<p>I understand that BIP44 has one edge case vulnerability where if a hacker gets his hands on an Xpub and a private key from its descendants, he can compute the Xprv pair of the original Xpub and therefor get access to every single private key of its descendants.</p>
<p>I'm trying to implement a system where Xpub can be shared without risking too much security and wanted to confirm my understanding. Here's the situation:</p>
<ol>
<li>Let's say Alice has a wallet with multiple accounts, for example <code>m/44'/0'/0'</code>, <code>m/44'/0'/1'</code>, <code>m/44'/0'/2'</code>, and so on.</li>
<li>Alice shares just one Xpub at path <code>m/44'/0'/0'</code> with Bob.</li>
<li>Bob can derive the descendant public key tree with paths such as <code>m/44'/0'/0'/0/0</code>, <code>m/44'/0'/0'/0/1</code>, <code>m/44'/0'/0'/0/2</code>, and so on.</li>
<li>Bob ONLY has access to the derived <strong>PUBLIC KEYS</strong> at above paths.</li>
<li>For some reason, Alice's <strong>PRIVATE KEY</strong> at path <code>m/44'/0'/0'/0/2</code> is leaked.</li>
</ol>
<p>In this case, is the worst case scenario that Alice gets compromised up to <code>m/44'/0'/0'</code> only, and her other key trees <code>m/44'/0'/1'</code>, <code>m/44'/0'/2'</code>, and so on are safe? (Meaning her private keys like <code>m/44/0'/1'/0/0</code>, <code>m/44/0'/2'/0/2</code>, are not affected by the leak)</p>

CC BY-SA 4.0
2020-10-19T16:42:52.760Z
Looks like you've answered your own question? If not, what is the question?
Tony Sanak
CC BY-SA 4.0
2020-10-19T16:45:55.977Z
I just wanted to confirm that I am not misunderstood. So does this mean my "answer" to my question is correct? Also am i missing anything else that might go wrong?
Vlad
<security><private-key><bip32-hd-wallets><deterministic-wallets><bip44>
When a BIP44 XPUB and one of its descendant keys get leaked, what's the worst that can happen?
Vlad
# When a BIP44 XPUB and one of its descendant keys get leaked, what's the worst that can happen?

(Asked by: username_0 on 2020-10-19)

I understand that BIP44 has one edge case vulnerability where if a hacker gets his hands on an Xpub and a private key from its descendants, he can compute the Xprv pair of the original Xpub and therefor get access to every single private key of its descendants.

I'm trying to implement a system where Xpub can be shared without risking too much security and wanted to confirm my understanding. Here's the situation:

1. Let's say Alice has a wallet with multiple accounts, for example `m/44'/0'/0'`, `m/44'/0'/1'`, `m/44'/0'/2'`, and so on.
2. Alice shares just one Xpub at path `m/44'/0'/0'` with Bob.
3. Bob can derive the descendant public key tree with paths such as `m/44'/0'/0'/0/0`, `m/44'/0'/0'/0/1`, `m/44'/0'/0'/0/2`, and so on.
4. Bob ONLY has access to the derived **PUBLIC KEYS** at above paths.
5. For some reason, Alice's **PRIVATE KEY** at path `m/44'/0'/0'/0/2` is leaked.

In this case, is the worst case scenario that Alice gets compromised up to `m/44'/0'/0'` only, and her other key trees `m/44'/0'/1'`, `m/44'/0'/2'`, and so on are safe? (Meaning her private keys like `m/44/0'/1'/0/0`, `m/44/0'/2'/0/2`, are not affected by the leak)

**Tags:** security, private-key, bip32-hd-wallets, deterministic-wallets, bip44

> **Comments:**
> **username_1**: Looks like you've answered your own question? If not, what is the question?  
> **username_0**: I just wanted to confirm that I am not misunderstood. So does this mean my "answer" to my question is correct? Also am i missing anything else that might go wrong?  

---

## 0 answers

