<p>Upon a bit more searching, I found the derivation for getting the child public key without the private key <a href="https://bitcoin.org/en/developer-guide#public-key-formats" rel="nofollow noreferrer">here</a>:</p>

<pre><code>child_private_key == (parent_private_key + lefthand_hash_output) % G
child_public_key == point( (parent_private_key + lefthand_hash_output) % G )
child_public_key == point(child_private_key) == parent_public_key + point(lefthand_hash_output)
</code></pre>

<p>In terms of <em>K</em>, <em>k</em> and <em>G</em> where prime denotes the child and <em>h</em> denotes the left-hand hash output:</p>

<pre><code>k' = (k + h) % G
K' = point ( (k + h) % G)
K' = point (k')
K' = K + point(h)
</code></pre>

<p><a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Public_parent_key_rarr_public_child_key" rel="nofollow noreferrer">Here</a> are the exact implementation details from the BIP 32 documentation</p>

CC BY-SA 4.0
2020-03-28T13:33:50.397Z
You may want to mention that `point()` is the ECDSA public key creation function i.e. `point(private_key) == public_key`.
Flux
CC BY-SA 4.0
2017-10-31T15:34:35.767Z
2018-12-17T17:14:56.607Z
2018-12-17T17:14:56.607Z
Seb
<blockquote>
  <p>How is the relationship between child private and public keys (K = k*G)</p>
</blockquote>

<p>(a+b)*G = aG + bG</p>

CC BY-SA 3.0
2017-10-31T15:13:51.410Z
Thanks for answering! Its helpful to see how associative addition in elliptic curve math applies to generating the public key while using the private key. But I still don't understand how that generates a public key without using a private key. If a = [lefthand hash output] and b = [parent private key], I can see how that equation generates the public key, but how does that get me the child public key without the parent private key?
Seb
CC BY-SA 3.0
2017-10-31T14:50:21.160Z
2017-10-31T14:50:21.160Z
amaclin
<p>According to the documentation on <a href="https://bitcoin.org/en/developer-guide#hierarchical-deterministic-key-creation" rel="noreferrer">bitcoin.org</a> and the Mastering Bitcoin book, you can use an extended public key to create child public keys in HD wallets by combining the lefthand side of the hash output of the parent chain code + parent public key + index:</p>

<blockquote>
  <p>The seemingly-random 256 bits on the lefthand side of the hash output are used as the integer value to be combined with either the parent private key or parent public key to, respectively, create either a child private key or child public key</p>
</blockquote>

<p>I understand how this lefthand side output can be combined with the parent private key to generate the child private key, which in turn can be used to generate a valid child public key. </p>

<p>How is it possible that the child public key generated by combining the hash output with the parent public key corresponds to the child private key generated separately by combining the same hash output with the parent private key?</p>

<p>I thought that in was impossible to generate a public key without knowing exactly what the private key was. How is the relationship between child private and public keys (K = k*G) maintained when they are generated separately in this way?.</p>

<bip32-hd-wallets>
How can extended public keys generate child public keys without generating the child private key in HD wallets?
Seb
# How can extended public keys generate child public keys without generating the child private key in HD wallets?

(Asked by: username_0 on 2017-10-31)

According to the documentation on [bitcoin.org](https://bitcoin.org/en/developer-guide#hierarchical-deterministic-key-creation) and the Mastering Bitcoin book, you can use an extended public key to create child public keys in HD wallets by combining the lefthand side of the hash output of the parent chain code + parent public key + index:

> The seemingly-random 256 bits on the lefthand side of the hash output are used as the integer value to be combined with either the parent private key or parent public key to, respectively, create either a child private key or child public key

I understand how this lefthand side output can be combined with the parent private key to generate the child private key, which in turn can be used to generate a valid child public key.

How is it possible that the child public key generated by combining the hash output with the parent public key corresponds to the child private key generated separately by combining the same hash output with the parent private key?

I thought that in was impossible to generate a public key without knowing exactly what the private key was. How is the relationship between child private and public keys (K = k\*G) maintained when they are generated separately in this way?.

**Tags:** bip32-hd-wallets


---

## 2 answers

### Answer by username_0 on 2017-10-31. Score: 4

Upon a bit more searching, I found the derivation for getting the child public key without the private key [here](https://bitcoin.org/en/developer-guide#public-key-formats):

```
child_private_key == (parent_private_key + lefthand_hash_output) % G
child_public_key == point( (parent_private_key + lefthand_hash_output) % G )
child_public_key == point(child_private_key) == parent_public_key + point(lefthand_hash_output)

```

In terms of *K*, *k* and *G* where prime denotes the child and *h* denotes the left-hand hash output:

```
k' = (k + h) % G
K' = point ( (k + h) % G)
K' = point (k')
K' = K + point(h)

```

[Here](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Public_parent_key_rarr_public_child_key) are the exact implementation details from the BIP 32 documentation

> **Comments:**
> **username_1**: You may want to mention that `point()` is the ECDSA public key creation function i.e. `point(private_key) == public_key`.  

---

### Answer by username_2 on 2017-10-31. Score: 3

> How is the relationship between child private and public keys (K = k\*G)

(a+b)\*G = aG + bG

> **Comments:**
> **username_0**: Thanks for answering! Its helpful to see how associative addition in elliptic curve math applies to generating the public key while using the private key. But I still don't understand how that generates a public key without using a private key. If a = [lefthand hash output] and b = [parent private key], I can see how that equation generates the public key, but how does that get me the child public key without the parent private key?  

---

