<p>The purpose of unhardened derivation is to allow for cases 1 and 2 to derive the same keys as each other. It works because both actually hash the same data, and that adding two scalars will result in the discrete log for the result of adding two points.</p>
<p>In case 1, we take the left part of the hash as a scalar, and add it to the parent private key (also a scalar). In case 2, we take the left part of the hash as a scalar, multiply it by the generator point G to get a point, and add it to the parent public key (which is the parent private key multiplied by G).</p>

CC BY-SA 4.0
2022-03-06T14:41:17.483Z
2022-03-06T14:41:17.483Z
Ava Chow
<p>I am reading about key derivation in chapter 5 of the book &quot;Mastering Bitcoin&quot; by Andreas, along with this <a href="https://bitcoin.stackexchange.com/questions/62533/key-derivation-in-hd-wallets-using-the-extended-private-key-vs-hardened-derivati">detailed thread</a> and <a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki" rel="nofollow noreferrer">BIP-32</a>. Here are some of my understanding about these two procedures:</p>
<p><code>k</code>: private key // <code>K</code>: public key // <code>i</code>: index // <code>c</code>: chain code // <code>H</code>: HMAC hashing result //  <code>Hleft</code>: the first 32 bits of the hash result. // <code>n</code>: order of Ecliptic Curve.  // <code>G</code>: starting point of Ecliptic Curve</p>
<p><strong>Normal Key Derivation</strong></p>
<p>Case 1: parPrivkey -&gt; childPrivkey (and from that, childPubkey)</p>
<pre><code>H = HMAC(cpar, Kpar || ichild) 
=&gt; kchild = (kpar + Hleft) mod n
=&gt; Kchild = G*kchild = G*[ (kpar + Hleft) mod n)]
</code></pre>
<p>Case 2: parPubkey -&gt; childPubkey</p>
<pre><code>H = HMAC(cpar, Kpar || ichild)
=&gt; Kchild = G*Hleft + Kpar
</code></pre>
<p><strong>Hardened Key Derivation</strong></p>
<p>Case 3: parPrivkey -&gt; childPrivkey  (and from that childPubkey)</p>
<pre><code>H = HMAC(cpar, kpar || ichild)
=&gt; kchild = (kpar + Hleft) mod n
=&gt; Kchild = G*kchild = G*[ (kpar + Hleft) mod n]
</code></pre>
<p>Given those 3 methods I have some pretty confusion:</p>
<ol>
<li>the difference in the generation equation between cases 1 and 2 are quite subtle such that we only need to multiply <code>kchild = (kpar + Hleft) mod n</code> by G to get that in case 2. Nevertheless, since there is a factor <code>mod n</code> at the end, I couldn't tell whether <code>Kchild</code> of case 1 will relate to that of case 2. If it does not, then what's the point of generating just public key without being able to spend the fund sent to to it?</li>
</ol>
<p>Thank you very much in advance.</p>

CC BY-SA 4.0
2022-03-07T14:46:30.807Z
> whats the point of generating just public key without being able to spend the fund sent to to it? A. deriving the Receiving address without giving ability to spend, as with less secure store website, or a Watch-Only wallet
HansBKK
<bitcoin-core><wallet><bip32-hd-wallets><mastering-bitcoin><hardened-derivation>
Does derivation from public and private keys give the same result in normal key derivation?
John Pham
# Does derivation from public and private keys give the same result in normal key derivation?

(Asked by: username_0 on 2022-03-06)

I am reading about key derivation in chapter 5 of the book "Mastering Bitcoin" by Andreas, along with this [detailed thread](https://bitcoin.stackexchange.com/questions/62533/key-derivation-in-hd-wallets-using-the-extended-private-key-vs-hardened-derivati) and [BIP-32](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki). Here are some of my understanding about these two procedures:

`k`: private key // `K`: public key // `i`: index // `c`: chain code // `H`: HMAC hashing result // `Hleft`: the first 32 bits of the hash result. // `n`: order of Ecliptic Curve. // `G`: starting point of Ecliptic Curve

**Normal Key Derivation**

Case 1: parPrivkey -> childPrivkey (and from that, childPubkey)

```
H = HMAC(cpar, Kpar || ichild) 
=> kchild = (kpar + Hleft) mod n
=> Kchild = G*kchild = G*[ (kpar + Hleft) mod n)]

```

Case 2: parPubkey -> childPubkey

```
H = HMAC(cpar, Kpar || ichild)
=> Kchild = G*Hleft + Kpar

```

**Hardened Key Derivation**

Case 3: parPrivkey -> childPrivkey (and from that childPubkey)

```
H = HMAC(cpar, kpar || ichild)
=> kchild = (kpar + Hleft) mod n
=> Kchild = G*kchild = G*[ (kpar + Hleft) mod n]

```

Given those 3 methods I have some pretty confusion:

1. the difference in the generation equation between cases 1 and 2 are quite subtle such that we only need to multiply `kchild = (kpar + Hleft) mod n` by G to get that in case 2. Nevertheless, since there is a factor `mod n` at the end, I couldn't tell whether `Kchild` of case 1 will relate to that of case 2. If it does not, then what's the point of generating just public key without being able to spend the fund sent to to it?

Thank you very much in advance.

**Tags:** bitcoin-core, wallet, bip32-hd-wallets, mastering-bitcoin, hardened-derivation

> **Comments:**
> **username_1**: > whats the point of generating just public key without being able to spend the fund sent to to it? A. deriving the Receiving address without giving ability to spend, as with less secure store website, or a Watch-Only wallet  

---

## 1 answers

### Answer by username_2 on 2022-03-06. Score: 2 | Accepted answer

The purpose of unhardened derivation is to allow for cases 1 and 2 to derive the same keys as each other. It works because both actually hash the same data, and that adding two scalars will result in the discrete log for the result of adding two points.

In case 1, we take the left part of the hash as a scalar, and add it to the parent private key (also a scalar). In case 2, we take the left part of the hash as a scalar, multiply it by the generator point G to get a point, and add it to the parent public key (which is the parent private key multiplied by G).


---

