<p>As outlined <a href="https://bitcoinmagazine.com/8396/deterministic-wallets-advantages-flaw/" rel="nofollow">here</a>, <strong>non-hardened</strong> BIP32 wallets can be compromised if:</p>

<ol>
<li>The master public key is known</li>
<li>A child private key is known</li>
</ol>

<p>This is because the unknown (offset) - the index - can be brute forced since it's a field of 2^31. </p>

<p><a href="https://bitcoinmagazine.com/wp-content/uploads/2013/11/privpub2.png" rel="nofollow">Diagram from article</a></p>

<p>Hardened-keys use a master <em>private</em> key and an index >0x80000000 (2^31), denoted with prime notation, <code>k'</code></p>

CC BY-SA 3.0
2015-04-15T07:27:30.407Z
I don't think the OP is asking about BIP32. I made a post on meta about this: http://meta.bitcoin.stackexchange.com/questions/661/what-should-hd-wallet-mean
Nick ODell
CC BY-SA 3.0
2015-04-15T15:47:33.247Z
The offset is generated based on the master public key so if someone has the master public key a lager offset doesn't really help. Am I correct?
abeikverdi
CC BY-SA 3.0
2015-04-15T19:33:56.087Z
The offset is more like adding 12345 after a password. The "offset" isn't anything more than appended data. But essentially, yes, you're right. See the `crack_bip32` function in pybitcointools
Wizard Of Ozzie
CC BY-SA 3.0
2015-04-15T07:17:16.867Z
2015-04-15T07:26:08.397Z
2015-04-15T07:26:08.397Z
Wizard Of Ozzie
<p>In typical HD wallet implementations, some kind of hash of the master public key and the sequence number of the child key is added into the private portion of each child key. This makes the interval between private keys unpredictable to an attacker who does not know the master public key and thus the interval between public keys is likewise unpredictable. With this kind of implementation, no number of child public keys will reveal the master public key and there is no way to tell that accounts are part of the same family with only public information.</p>

<p>You can see the scheme I designed for Ripple <a href="https://wiki.ripple.com/Account_Family#Algorithms" rel="nofollow">here</a>.</p>

CC BY-SA 3.0
2015-04-15T07:00:34.997Z
2015-04-15T07:00:34.997Z
David Schwartz
<p>Hierarchy deterministic wallets have a master public key. I fully understand elliptic curve's concept regarding to the private and public keys.<br/>
I also understand the concept that <a href="https://bitcointalk.org/index.php?topic=19137.0" rel="nofollow">Maxwell</a> described here to generate new public keys without knowing their corresponding private keys by only knowing the master public key.
Based on Maxwell's idea if someone gets two of the children's public keys with some simple math can calculate the master public key which allows him to generate all of the user's future bitcoin addresses. 
So my question is</p>

<ol>
<li>Does HD wallet use the same mechanism explained by Maxwell to generate new public keys?</li>
<li>How does an HD wallet protect its master public key?</li>
</ol>

CC BY-SA 3.0
2015-04-15T06:57:04.813Z
I don't think I've never seen an HD wallet implementation that permitted the master public key to be determined from two child public keys.
David Schwartz
<bip32-hd-wallets>
How does HD wallet protect its master public key?
abeikverdi
# How does HD wallet protect its master public key?

(Asked by: username_0 on 2015-04-15)

Hierarchy deterministic wallets have a master public key. I fully understand elliptic curve's concept regarding to the private and public keys.  
I also understand the concept that [Maxwell](https://bitcointalk.org/index.php?topic=19137.0) described here to generate new public keys without knowing their corresponding private keys by only knowing the master public key.
Based on Maxwell's idea if someone gets two of the children's public keys with some simple math can calculate the master public key which allows him to generate all of the user's future bitcoin addresses.
So my question is

1. Does HD wallet use the same mechanism explained by Maxwell to generate new public keys?
2. How does an HD wallet protect its master public key?

**Tags:** bip32-hd-wallets

> **Comments:**
> **username_1**: I don't think I've never seen an HD wallet implementation that permitted the master public key to be determined from two child public keys.  

---

## 2 answers

### Answer by username_1 on 2015-04-15. Score: 3 | Accepted answer

In typical HD wallet implementations, some kind of hash of the master public key and the sequence number of the child key is added into the private portion of each child key. This makes the interval between private keys unpredictable to an attacker who does not know the master public key and thus the interval between public keys is likewise unpredictable. With this kind of implementation, no number of child public keys will reveal the master public key and there is no way to tell that accounts are part of the same family with only public information.

You can see the scheme I designed for Ripple [here](https://wiki.ripple.com/Account_Family#Algorithms).


---

### Answer by username_2 on 2015-04-15. Score: 0

As outlined [here](https://bitcoinmagazine.com/8396/deterministic-wallets-advantages-flaw/), **non-hardened** BIP32 wallets can be compromised if:

1. The master public key is known
2. A child private key is known

This is because the unknown (offset) - the index - can be brute forced since it's a field of 2^31.

[Diagram from article](https://bitcoinmagazine.com/wp-content/uploads/2013/11/privpub2.png)

Hardened-keys use a master *private* key and an index >0x80000000 (2^31), denoted with prime notation, `k'`

> **Comments:**
> **username_3**: I don't think the OP is asking about BIP32. I made a post on meta about this: http://meta.bitcoin.stackexchange.com/questions/661/what-should-hd-wallet-mean  
> **username_0**: The offset is generated based on the master public key so if someone has the master public key a lager offset doesn't really help. Am I correct?  
> **username_2**: The offset is more like adding 12345 after a password. The "offset" isn't anything more than appended data. But essentially, yes, you're right. See the `crack_bip32` function in pybitcointools  

---

