- Password-Based Key Derivation Function 2
- 2048 rounds of HMAC-SHA512
- Password: mnemonic sentence
- Salt: "mnemonic" + passphrase
- (Password & salt encoded in UTF-8 NFKD)
- 512-bit hash digest
- Seed for the creation of a wallet
Hierarchical Deterministic Wallets (BIP32)
- HD wallets (BIP32) can deterministically derive an indefinite number of fresh addresses
from a single wallet secret.
- HD Tree
- Fresh addresses to improve privacy.
- HD Tree is derived from Master Keys.
- HD Tree can be reconstructed from master Keys (given tree structure).
- Master keys
- Derived from HD root secret.
- Allow separation of keys for accounts/usages.
- Selective key sharing.
Master Key Pair Derivation
- The master key pair is dervied from the HD root secret, and together with the chaincode,
provides the basis for deriving subsequent child key generations.
- 512 bit hash digest is split into
left and right 256 bits.
- Right 256 bits are chaincode, used in
child key derivation.
Child Key Pair Derivation
- Hierarchical deterministic (child) private keys are derived from parent private keys.
- HMAC SHA512
- Key: Parent chaincode
- Data: Parent public Key || Index
- Addition of two 256bit scalars
- Private key + L256
- Result: Child private key
- Parent public key to child public key
- HD child public key derivation
without parent private key.
HD Derivation Paths
- Parent-to-child derivation
- Parent private to child private key
- Parent public to child public key
- Firewall between private and public
key derivation paths
- Creation of new addresses can be delegated safely.
- Example: Creation of new receiving addresses by frontend.
- XPRV & XPUB keys
- + Private or public key
Hardened HD Key Path
- Hardened Child Keys break XPUB derivation paths
- Hardened keys denoted with prime′
- Although the parent keys are hardened, note that children keys
mustn't necessarily be hardened, as shown here.
- This means the child XPUB keys in this example can derive grandchildren XPUB keys.
- Note: In the case of key exposure in any of the subsequent child generations,
the upstream key exposure cannot propgate up to the hardened parent key.
HD Wallet Tree Structure (BIP44/43)
- ➊ Purpose
- Always set to a hardened 44′ (BIP44/43).
- ➋ Network
- ➌ Account
- Individual Wallet Accounts.
- ➍ Receiving/Change Addresses
- Keys of receiving address: 0 (unhardened)
- Keys of change address: 1 (unhardened)
- ➎ Address Index