<p>This is accounted for within the BIP32 specification, they are called 'hardened' keys. Hardened child private keys are derived from the parents' private keys, and revealing the hardened child private keys does not reveal the parents' private key. </p>

<p>Child indices 0...2^31-1 are reserved for regular keys (that have the problem you describe), and child indices 2^31...2^32-1 are reserved for hardened private keys.</p>

<p>Notation for a standard child:</p>

<pre><code>m/0
</code></pre>

<p>Notation for a hardened child:</p>

<pre><code>m/0'
m/0h
</code></pre>

CC BY-SA 3.0
2015-07-29T18:41:06.393Z
This makes generating master public key useless as it is unable to generate public keys in children, which is something I want to have.
Pavol Rusnak
CC BY-SA 3.0
2015-07-29T19:00:50.267Z
@PavolRusnak, you can't have it both ways, unfortunately. Either the parent-pub and child-pub are related by an ECC key for which the private key is known, or it's not. But you can use both hardened and standard keys in the same tree structure! [Best practice](http://bitcoin.stackexchange.com/questions/37826/best-practices-for-hardened-keys-in-hd-wallets) is to use Hardened keys for upper levels of the tree, and non-hardened only for the lower levels.
morsecoder
CC BY-SA 3.0
2015-07-30T06:10:31.993Z
See Bip44: you can use m / 44'/0'/0'/0/k, where k is your key. Losing private key k together with parent/k would not reveal the whole chain because you do : m/44'/0'/0>'</0/0 (mint the >.<)
Jonas Schnelli
CC BY-SA 3.0
2015-07-29T17:59:39.487Z
2015-07-29T18:21:45.340Z
2015-07-29T18:21:45.340Z
morsecoder
<p>HD Wallets have a flaw that revealing a private key and its parent master public key will reveal its parent master private key. (Described here[1] and here[2]).</p>

<p>Isn't there a similar concept with master public key and master private key that does not suffer from this issue. (Does not have to be ECDSA. I just want a deterministic private-public keypair generator that can publish its master public key).</p>

<p>[1] <a href="https://bitcoinmagazine.com/8396/deterministic-wallets-advantages-flaw/" rel="nofollow">https://bitcoinmagazine.com/8396/deterministic-wallets-advantages-flaw/</a></p>

<p>[2] <a href="https://eprint.iacr.org/2014/998.pdf" rel="nofollow">https://eprint.iacr.org/2014/998.pdf</a> (chapter 3)</p>

<private-key><public-key><bip32-hd-wallets>
Is there a deterministic private-public keypair generator without the BIP32 private key revealing issue?
Pavol Rusnak
# Is there a deterministic private-public keypair generator without the BIP32 private key revealing issue?

(Asked by: username_0 on 2015-07-29)

HD Wallets have a flaw that revealing a private key and its parent master public key will reveal its parent master private key. (Described here[1] and here[2]).

Isn't there a similar concept with master public key and master private key that does not suffer from this issue. (Does not have to be ECDSA. I just want a deterministic private-public keypair generator that can publish its master public key).

[1] <https://bitcoinmagazine.com/8396/deterministic-wallets-advantages-flaw/>

[2] <https://eprint.iacr.org/2014/998.pdf> (chapter 3)

**Tags:** private-key, public-key, bip32-hd-wallets


---

## 1 answers

### Answer by username_1 on 2015-07-29. Score: 4

This is accounted for within the BIP32 specification, they are called 'hardened' keys. Hardened child private keys are derived from the parents' private keys, and revealing the hardened child private keys does not reveal the parents' private key.

Child indices 0...2^31-1 are reserved for regular keys (that have the problem you describe), and child indices 2^31...2^32-1 are reserved for hardened private keys.

Notation for a standard child:

```
m/0

```

Notation for a hardened child:

```
m/0'
m/0h

```

> **Comments:**
> **username_0**: This makes generating master public key useless as it is unable to generate public keys in children, which is something I want to have.  
> **username_1**: @username_0, you can't have it both ways, unfortunately. Either the parent-pub and child-pub are related by an ECC key for which the private key is known, or it's not. But you can use both hardened and standard keys in the same tree structure! [Best practice](http://bitcoin.stackexchange.com/questions/37826/best-practices-for-hardened-keys-in-hd-wallets) is to use Hardened keys for upper levels of the tree, and non-hardened only for the lower levels.  
> **username_2**: See Bip44: you can use m / 44'/0'/0'/0/k, where k is your key. Losing private key k together with parent/k would not reveal the whole chain because you do : m/44'/0'/0>'</0/0 (mint the >.<)  

---

