<p>Review <a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki" rel="nofollow noreferrer">BIP32</a>:</p>
<blockquote>
<p>The fact that they are equivalent is what makes non-hardened keys
useful (one can derive child public keys of a given parent key without
knowing any private key), and also what distinguishes them from
hardened keys. The reason for not always using non-hardened keys
(which are more useful) is security; see further for more information.</p>
</blockquote>
<p>That little apostrophe <code>'</code> means that branch of the key derivation tree is &quot;hardened&quot; -- and THAT means that you must have the private key to derive its child keys.</p>
<p>So if you have the PRIVATE key for <code>m/84'/0'/0'</code> you can generate child keys for example <code>m/84'/0'/0'/0</code> or <code>m/84'/0'/0'/0'</code> (these are two different keys, one is hardened the other is not).</p>
<p>If you were to derive the non-hardened key at <code>m/84'/0'/0'/0</code> then you could use an xpub FROM THIS KEY (not any of the parent keys) to derive public child keys, without any private keys. Examples would be <code>m/84'/0'/0'/0/0</code> and <code>m/84'/0'/0'/0/1</code></p>

CC BY-SA 4.0
2020-12-19T13:33:57.550Z
Thanks a lot for your answer. Just another precision: If I have ONLY the xpub key of the top account (the xpub key than can be exported from a Ledger wallet for instance),  it is not possible to get the xpub key at m/84'/0'/0' with btclib derive function so. But can I get the xpub key at  m/84'/0'/0'/0 (or m/84'/0'/0'/1) ?
Guillaume Paris
CC BY-SA 4.0
2020-12-20T03:10:13.990Z
See https://github.com/bitcoin/bips/blob/master/bip-0084.mediawiki#public-key-derivation The xpub you get from a Ledger is (I'm pretty sure) at the account level. Meaning from there you can derive change and receive addresses like `m/84'/0'/0'/0/0`. What you should try with your library is to take the xpub and just derive the last two levels: `xpub/0/0`
pinhead
CC BY-SA 4.0
2020-12-20T11:29:31.317Z
More precisely bip32.derive("xpub...","/0") for receive addresses
Guillaume Paris
CC BY-SA 4.0
2020-12-18T16:47:49.550Z
2020-12-18T16:47:49.550Z
pinhead
<p>I woud like to obtain an extended public key of a derivation path (m/84'/0'/0').
I'm using btclib, and I have the xpub of the root account.</p>
<p>When I try to use <code>bip32.derive(&quot;xpub...&quot;,&quot;m/84'/0'/0'&quot;)</code></p>
<p>I get <code>btclib.exceptions.BTClibValueError: invalid hardened derivation from public key</code></p>
<p>What am I doing wrong ?</p>

<bip32-hd-wallets>
Derive public key from xpub?
Guillaume Paris
# Derive public key from xpub?

(Asked by: username_0 on 2020-12-18)

I woud like to obtain an extended public key of a derivation path (m/84'/0'/0').
I'm using btclib, and I have the xpub of the root account.

When I try to use `bip32.derive("xpub...","m/84'/0'/0'")`

I get `btclib.exceptions.BTClibValueError: invalid hardened derivation from public key`

What am I doing wrong ?

**Tags:** bip32-hd-wallets


---

## 1 answers

### Answer by username_1 on 2020-12-18. Score: 2 | Accepted answer

Review [BIP32](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki):

> The fact that they are equivalent is what makes non-hardened keys
> useful (one can derive child public keys of a given parent key without
> knowing any private key), and also what distinguishes them from
> hardened keys. The reason for not always using non-hardened keys
> (which are more useful) is security; see further for more information.

That little apostrophe `'` means that branch of the key derivation tree is "hardened" -- and THAT means that you must have the private key to derive its child keys.

So if you have the PRIVATE key for `m/84'/0'/0'` you can generate child keys for example `m/84'/0'/0'/0` or `m/84'/0'/0'/0'` (these are two different keys, one is hardened the other is not).

If you were to derive the non-hardened key at `m/84'/0'/0'/0` then you could use an xpub FROM THIS KEY (not any of the parent keys) to derive public child keys, without any private keys. Examples would be `m/84'/0'/0'/0/0` and `m/84'/0'/0'/0/1`

> **Comments:**
> **username_0**: Thanks a lot for your answer. Just another precision: If I have ONLY the xpub key of the top account (the xpub key than can be exported from a Ledger wallet for instance),  it is not possible to get the xpub key at m/84'/0'/0' with btclib derive function so. But can I get the xpub key at  m/84'/0'/0'/0 (or m/84'/0'/0'/1) ?  
> **username_1**: See https://github.com/bitcoin/bips/blob/master/bip-0084.mediawiki#public-key-derivation The xpub you get from a Ledger is (I'm pretty sure) at the account level. Meaning from there you can derive change and receive addresses like `m/84'/0'/0'/0/0`. What you should try with your library is to take the xpub and just derive the last two levels: `xpub/0/0`  
> **username_0**: More precisely bip32.derive("xpub...","/0") for receive addresses  

---

