2
1
I'm wondering whether disclosing a consecutive number of HD private keys derived from a given master key would allow someone to compute what the next private key in the sequence would be before it is revealed?
So given HD-derived private keys n, n+1, n+2, ..., n+m, can one figure out what is the private key n+m+1?
1
No, this cannot be found out if we assume
(which is a desired property of BIP32 and which I'm going to refer to as Φ describing the problem φ) to be true and assume that n+m <= 2^32 - 2
Assume you have an efficient solver ξ : P^m → P for the problem you described with
P := { a ∈ ℕ | 1 <= a <= 0xFFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFE BAAE DCE6 AF48 A03B BFD2 5E8C D036 4140}
being the set of valid secp256k1 ECDSA standard private keys.
Let Ψ = (r_1, r_2, ..., r_{m+1}) be an instance of a problem impossible to solve efficiently if Φ is true.
Solve φ as follows: If and only if ξ(r_1, r_2, ..., r_m) = r_{m+1}, return true, otherwise return false. This contradicts Φ.
Maybe it would be helpful to explain how the BIP32 key generation algorithm ensures that this property is satisfied. – Nate Eldredge – 2017-03-03T16:15:45.647
This is correct, but only when the extended parent public key is not known (or hardened derivation was used). Otherwise, one can derive the parent private key from the parent public key and 1 child private key, and then just derive the other children from that. Sharing HD private keys is very dangerous for this reason. – Pieter Wuille – 2017-03-03T16:17:12.897