<p>You're quite right that in theory, there is likely no difference between using BIP32 hardened derivation, and using a secret xpub (I won't say no difference with certainty, as I'm not sure a security proof of their equivalence is trivial).</p>
<p>In practice, however, I think there is a distinction: xpubs are often exposed to users, while derivation path choices are generally not made by the user. In that regard, having software that forces (or defaults to) hardened derivation steps for (parts of) the derivation path means that the responsibility for security is removed from the user, who may not understand the seriousness of keeping a &quot;public key&quot; secret.</p>

CC BY-SA 4.0
2023-07-18T21:22:27.080Z
What do you mean by "derivation path"? Like the paths defined by BIP44 that have the first three "successors" derived with a hardened derivation?
dassd
CC BY-SA 4.0
2023-07-18T21:27:01.873Z
Yes, the sequence of indexes to use, and whether they're hardened or not.
Pieter Wuille
CC BY-SA 4.0
2023-07-19T09:54:54.980Z
Yes, but I'm not sure I understand how the derivation path relates to the end goals of using hardened or unhardened derivations? You mean in the sense that it's good to have because it increases security and the user doesn't even have to think about it, it's part of the software, otherwise they'd have to worry about the chain code?
dassd
CC BY-SA 4.0
2023-07-19T12:18:07.010Z
Not only think about - software would need to explain to users that the risks involved when xpubs are shared. Sometimes it's desirable (e.g. when watching others' wallets), but if combined with sharing private keys it suddenly leaks your entire wallet. This is a highly unintuitive property, and the reason why hardened derivation exists in the first place. To get the same security without hardening, you'd need to very carefully explain to users the risks involved. Using a separate derivation method avoids the need for users to understand the cryptographic properties of key derivation.
Pieter Wuille
CC BY-SA 4.0
2023-07-18T19:51:56.137Z
2023-07-18T19:51:56.137Z
Pieter Wuille
<p>We can use xpub (extended public key) if we want to generate a new public key (and further the address) on some insecure website for each new order without knowing the private key. We'll do this by using the parent's public key and the parent's chain code from the parent's extended public key, and incrementing the index for each new child key. The problem is that by discovering the private key of one child using the formula <code>parentPrivateKey = childPrivateKey - L256bits % n</code>, we can discover the parent's private key, and thus the private keys for all children in that branch.</p>
<p>So with a non-hardened derivative function, we have:</p>
<ol>
<li>(a) the possibility of deriving the public keys of children without knowing the private key of the parent</li>
<li>(a) risk of theft of all funds by knowing the private key of one child</li>
</ol>
<p>Hence the need for hardened derivation. It works in such a way that the child keys are derived using the private key instead of the public key. Thus, leaking the private key of one child will make it impossible to discover the private key of the parent and the private key of the other children. But also, this type of implementation makes it impossible to obtain the children's public keys without knowing the parent's private key.</p>
<p>So with the hardened derivative function we have:</p>
<ol>
<li>(b) impossibility of deriving children's public keys without the parents private key</li>
<li>(b) there is no risk of theft of all assets by knowing one child's private key</li>
</ol>
<p>My question is why do we have a hardened derivation when we can achieve the same effect (1 (b) and 2 (b) above) using an non-hardened derivation with a <strong>secret chain code</strong>. This will give us:</p>
<ol>
<li>impossibility of deriving children's public keys without the parent's private key; since the parent's chain code is required for that, and the chain code will be kept secret along with the parent's private key</li>
<li>there is no risk of theft of all funds knowing the private key of one child; since the parent's chain code is secret, it will not be possible to make L256 bits from the parent's public key + parent's chain code + index</li>
</ol>
<p><strong>What's the point of a hardened key derivation when we can achieve the same effects using a non-hardened derivation while keeping the parent's chain code secret?</strong></p>

<bip32-hd-wallets><xpub><hardened-derivation>
What's the point of hardened derivation when we can achieve the same effect using non-hardened derivation with a secret parent chain code?
dassd
# What's the point of hardened derivation when we can achieve the same effect using non-hardened derivation with a secret parent chain code?

(Asked by: username_0 on 2023-07-18)

We can use xpub (extended public key) if we want to generate a new public key (and further the address) on some insecure website for each new order without knowing the private key. We'll do this by using the parent's public key and the parent's chain code from the parent's extended public key, and incrementing the index for each new child key. The problem is that by discovering the private key of one child using the formula `parentPrivateKey = childPrivateKey - L256bits % n`, we can discover the parent's private key, and thus the private keys for all children in that branch.

So with a non-hardened derivative function, we have:

1. (a) the possibility of deriving the public keys of children without knowing the private key of the parent
2. (a) risk of theft of all funds by knowing the private key of one child

Hence the need for hardened derivation. It works in such a way that the child keys are derived using the private key instead of the public key. Thus, leaking the private key of one child will make it impossible to discover the private key of the parent and the private key of the other children. But also, this type of implementation makes it impossible to obtain the children's public keys without knowing the parent's private key.

So with the hardened derivative function we have:

1. (b) impossibility of deriving children's public keys without the parents private key
2. (b) there is no risk of theft of all assets by knowing one child's private key

My question is why do we have a hardened derivation when we can achieve the same effect (1 (b) and 2 (b) above) using an non-hardened derivation with a **secret chain code**. This will give us:

1. impossibility of deriving children's public keys without the parent's private key; since the parent's chain code is required for that, and the chain code will be kept secret along with the parent's private key
2. there is no risk of theft of all funds knowing the private key of one child; since the parent's chain code is secret, it will not be possible to make L256 bits from the parent's public key + parent's chain code + index

**What's the point of a hardened key derivation when we can achieve the same effects using a non-hardened derivation while keeping the parent's chain code secret?**

**Tags:** bip32-hd-wallets, xpub, hardened-derivation


---

## 1 answers

### Answer by username_1 on 2023-07-18. Score: 2 | Accepted answer

You're quite right that in theory, there is likely no difference between using BIP32 hardened derivation, and using a secret xpub (I won't say no difference with certainty, as I'm not sure a security proof of their equivalence is trivial).

In practice, however, I think there is a distinction: xpubs are often exposed to users, while derivation path choices are generally not made by the user. In that regard, having software that forces (or defaults to) hardened derivation steps for (parts of) the derivation path means that the responsibility for security is removed from the user, who may not understand the seriousness of keeping a "public key" secret.

> **Comments:**
> **username_0**: What do you mean by "derivation path"? Like the paths defined by BIP44 that have the first three "successors" derived with a hardened derivation?  
> **username_1**: Yes, the sequence of indexes to use, and whether they're hardened or not.  
> **username_0**: Yes, but I'm not sure I understand how the derivation path relates to the end goals of using hardened or unhardened derivations? You mean in the sense that it's good to have because it increases security and the user doesn't even have to think about it, it's part of the software, otherwise they'd have to worry about the chain code?  
> **username_1**: Not only think about - software would need to explain to users that the risks involved when xpubs are shared. Sometimes it's desirable (e.g. when watching others' wallets), but if combined with sharing private keys it suddenly leaks your entire wallet. This is a highly unintuitive property, and the reason why hardened derivation exists in the first place. To get the same security without hardening, you'd need to very carefully explain to users the risks involved. Using a separate derivation method avoids the need for users to understand the cryptographic properties of key derivation.  

---

