2
I know I can sign a piece of text using a bitcoin private key to prove control over a public address but are there any operations I can perform to know if a public key submitted to me was derived from a parent public key if I do not have any private keys at my disposal?
I have looked at: https://github.com/richardkiss/pycoin and https://github.com/jmcorgan/bip32utils but have not yet found a way to do it.
Thank you for any input :)
5
Yes, you can, assuming that the child key isn't hardened, and you know the chain code of the parent public key and the index of the child. (Also known as the extended public key.)
Just compute
CKDpub((Kpar, cpar), i) → (Ki, ci)
Kpar is the parent public key, cpar is the chain code, i is the index, and Ki is the child public key
as defined here and compare it to the child key you were given.
Woohoo, thanks so much :) Needing to know the index is a bit of a bummer though because if I didn't know it then I would be forced to generate each child key from index 0 until I found the matching one, Am I correct in assuming this or could the index number be embedded in the key somehow? – derrend – 2015-04-28T01:39:57.683
@derrend You're correct. You only need to try 2^31 keys at most, though, so it's not too bad. – Nick ODell – 2015-04-28T01:50:03.207
reading again over the link you gave me earlier, is there a method of achievig this using 'gmaxwell's proposal' and would it be more efficient? – derrend – 2015-04-28T04:35:29.803
@derrend 1) Yes 2) It's probably about the same in terms of speed and complexity. – Nick ODell – 2015-04-28T04:38:25.900
Can you link me to some info if possible, I'd be interested see how it's done :) – derrend – 2015-04-28T04:40:03.233
@derrend This is the best resource I know of: https://bitcointalk.org/index.php?topic=19137.0
Are you asking about BIP32 or deterministic type 2 wallets? See also: http://meta.bitcoin.stackexchange.com/questions/661/what-should-hd-wallet-mean
– Nick ODell – 2015-04-28T01:06:16.077Yes I am but one specific use case in particular involving public key verification as described above, I'm hoping @Pieter Wuille (sipa) will see this question. Thank you for the link, I will check it out :) – derrend – 2015-04-28T01:10:14.443
Right, but which one are you asking about? – Nick ODell – 2015-04-28T01:12:09.063
I'm only asking if it is possible to know that a child private key came from it's parent in the absence of any secret keys and what the method would be to do it. If this is BIP32 deterministic wallet then yes I suppose this is what I am asking about :) – derrend – 2015-04-28T01:19:02.363