<blockquote>
  <p>My question is, why is reversible arithmetic (addition of the parent private key and output from the hashing function) used instead of a “one way” function such as elliptic curve addition or others?</p>
</blockquote>

<p>To allow public derivation.</p>

<p>This means that it is possible to give someone a parent extended key (public key + chain code), and they can derive all public keys in the chain.</p>

<p>If the final secret key is computed by a one-way function directly, no equivalent operations exists with public keys to compute the public version of the result.</p>

CC BY-SA 3.0
2017-12-08T21:12:17.750Z
We have equations like this, where `hash` is the first half of the HMAC-SHA512 hash, `K`, `k` are parent keys and `K1`, `k1` are children. `K+hash = K1`, `k+hash = k1`. There is no one directional arithmetic operation that would allow the same to be true?
Ivan G.
CC BY-SA 3.0
2017-12-08T22:53:44.870Z
No, this is provably impossible with just elliptic curve based derivations. The constructions you will come up with will either be insecure, or impossible to do without the private keys.
Pieter Wuille
CC BY-SA 3.0
2017-12-08T20:46:49.517Z
2017-12-08T20:46:49.517Z
Pieter Wuille
<p>As I currently understand, there exist two methods for extending keys in a hierarchical deterministic wallet: regular derivation, and hardened derivation. Hardened derivation essentially “breaks the chain,” adding security because through normal derivation, a leaked child private key, along with the chain code, could be used to derive any parent private keys through subtraction.</p>

<p>Normal child private key derivation would happen like this: Take the HMAC-SHA512 hash of the parent public key, parent chain code, and index number. The first 256 bits are added to the parent private key to derive the child private key, and the other 256 bits are the child chain code. Using this, an adversary who possesses a child private key and the chain code could use subtraction to find the parent private key.
And hardened derivation is similar, but the parent private key is used as input to the hashing function so it can’t be reversed, even if the chain code is known. The disadvantage is that a parent private key is required to generate child public keys, eliminating the possibility of a “receive only” machine having access to public keys only.</p>

<p>My question is, why is reversible arithmetic (addition of the parent private key and output from the hashing function) used instead of a “one way” function such as elliptic curve addition or others?</p>

<wallet><private-key><bip32-hd-wallets>
HD Wallets - Why Extend a Private Key with addition? (Non Hardened)
Ivan G.
# HD Wallets - Why Extend a Private Key with addition? (Non Hardened)

(Asked by: username_0 on 2017-12-08)

As I currently understand, there exist two methods for extending keys in a hierarchical deterministic wallet: regular derivation, and hardened derivation. Hardened derivation essentially “breaks the chain,” adding security because through normal derivation, a leaked child private key, along with the chain code, could be used to derive any parent private keys through subtraction.

Normal child private key derivation would happen like this: Take the HMAC-SHA512 hash of the parent public key, parent chain code, and index number. The first 256 bits are added to the parent private key to derive the child private key, and the other 256 bits are the child chain code. Using this, an adversary who possesses a child private key and the chain code could use subtraction to find the parent private key.
And hardened derivation is similar, but the parent private key is used as input to the hashing function so it can’t be reversed, even if the chain code is known. The disadvantage is that a parent private key is required to generate child public keys, eliminating the possibility of a “receive only” machine having access to public keys only.

My question is, why is reversible arithmetic (addition of the parent private key and output from the hashing function) used instead of a “one way” function such as elliptic curve addition or others?

**Tags:** wallet, private-key, bip32-hd-wallets


---

## 1 answers

### Answer by username_1 on 2017-12-08. Score: 2 | Accepted answer

> My question is, why is reversible arithmetic (addition of the parent private key and output from the hashing function) used instead of a “one way” function such as elliptic curve addition or others?

To allow public derivation.

This means that it is possible to give someone a parent extended key (public key + chain code), and they can derive all public keys in the chain.

If the final secret key is computed by a one-way function directly, no equivalent operations exists with public keys to compute the public version of the result.

> **Comments:**
> **username_0**: We have equations like this, where `hash` is the first half of the HMAC-SHA512 hash, `K`, `k` are parent keys and `K1`, `k1` are children. `K+hash = K1`, `k+hash = k1`. There is no one directional arithmetic operation that would allow the same to be true?  
> **username_1**: No, this is provably impossible with just elliptic curve based derivations. The constructions you will come up with will either be insecure, or impossible to do without the private keys.  

---

