<p>In deterministic derivation schemes such as BIP-32, the essence of a wallet is reduced to two pieces of information: a private key and a derivation rule. We call these two in combination an <code>xPriv</code> or extended private key.
Similarly, an extended public key (<code>xPub</code>) consists of the corresponding public key and another derivation rule. We can easily find the public key from the private key. What about the derivation rule, though?</p>
<p>In the standard¹ case, the derivation rules are simple arithmetic with large numbers. Let's look at an example. Let <code>k</code> be the main private key, the derivation rule <code>k' = k + 1</code>, <code>g</code> the generator, and the public key <code>K = k•g</code>. So, when we derive the second key in the chain <code>k'</code> we observe</p>
<p><code>k'•g = (k+1)•g = k•g + g = K + g = K'</code></p>
<p>which means that when the private keys are a scalar series created per additions of 1, the corresponding public keys would be a series of elliptic curve points derived by additions of the generator <code>g</code>. So, we have both the main public key and a derivation rule by which we can find any subkey from it!</p>
<p>What does that have to do with your question? In the example you link to, Gabriel uses the described relationship between his <code>xPub</code> and his <code>xPriv</code> to keep the private key offline, and to only deploy the <code>xPub</code> on his online system. This allows Gabriel to generate addresses as needed for the webshop, but keeps the private keys from being exposed to a potentially breachable online system. When Gabriel wants to spend some funds he received, he generates the transaction with the watch-only wallet and signs it offline by deriving the corresponding private keys with his hardware wallet as needed.</p>
<hr />
<p><sup>¹ There are also derivation rules that do not allow public keys to be derived from the main public key, e.g. by using a step of hashing in the derivation. Such &quot;hardened&quot; schemes require access to the main private key to derive additional addresses.</sup></p>

CC BY-SA 4.0
2020-10-13T13:32:28.030Z
2020-10-13T13:32:28.030Z
Murch
<p>I'm new in Bitcoin, this is something I'm confused with.</p>
<p>If we are deriving children, i.e. public keys, from xpub, without private keys, for the purpose of receiving outputs, how are we able to spend UTXO if we don't have private key?</p>
<p>In this example:
<a href="https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch05.asciidoc#using-an-extended-public-key-on-a-web-store" rel="nofollow noreferrer">https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch05.asciidoc#using-an-extended-public-key-on-a-web-store</a>
xpub is set up on server to generate public keys to receive money on e-commerce website. But how do we access that money if we don't have private keys?</p>

<bip32-hd-wallets><address-generation><utxo><xpub>
How to use UTXO of xpub derived addresses?
Andrija
# How to use UTXO of xpub derived addresses?

(Asked by: username_0 on 2020-10-13)

I'm new in Bitcoin, this is something I'm confused with.

If we are deriving children, i.e. public keys, from xpub, without private keys, for the purpose of receiving outputs, how are we able to spend UTXO if we don't have private key?

In this example:
<https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch05.asciidoc#using-an-extended-public-key-on-a-web-store>
xpub is set up on server to generate public keys to receive money on e-commerce website. But how do we access that money if we don't have private keys?

**Tags:** bip32-hd-wallets, address-generation, utxo, xpub


---

## 1 answers

### Answer by username_1 on 2020-10-13. Score: 0

In deterministic derivation schemes such as BIP-32, the essence of a wallet is reduced to two pieces of information: a private key and a derivation rule. We call these two in combination an `xPriv` or extended private key.
Similarly, an extended public key (`xPub`) consists of the corresponding public key and another derivation rule. We can easily find the public key from the private key. What about the derivation rule, though?

In the standard¹ case, the derivation rules are simple arithmetic with large numbers. Let's look at an example. Let `k` be the main private key, the derivation rule `k' = k + 1`, `g` the generator, and the public key `K = k•g`. So, when we derive the second key in the chain `k'` we observe

`k'•g = (k+1)•g = k•g + g = K + g = K'`

which means that when the private keys are a scalar series created per additions of 1, the corresponding public keys would be a series of elliptic curve points derived by additions of the generator `g`. So, we have both the main public key and a derivation rule by which we can find any subkey from it!

What does that have to do with your question? In the example you link to, Gabriel uses the described relationship between his `xPub` and his `xPriv` to keep the private key offline, and to only deploy the `xPub` on his online system. This allows Gabriel to generate addresses as needed for the webshop, but keeps the private keys from being exposed to a potentially breachable online system. When Gabriel wants to spend some funds he received, he generates the transaction with the watch-only wallet and signs it offline by deriving the corresponding private keys with his hardware wallet as needed.

---

¹ There are also derivation rules that do not allow public keys to be derived from the main public key, e.g. by using a step of hashing in the derivation. Such "hardened" schemes require access to the main private key to derive additional addresses.


---

