<p>Hierarchical Deterministic (HD) wallets are described in <a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki" rel="noreferrer">BIP-32</a>. There are a number of technical aspects to this, so for the simplicity of this answer, I'll only talk about deriving a child private key from a parent private key, using <em>non-hardened derivation</em>.</p>
<p>To keep the syntax similar to your screenshot, let <code>y</code> be the parent private key, so that <code>g^y</code> is the parent public key. In BIP-32 HD, we don't just use <code>y</code> though, we also need the <em>chain code</em> for <code>y</code>. They call it a random value, but in practice it is computed in a deterministic way, so that it can be retrieved later. Let's call this <code>k</code>, as the purpose in the screenshot seems to be similar.</p>
<p>To derive child <code>i</code>, we compute (simplified):</p>
<pre><code>I = HMAC-SHA512(k, g^y || i).
</code></pre>
<p>where <code>k</code> is used as a secret to compute the HMAC function. In the screenshot they simply hashed the two together, which isn't best practice, but may be simpler to understand. They also left out <code>g^y</code>, so let's ignore that too.</p>
<p>This value <code>I</code> we computed is 512 bits long. Split it in half, and call the left 256 bits <code>L</code> and the right 256 bits <code>R</code>:</p>
<ul>
<li><code>R</code> is the child chain code (which you can ignore if you like), used to derive children of this child and continue the chain.</li>
<li>The child secret key is <code>y + L</code>.</li>
</ul>
<p>Because your screenshot simply just computes a hash, you can think of it like directly computing <code>L</code> here without computing <code>R</code>. It is safe to say that <code>x</code> is a typo though. HD derivation only needs the chain code <code>k</code> and private key <code>y</code> to compute the child private keys.</p>

CC BY-SA 4.0
2021-12-12T01:56:13.470Z
2021-12-12T01:56:13.470Z
meshcollider
<p>I'm reading <a href="https://rads.stackoverflow.com/amzn/click/com/0691171696" rel="nofollow noreferrer" rel="nofollow noreferrer">Bitcoin and Cryptocurrency Technologies</a>. This book talks about how &quot;hierarchical deterministic wallet&quot; works like this:</p>
<p><a href="https://i.sstatic.net/owIn9.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/owIn9.png" alt="enter image description here" /></a></p>
<p>Here it says private key generation need &quot;k, x, y&quot;, but where is x in the equation? I mean, for &quot;y+H(k||i)&quot;, what does it have to do with the &quot;x&quot;?</p>

<wallet><bip32-hd-wallets>
How does "hierarchical deterministic wallet" work?
Shawn C
# How does "hierarchical deterministic wallet" work?

(Asked by: username_0 on 2021-12-11)

I'm reading [Bitcoin and Cryptocurrency Technologies](https://rads.stackoverflow.com/amzn/click/com/0691171696). This book talks about how "hierarchical deterministic wallet" works like this:

[![enter image description here](https://i.sstatic.net/owIn9.png)](https://i.sstatic.net/owIn9.png)

Here it says private key generation need "k, x, y", but where is x in the equation? I mean, for "y+H(k||i)", what does it have to do with the "x"?

**Tags:** wallet, bip32-hd-wallets


---

## 1 answers

### Answer by username_1 on 2021-12-12. Score: 5 | Accepted answer

Hierarchical Deterministic (HD) wallets are described in [BIP-32](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki). There are a number of technical aspects to this, so for the simplicity of this answer, I'll only talk about deriving a child private key from a parent private key, using *non-hardened derivation*.

To keep the syntax similar to your screenshot, let `y` be the parent private key, so that `g^y` is the parent public key. In BIP-32 HD, we don't just use `y` though, we also need the *chain code* for `y`. They call it a random value, but in practice it is computed in a deterministic way, so that it can be retrieved later. Let's call this `k`, as the purpose in the screenshot seems to be similar.

To derive child `i`, we compute (simplified):

```
I = HMAC-SHA512(k, g^y || i).

```

where `k` is used as a secret to compute the HMAC function. In the screenshot they simply hashed the two together, which isn't best practice, but may be simpler to understand. They also left out `g^y`, so let's ignore that too.

This value `I` we computed is 512 bits long. Split it in half, and call the left 256 bits `L` and the right 256 bits `R`:

* `R` is the child chain code (which you can ignore if you like), used to derive children of this child and continue the chain.
* The child secret key is `y + L`.

Because your screenshot simply just computes a hash, you can think of it like directly computing `L` here without computing `R`. It is safe to say that `x` is a typo though. HD derivation only needs the chain code `k` and private key `y` to compute the child private keys.


---

