<p>No, this cannot be found out if we assume</p>

<blockquote>
  <p><img src="https://i.sstatic.net/XnYKF.png" alt=""></p>
</blockquote>

<p>(<a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Security" rel="nofollow noreferrer">which is a desired property of BIP32</a> and which I'm going to refer to as <code>Φ</code> describing the problem <code>φ</code>) to be true and assume that <code>n+m &lt;= 2^32 - 2</code></p>

<p>Assume you have an efficient solver <code>ξ : P^m → P</code> for the problem you described with</p>

<pre><code>P := { a ∈ ℕ | 1 &lt;= a &lt;= 0xFFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFE BAAE DCE6 AF48 A03B BFD2 5E8C D036 4140}
</code></pre>

<p>being the set of valid secp256k1 ECDSA standard private keys.</p>

<p>Let <code>Ψ = (r_1, r_2, ..., r_{m+1})</code> be an instance of a problem impossible to solve efficiently if <code>Φ</code> is true.</p>

<p>Solve <code>φ</code> as follows: If and only if <code>ξ(r_1, r_2, ..., r_m) = r_{m+1}</code>, return <code>true</code>, otherwise return <code>false</code>. This contradicts <code>Φ</code>.</p>

CC BY-SA 3.0
2017-03-03T16:15:45.647Z
Maybe it would be helpful to explain how the BIP32 key generation algorithm ensures that this property is satisfied.
Nate Eldredge
CC BY-SA 3.0
2017-03-03T16:17:12.897Z
This is correct, but only when the extended parent public key is not known (or hardened derivation was used). Otherwise, one can derive the parent private key from the parent public key and 1 child private key, and then just derive the other children from that. Sharing HD private keys is very dangerous for this reason.
Pieter Wuille
CC BY-SA 3.0
2017-03-03T13:52:39.187Z
2017-03-05T09:05:41.000Z
2017-03-05T09:05:41.000Z
UTF-8
<p>I'm wondering whether disclosing a consecutive number of HD private keys derived from a given master key would allow someone to compute what the next private key in the sequence would be before it is revealed?</p>

<p>So given HD-derived private keys n, n+1, n+2, ..., n+m, can one figure out what is the private key n+m+1?</p>

<private-key><cryptography><bip32-hd-wallets>
Given a set of consecutive HD private keys, can you generate the next private key without knowing the master private key?
ThePiachu
# Given a set of consecutive HD private keys, can you generate the next private key without knowing the master private key?

(Asked by: username_0 on 2017-03-02)

I'm wondering whether disclosing a consecutive number of HD private keys derived from a given master key would allow someone to compute what the next private key in the sequence would be before it is revealed?

So given HD-derived private keys n, n+1, n+2, ..., n+m, can one figure out what is the private key n+m+1?

**Tags:** private-key, cryptography, bip32-hd-wallets


---

## 1 answers

### Answer by username_1 on 2017-03-03. Score: 1 | Accepted answer

No, this cannot be found out if we assume

> ![](https://i.sstatic.net/XnYKF.png)

([which is a desired property of BIP32](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Security) and which I'm going to refer to as `Φ` describing the problem `φ`) to be true and assume that `n+m <= 2^32 - 2`

Assume you have an efficient solver `ξ : P^m → P` for the problem you described with

```
P := { a ∈ ℕ | 1 <= a <= 0xFFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFE BAAE DCE6 AF48 A03B BFD2 5E8C D036 4140}

```

being the set of valid secp256k1 ECDSA standard private keys.

Let `Ψ = (r_1, r_2, ..., r_{m+1})` be an instance of a problem impossible to solve efficiently if `Φ` is true.

Solve `φ` as follows: If and only if `ξ(r_1, r_2, ..., r_m) = r_{m+1}`, return `true`, otherwise return `false`. This contradicts `Φ`.

> **Comments:**
> **username_2**: Maybe it would be helpful to explain how the BIP32 key generation algorithm ensures that this property is satisfied.  
> **username_3**: This is correct, but only when the extended parent public key is not known (or hardened derivation was used). Otherwise, one can derive the parent private key from the parent public key and 1 child private key, and then just derive the other children from that. Sharing HD private keys is very dangerous for this reason.  

---

