Hardened Keys vs Normal Keys - A Simpler Explanation

Question

I'm trying to better understand hardened keys and normal keys and how the former protects the rest of and HD wallet.

Following on from the answer provided here: ELI5: What's the difference between a child-key and a hardened child-key in BIP32

I'd like to know "how an attacker would be able to work out the private key of the extended public key, and therefore get every key that can be derived from that, hardened and non-hardened." should they manage to "1) gain access to the extended public key and 2) one of the non-hardened private keys that was derived from it"

Thanks in advance!

Probably a duplicate of https://bitcoin.stackexchange.com/questions/56916/derivation-of-parent-private-key-from-non-hardened-child ? — Adam Spiers, Jul 06 '21 at 14:53

Ugam Kamat · Accepted Answer · 2019-05-19T11:27:59.943

A non-hardened private key is derived using the equations shown below. Here small case letter represents private keys and large case represents public keys. G is the generator point, c is the chain code and i is the index number of the key generated. Kpar and cpar together represent the extended public key. kpar and cpar together represents the extended privat key.

k(i) = kpar + hash(Kpar, cpar, i)
rearranging you get, kpar = k(i) - hash(Kpar, cpar, i)

Now, let us say the attacker gets his hands on k(i) and xpub. You can generate public keys without the need of private keys using the xpub with the following equation: K(i) = Kpar + hash(Kpar, cpar, i)*G (check why this equation holds below in Appendix). The attacker is going to increment the index (i) in a loop until it generates the public key associated with k(i). When K(i) = k(i) * G the attacker knows the index number.

Thus with the index in his hand, he can just calculate the kpar from the equation kpar = k(i) - hash(Kpar, cpar, i).

Hardened keys prevent this by using the equation: k(i) = kpar + hash(kpar, cpar, i). So, although you get your hands on the xpub and the k(i), you will not be able to reverse engineer kpar as that variable is in the hash function which is one-way.

Appendix:

we saw above that k(i) = kpar + hash(Kpar, cpar, i)
=> k(i) *G = kpar*g + hash(Kpar, cpar, i)*G
=> K(i) = Kpar + hash(Kpar, cpar, i)*G

Thanks, this is very helpful. It would be even better if you explicitly define `xpub`. — Adam Spiers, Jul 06 '21 at 14:30

Hardened Keys vs Normal Keys - A Simpler Explanation

1 Answers1

Appendix:

Linked