<p>A private key is a number, a very big 256 bit number. You can do ordinary arithmetic on such numbers, for example addition modulo n, where n is the order of the curve (someone else will have to expand on that if needed). n is very close to but less than 2^256.</p>

<p>Here's a diagram of the child private key derivation:</p>

<p><a href="https://i.sstatic.net/NK9Vy.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/NK9Vy.png" alt="enter image description here"></a></p>

<p>The left 256 bits of the 512 bit hash is added <em>modulo n</em> to the parent private key. The sum, which is also a 256 bit number (because of modulo n), is the child private key. The sum of the parent private key and a seemingly random 256 bit number is a seemingly random 256 bit number, so that sum will function just fine as a private key.</p>

CC BY-SA 4.0
2018-06-12T10:39:16.170Z
All operations are modulo the curve order N not modulo 2^256
Mike D
CC BY-SA 4.0
2018-06-12T11:06:59.360Z
Thanks, @MikeD. Updated my answer accordingly.
Kalle Rosenbaum
CC BY-SA 4.0
2018-06-12T12:55:46.873Z
From that image we can deduce that childPrivateKey= leftSideHash + parentPrivateKey ?. Correct me if I'm wrong. From that relation where's n or G used?
Eddy
CC BY-SA 4.0
2018-06-12T13:33:17.293Z
@TheOverloadGenius n is used in the addition (addition modulo n). It says "Normal addition" in the figure but it's actually "Normal addition modulo n". Maybe I should add that to the figure. G is not used at all in child private key derivation. It's only used when calculating a public key from a private key.
Kalle Rosenbaum
CC BY-SA 4.0
2018-06-12T07:57:14.350Z
2018-06-12T11:35:10.200Z
2018-06-12T11:35:10.200Z
Kalle Rosenbaum
<p>I was trying to understand the specs on <strong>CKD</strong> function from both the <strong>bip32</strong> standard and Mastering Bitcoin book, I couldn't understand how a private key <em>is derived from the left side of the extended key.</em></p>

<p>The book just says the right side becomes the chain code and the left side becomes the private key, after some research online I read someone using terms like <strong>tweaks</strong> and <strong>modulus n</strong>,  <strong>G</strong> which are confusing me since they were not mentioned in the book and not so much in the specification itself.</p>

<p>Please help me clarify on how exactly <em>a private key is derived from the left side of output</em>, and the relationship with all those non mentioned parts like the <strong>modulus n</strong> (Which  n?), <strong>tweak</strong> (??), <strong>multiply by G</strong> ( What's G?) since all these terms are not well documented.</p>

CC BY-SA 4.0
2018-06-12T10:41:51.267Z
N and G are fixed parameters of the secp256k1 curve. Specifically `N=115792089237316195423570985008687907852837564279074904382605163141518161494337` and `G=(55066263022277343669578718895168534326250603453777594175500187360389116729240, 32670510020758816978083085130507043184471273380659243275938904335757337482424)`
Mike D
<wallet><development><bip32-hd-wallets>
HD Wallet Child Private Key Derivation Function
Eddy
# HD Wallet Child Private Key Derivation Function

(Asked by: username_0 on 2018-06-12)

I was trying to understand the specs on **CKD** function from both the **bip32** standard and Mastering Bitcoin book, I couldn't understand how a private key *is derived from the left side of the extended key.*

The book just says the right side becomes the chain code and the left side becomes the private key, after some research online I read someone using terms like **tweaks** and **modulus n**, **G** which are confusing me since they were not mentioned in the book and not so much in the specification itself.

Please help me clarify on how exactly *a private key is derived from the left side of output*, and the relationship with all those non mentioned parts like the **modulus n** (Which n?), **tweak** (??), **multiply by G** ( What's G?) since all these terms are not well documented.

**Tags:** wallet, development, bip32-hd-wallets

> **Comments:**
> **username_1**: N and G are fixed parameters of the secp256k1 curve. Specifically `N=115792089237316195423570985008687907852837564279074904382605163141518161494337` and `G=(55066263022277343669578718895168534326250603453777594175500187360389116729240, 32670510020758816978083085130507043184471273380659243275938904335757337482424)`  

---

## 1 answers

### Answer by username_2 on 2018-06-12. Score: 2

A private key is a number, a very big 256 bit number. You can do ordinary arithmetic on such numbers, for example addition modulo n, where n is the order of the curve (someone else will have to expand on that if needed). n is very close to but less than 2^256.

Here's a diagram of the child private key derivation:

[![enter image description here](https://i.sstatic.net/NK9Vy.png)](https://i.sstatic.net/NK9Vy.png)

The left 256 bits of the 512 bit hash is added *modulo n* to the parent private key. The sum, which is also a 256 bit number (because of modulo n), is the child private key. The sum of the parent private key and a seemingly random 256 bit number is a seemingly random 256 bit number, so that sum will function just fine as a private key.

> **Comments:**
> **username_1**: All operations are modulo the curve order N not modulo 2^256  
> **username_2**: Thanks, @MikeD. Updated my answer accordingly.  
> **username_0**: From that image we can deduce that childPrivateKey= leftSideHash + parentPrivateKey ?. Correct me if I'm wrong. From that relation where's n or G used?  
> **username_2**: @TheOverloadGenius n is used in the addition (addition modulo n). It says "Normal addition" in the figure but it's actually "Normal addition modulo n". Maybe I should add that to the figure. G is not used at all in child private key derivation. It's only used when calculating a public key from a private key.  

---

