MASTERING-BITCOIN

One Seed, a Million Keys: HD Wallets

IKey Formulas

Formula	Name	Description
$\text{HMAC-SHA512}(\text{"Bitcoin seed"}, \text{seed}) = I_L \,\\|\, I_R$	Master derivation	$I_L = m$ (master priv key), $I_R = c$ (master chain code)
$M = m \cdot G$	Master public key	Scalar-multiply $m$ by generator point $G$
$\text{CKD}_{\text{normal}}: I = \text{HMAC}(c_{par}, K_{par} \,\\|\, i)$	Normal child derivation	Uses parent public key as HMAC data
$\text{CKD}_{\text{hardened}}: I = \text{HMAC}(c_{par}, k_{par} \,\\|\, i)$	Hardened child derivation	Uses parent private key (requires $i \geq 2^{31}$ )
$k_{child} = (I_L + k_{par}) \bmod n$	Child private key	Sum modulo curve order $n$

IIVisualization 1: The HD Key Tree

Explore how a single master seed branches into an entire tree of keys. Toggle which nodes are hardened (red, lock icon) vs normal (blue). Notice which subtrees can be regenerated from an xpub alone.

⚙ interactive visualization — coming to this page format soon

Reflect: If every top-level node is hardened (the default BIP-44 layout) and you export an xpub at the account level, the server can derive every public address below — but cannot walk back up to compromise other accounts or the master key. What happens if the account level were set to normal instead?

IIIVisualization 2: The 32-bit Index Boundary

The index that selects a child is a 32-bit integer. The top bit flips the derivation mode: indices below $2^{31}$ are normal, indices at or above $2^{31}$ are hardened. Drag the slider to see where your index lands.

⚙ interactive visualization — coming to this page format soon

Notice: The apostrophe notation 0' is just a shorthand for 0x80000000 (i.e., hardened index 0). Some tools use 0h instead because shells mangle apostrophes. The raw integer is the same.

IVVisualization 3: The Catastrophic Reversal Attack

This is why hardened derivation matters. Toggle whether the derivation step is hardened and whether a child private key has leaked, then watch which nodes become compromised.

⚙ interactive visualization — coming to this page format soon

Reflect: The xpub alone leaks nothing beyond public keys. One child private key alone leaks only that child. But xpub + one child private key + normal derivation reverses the CKD math: the attacker subtracts the known HMAC left-half from the leaked child private key (mod $n$ ) to recover the parent private key. Hardened derivation breaks this because the HMAC input uses the parent private key, which the attacker does not have.

VQuiz Questions

Question 1

Your 12-word seed is fed into HMAC-SHA512 with the key string "Bitcoin seed". The 512-bit output is split in half. What do those two halves become?

✅ Correct! $I_L \to m$ and $I_R \to c$ .

❌ Not quite. HMAC-SHA512 produces m and c directly; the public key M is derived afterwards as $m \cdot G$ .

Show solution

Solution:

$\text{HMAC-SHA512}(\text{key} = \text{"Bitcoin seed"},\; \text{data} = \text{seed}) = I_L \,\|\, I_R$

$I_L$ (the left 256 bits) becomes the master private key $m$ .
$I_R$ (the right 256 bits) becomes the master chain code $c$ .
The master public key is then computed separately as $M = m \cdot G$ .

The chain code is the extra entropy that lets the tree be deterministic yet compartmentalized.

Question 2

An e-commerce server is loaded with an xpub derived from the account level. An attacker compromises the server and also obtains the private key for receive address index 7 through a separate leak. All derivation below the account level is normal (non-hardened).

What is the worst-case impact?

✅ Correct! Catastrophic reversal: xpub + one child private key propagates upward and sideways within the normal-derivation region.

❌ Not quite. Under normal derivation, the chain code lets an attacker invert CKD once a single child private key leaks.

Show solution

Solution:

With normal derivation the CKD math is reversible given both halves:

$k_{child} = (I_L + k_{par}) \bmod n \;\;\Longrightarrow\;\; k_{par} = (k_{child} - I_L) \bmod n$

The attacker recomputes $I_L$ from the xpub (they know the chain code and the parent public key), subtracts it from the leaked child private key modulo $n$ , and recovers the parent private key. Once they hold the parent private key and the chain code, they can derive every sibling private key in that subtree.

However, the compromise stops at the first hardened boundary above. Since BIP-44 hardens the purpose, coin-type, and account levels, the master seed and other accounts remain safe.

Question 3

True or False: At a hardened derivation step, you can still export the parent xpub and use it to derive all child public keys on a web server — just like with normal derivation.

✅ Correct! Hardened steps block xpub-based derivation by design — that is how they protect against reversal.

❌ Not quite. Hardened derivation uses the parent private key as HMAC input, which the xpub does not contain.

Show solution

Solution:

False. That is precisely the tradeoff of hardened derivation.

Normal derivation feeds the parent public key into HMAC-SHA512, so anyone with the xpub can derive child public keys without ever touching the private key. This is the "xpub superpower."
Hardened derivation feeds the parent private key into HMAC-SHA512 instead. The xpub does not contain the private key, so child public keys cannot be derived from the xpub alone.

The tradeoff: you lose xpub-based public-key derivation, but you gain isolation against the chain-code-leak attack. That is why BIP-44 uses hardened steps at the top (purpose, coin, account) and normal steps at the leaves (change, address index).

Question 4

Consider the BIP-44 path:

$m / 44' / 0' / 0' / 0 / 5$

Which statement correctly describes what the apostrophes and their absence mean for this path?

✅ Correct! Hardened at the top (isolation), normal at the bottom (xpub-derivable leaves) — that is the BIP-44 security architecture.

❌ Not quite. The apostrophe marks hardened derivation on individual levels. In this path, only the top three have apostrophes.

Show solution

Solution:

The apostrophe (also written as h) marks a hardened index, meaning the raw index has its top bit set (i.e., the index is $\geq 2^{31}$ ).

Breaking down $m / 44' / 0' / 0' / 0 / 5$ :

Segment	Meaning	Mode
`m`	master key	—
`44'`	purpose = BIP-44	hardened
`0'`	coin type = Bitcoin	hardened
`0'`	account 0	hardened
`0`	change (external chain)	normal
`5`	address index 5	normal

Because the account level is hardened, the master key stays isolated from any account-level leak. Because the change and address-index levels are normal, you can export an account-level xpub to a web server and generate unlimited receive addresses at the leaves without exposing any private key — the classic watch-only / e-commerce deployment.

Solved: 0 / 4