte.</p>

CC BY-SA 4.0
2022-07-09T14:32:59.507Z
But the wallet uses compressed public key which is 264bits?
Athul A
CC BY-SA 4.0
2022-07-09T21:17:43.123Z
@athul 8 bits for evenness + 256 Y coordinate bits = 264 compressed public key bits.
miketery
CC BY-SA 4.0
2022-07-03T17:11:39.437Z
2022-07-03T17:18:37.740Z
2022-07-03T17:18:37.740Z
miketery
<p>For extended private key it is 512 bits but for extended public key how it is 512? It will be 264+256 right? And why in the book mastering bitcoin they said extended key is either 512 bits or 513 bits</p>

CC BY-SA 4.0
2022-07-02T14:44:38.673Z
Why do you think the extended pubkey is 512 bits?
Ava Chow
CC BY-SA 4.0
2022-07-02T14:49:44.267Z
it's mentioned in the book mastering bitcoin
Athul A
<wallet><private-key><public-key>
How the extended key in wallet is 512 bits?
Athul A
# How the extended key in wallet is 512 bits?

(Asked by: username_0 on 2022-07-02)

For extended private key it is 512 bits but for extended public key how it is 512? It will be 264+256 right? And why in the book mastering bitcoin they said extended key is either 512 bits or 513 bits

**Tags:** wallet, private-key, public-key

> **Comments:**
> **username_1**: Why do you think the extended pubkey is 512 bits?  
> **username_0**: it's mentioned in the book mastering bitcoin  

---

## 1 answers

### Answer by username_2 on 2022-07-03. Score: 2

Recommend reading [BIP-0032](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#serialization-format), and specifically serialization format.

The private key is a scalar value of 32 bytes (256 bits).

The public key is a point on the elliptic curve, a point is an XY value. This is called an uncompressed public key. It is prefixed with `0x04`. An uncompressed public key is 65 bytes.

For efficiency we simply represent the public key as an X value since the Y value can be derived easily. This is called a compressed public key. However for any X value there could be two Y values, as such we need to store a value to represent the sign of Y (or evenness). For even Y value we prefix `0x02`, for odd Y value we prefix `0x03`. A compressed public key is 33 bytes (see [Chapter 4 in Mastering Bitcoin](https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch04.asciidoc#compressed-public-keys)).

For HD, we have a private HD key and a public HD key. The serialization format from BIP-32 is as follows.

* 4 byte: version bytes (mainnet: 0x0488B21E public, 0x0488ADE4 private; testnet: 0x043587CF public, 0x04358394 private)
* 1 byte: depth: 0x00 for master nodes, 0x01 for level-1 derived keys, ....
* 4 bytes: the fingerprint of the parent's key (0x00000000 if master key)
* 4 bytes: child number. This is ser32(i) for i in xi = xpar/i, with xi the key being serialized. (0x00000000 if master key)
* 32 bytes: the chain code
* 33 bytes: the public key or private key data (serP(K) for public keys, 0x00 || ser256(k) for private keys)

Typically the important part (for recovery purposes and generating other keys) is the chain code (32 bytes = 256 bits) and the public / private key (33 bytes).

The book says 512 or 513 bits because the extended private key is `256 chain code bits || 256 private key bits` (512), and the extended public key is `256 chain code bits || 1 evenness bit || 256 public key bits` (513).

Since computers storage works in bytes, the 1 bit for evenness is represented as a whole byte.

> **Comments:**
> **username_0**: But the wallet uses compressed public key which is 264bits?  
> **username_2**: @username_0 8 bits for evenness + 256 Y coordinate bits = 264 compressed public key bits.  

---

