<p>A <a href="https://en.bitcoin.it/w/index.php?title=BIP_0032&amp;action=historysubmit&amp;diff=37414&amp;oldid=37158" rel="nofollow">previous draft</a> of BIP0032 did this, actually. (Sorry about linking to the bitcoin wiki - that change was made before we switched over to git for BIP tracking.)</p>

<p>According to the changelog, it was done for speed reasons.</p>

<blockquote>
  <ul>
  <li>[30 Apr 2013] Switched from multiplication by I<sub>L</sub> to addition of I<sub>L</sub> (faster, easier implementation)</li>
  </ul>
</blockquote>

<p>It's much faster when deriving a child private key from a parent private key. The new method requires only a normal addition (mod n) rather than an ECDSA point multiplication.</p>

<p>It's not faster when deriving a child public key from a parent public key. That still requires an ECDSA multiplication followed by an ECDSA addition. (In fact, <a href="https://gist.github.com/nickodell/a34f724a548d10402fa0" rel="nofollow">it's about 2% slower.</a>)</p>

<p>Using addition does not add any security issues. It's possible to get a parent private key from a child private key and an extended public key, but that would also be true if multiplication was used.</p>

CC BY-SA 3.0
2015-03-08T08:52:04.910Z
Thanks for the answer! As I also expected, it should be due to the performance and efficiency. However, doesn't multiplication makes it stronger in terms of security? In addition, finding the master public key based on children's public key would be easy for an attacker I suppose? He just needs to subtract a children's public key by different number (brute forcing seed size)
abeikverdi
CC BY-SA 3.0
2015-03-08T14:23:10.570Z
No, it does not add anything. There are no security properties that a multiplication gives that addition doesn't. The reasons for changing was that it 1) didn't improve anything 2) was faster 3) was easier to implement and 4) would not make people assume it has any properties it doesn't (people often assume that no inverse for EC multiplication exists, which is true, but only to solve for k in k*P = Q; solving for P is possible).
Pieter Wuille
CC BY-SA 3.0
2015-03-09T08:10:27.430Z
@PieterWuille can you elaborate a bit more on your last sentence? What do you mean by solving P is possible?
abeikverdi
CC BY-SA 3.0
2015-03-09T09:34:04.987Z
@abeikverdi This is getting out of scope of the original question, so I [made a new question](http://bitcoin.stackexchange.com/questions/36382/how-do-you-invert-an-ecdsa-multiplication).
Nick ODell
CC BY-SA 3.0
2015-03-08T07:49:54.140Z
2015-03-08T18:19:03.377Z
2015-03-08T18:19:03.377Z
Nick ODell
<p>As describe by Maxwell <a href="https://bitcointalk.org/index.php?topic=19137.msg239768#msg239768" rel="nofollow">here</a> in HD wallets assuming we have a key pair with private key <code>SK.a</code> and public key of <code>PK.a</code> and a seed <code>s</code> and a generator point <code>G</code>, we can generate a new key pair of <code>(SK.b, PK.b)</code> as follows: <br/></p>

<pre><code>PK.b = PK.a + sG
SK.b = SK.a + s
</code></pre>

<p>The advantage with this method is that a service provider can generate new public keys without knowing the clients private key.
My question is that, why don't we multiply the seed and private key rather than adding them?</p>

<pre><code>PK.b = PK.a * s
SK.b = SK.a * s
</code></pre>

<p>Is there any problem with the later method that I suggested?</p>

<private-key><bip32-hd-wallets><seed>
Address generator for Bitcoin wallet
abeikverdi
# Address generator for Bitcoin wallet

(Asked by: username_0 on 2015-03-08)

As describe by Maxwell [here](https://bitcointalk.org/index.php?topic=19137.msg239768#msg239768) in HD wallets assuming we have a key pair with private key `SK.a` and public key of `PK.a` and a seed `s` and a generator point `G`, we can generate a new key pair of `(SK.b, PK.b)` as follows:

```
PK.b = PK.a + sG
SK.b = SK.a + s

```

The advantage with this method is that a service provider can generate new public keys without knowing the clients private key.
My question is that, why don't we multiply the seed and private key rather than adding them?

```
PK.b = PK.a * s
SK.b = SK.a * s

```

Is there any problem with the later method that I suggested?

**Tags:** private-key, bip32-hd-wallets, seed


---

## 1 answers

### Answer by username_1 on 2015-03-08. Score: 2 | Accepted answer

A [previous draft](https://en.bitcoin.it/w/index.php?title=BIP_0032&action=historysubmit&diff=37414&oldid=37158) of BIP0032 did this, actually. (Sorry about linking to the bitcoin wiki - that change was made before we switched over to git for BIP tracking.)

According to the changelog, it was done for speed reasons.

> * [30 Apr 2013] Switched from multiplication by IL to addition of IL (faster, easier implementation)

It's much faster when deriving a child private key from a parent private key. The new method requires only a normal addition (mod n) rather than an ECDSA point multiplication.

It's not faster when deriving a child public key from a parent public key. That still requires an ECDSA multiplication followed by an ECDSA addition. (In fact, [it's about 2% slower.](https://gist.github.com/username_1/a34f724a548d10402fa0))

Using addition does not add any security issues. It's possible to get a parent private key from a child private key and an extended public key, but that would also be true if multiplication was used.

> **Comments:**
> **username_0**: Thanks for the answer! As I also expected, it should be due to the performance and efficiency. However, doesn't multiplication makes it stronger in terms of security? In addition, finding the master public key based on children's public key would be easy for an attacker I suppose? He just needs to subtract a children's public key by different number (brute forcing seed size)  
> **username_2**: No, it does not add anything. There are no security properties that a multiplication gives that addition doesn't. The reasons for changing was that it 1) didn't improve anything 2) was faster 3) was easier to implement and 4) would not make people assume it has any properties it doesn't (people often assume that no inverse for EC multiplication exists, which is true, but only to solve for k in k*P = Q; solving for P is possible).  
> **username_0**: @username_2 can you elaborate a bit more on your last sentence? What do you mean by solving P is possible?  
> **username_1**: @username_0 This is getting out of scope of the original question, so I [made a new question](http://bitcoin.stackexchange.com/questions/36382/how-do-you-invert-an-ecdsa-multiplication).  

---

