<p>This is not possible; quoting BIP32:</p>
<blockquote>
<p>Given any number (2 ≤ N ≤ 232-1) of (index, extended private key) tuples (ij,(kij,cij)), with distinct ij's, determining whether they are derived from a common parent extended private key (i.e., whether there exists a (kpar,cpar) such that for each j in (0..N-1) CKDpriv((kpar,cpar),ij)=(kij,cij)), cannot be done more efficiently than a 2256 brute force of HMAC-SHA512.</p>
</blockquote>
<p>Given that this is not possible for extended private keys, it is certainly not possible for extended public keys.</p>

CC BY-SA 4.0
2024-05-22T12:25:37.007Z
2024-05-22T12:25:37.007Z
Pieter Wuille
<p>Say I derive three extended public keys<sup>1</sup> (normal mode):</p>
<p><strong>Parent</strong>:</p>
<p>Pubkey: <code>035f743ee7d73d27e8c80f6b2458e6d4e2a45f3d7dd35c4e4d84ff3d939d09f40c</code></p>
<p>Chaincode <code>71d145eec8d031b39107cb7cb9641cc1e8169b6a25b489b157a0af2197717970</code></p>
<p><strong>Children</strong>:</p>
<p>Pubkey: <code>0317365d2ea4aa79e731fd4f0f6d60bf0ef75a35189a647667eebc9c7323d304d0</code></p>
<p>Chaincode <code>9cb9a9fe6e57b62f9a7970649d8dc4633fd9d4b5777a1397a275bd30a88c3111</code></p>
<p>Pubkey: <code>0230cdc8f7b84c0998ec182777d9d1f35ea45fe7620e979862c7025b18162108cb</code></p>
<p>Chaincode <code>44b54106ea0720a1ac226d598b89297dfe8efd2b7abf75c88761aa6df9c2886b</code></p>
<hr />
<p>If I have any two of these three (child-child or parent-child (not knowing which is parent)), is it possible to detect that the keys are related? How would it be done?</p>
<p>If not, what extra information would be required. The child indexes? Signatures from a shared root private key?</p>
<hr />
<p>See also:</p>
<p><a href="https://bitcoin.stackexchange.com/questions/83970/why-the-normal-mode-exist-in-bip32">Why the normal mode exist in BIP32</a></p>
<p><a href="https://bitcoin.stackexchange.com/questions/37488/eli5-whats-the-difference-between-a-child-key-and-a-hardened-child-key-in-bip3">ELI5: What&#39;s the difference between a child-key and a hardened child-key in BIP32</a></p>
<p><a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki" rel="nofollow noreferrer">BIP32</a></p>
<hr />
<p><sub> 1: I used this <a href="https://learnmeabitcoin.com/technical/keys/hd-wallets/extended-keys/" rel="nofollow noreferrer">most excellent write up</a> to create these.</sub></p>

CC BY-SA 4.0
2024-05-22T08:40:30.570Z
A signature created with the root private key can be used to verify the relationship. You would use the root public key to verify the signature.
To detect if two extended keys have the same root private key, you need additional information such as the child index or signatures from the root private key. Without this information, determining the relationship is not feasible.
Mani T
<bip32-hd-wallets><public-key><xpub><deterministic-wallets>
How might you detect if two extended public keys have the same root private key?
Lee
# How might you detect if two extended public keys have the same root private key?

(Asked by: username_0 on 2024-05-22)

Say I derive three extended public keys1 (normal mode):

**Parent**:

Pubkey: `035f743ee7d73d27e8c80f6b2458e6d4e2a45f3d7dd35c4e4d84ff3d939d09f40c`

Chaincode `71d145eec8d031b39107cb7cb9641cc1e8169b6a25b489b157a0af2197717970`

**Children**:

Pubkey: `0317365d2ea4aa79e731fd4f0f6d60bf0ef75a35189a647667eebc9c7323d304d0`

Chaincode `9cb9a9fe6e57b62f9a7970649d8dc4633fd9d4b5777a1397a275bd30a88c3111`

Pubkey: `0230cdc8f7b84c0998ec182777d9d1f35ea45fe7620e979862c7025b18162108cb`

Chaincode `44b54106ea0720a1ac226d598b89297dfe8efd2b7abf75c88761aa6df9c2886b`

---

If I have any two of these three (child-child or parent-child (not knowing which is parent)), is it possible to detect that the keys are related? How would it be done?

If not, what extra information would be required. The child indexes? Signatures from a shared root private key?

---

See also:

[Why the normal mode exist in BIP32](https://bitcoin.stackexchange.com/questions/83970/why-the-normal-mode-exist-in-bip32)

[ELI5: What's the difference between a child-key and a hardened child-key in BIP32](https://bitcoin.stackexchange.com/questions/37488/eli5-whats-the-difference-between-a-child-key-and-a-hardened-child-key-in-bip3)

[BIP32](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki)

---

1: I used this [most excellent write up](https://learnmeabitcoin.com/technical/keys/hd-wallets/extended-keys/) to create these.

**Tags:** bip32-hd-wallets, public-key, xpub, deterministic-wallets

> **Comments:**
> **username_1**: A signature created with the root private key can be used to verify the relationship. You would use the root public key to verify the signature. To detect if two extended keys have the same root private key, you need additional information such as the child index or signatures from the root private key. Without this information, determining the relationship is not feasible.  

---

## 1 answers

### Answer by username_2 on 2024-05-22. Score: 2 | Accepted answer

This is not possible; quoting BIP32:

> Given any number (2 ≤ N ≤ 232-1) of (index, extended private key) tuples (ij,(kij,cij)), with distinct ij's, determining whether they are derived from a common parent extended private key (i.e., whether there exists a (kpar,cpar) such that for each j in (0..N-1) CKDpriv((kpar,cpar),ij)=(kij,cij)), cannot be done more efficiently than a 2256 brute force of HMAC-SHA512.

Given that this is not possible for extended private keys, it is certainly not possible for extended public keys.


---

