BA-04 · LESSON 04

HD derivation

A hierarchical deterministic wallet creates many related keys from one root. Bitcoin Improvement Proposal 32 defines normal and hardened child-key paths with different exposure risks.

Key terms in this lesson 7 definitions

HD wallet: Hierarchical deterministic wallet: a wallet that derives many related keys from one root.
xpub: A serialized extended public key containing a public key and chain code for deriving normal public descendants.
BIP32: The Bitcoin standard for deriving a tree of child keys from one extended root key.
HMAC: Hash-based message authentication code: a keyed hash construction used to authenticate data or derive deterministic secret material.
HMAC-SHA512: HMAC using SHA-512; BIP32 uses it to derive a master key and chain code from seed material.
BIP84: The wallet derivation convention for native SegWit single-key outputs.
Descriptor: A machine-readable description of the scripts, keys, and derivation paths a Bitcoin wallet watches or can spend.

Self-paced Intermediate Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · bip32 derivationAn extended key derives a reproducible child branchSelect any state to inspect its exact role.

RELATIONSHIP MAPCommitment and derivation tree

01
PARENTKey K and chain code c
An extended key carries both a curve key and 32 bytes of derivation entropy.
02
INDEXAddress 0 non-hardened
Hardened indices set the high bit and use the parent private scalar as HMAC input.
03
HMACHMAC-SHA512(c, data)
The left half tweaks the key; the right half becomes the child chain code.
04
CHILDPublic or private address derivation
Non-hardened public children can be derived from an extended public key. The changed path hardens the account index, then derives public change and address indices.
05
PATHm/84'/0'/0'/0/0
The path is part of wallet policy. The same seed at another path produces another wallet branch.

Rule shown: BIP32 combines a key, chain code, child index, and HMAC-SHA512; hardened derivation requires private parent material.

STAGE 1 OF 5PARENT: Key K and chain code c

An extended key carries both a curve key and 32 bytes of derivation entropy.

Governing relationship: BIP32 combines a key, chain code, child index, and HMAC-SHA512; hardened derivation requires private parent material. Complete path: 1. PARENT, Key K and chain code c. An extended key carries both a curve key and 32 bytes of derivation entropy. 2. INDEX, Address 0 non-hardened. Hardened indices set the high bit and use the parent private scalar as HMAC input. 3. HMAC, HMAC-SHA512(c, data). The left half tweaks the key; the right half becomes the child chain code. 4. CHILD, Public or private address derivation. Non-hardened public children can be derived from an extended public key. The changed path hardens the account index, then derives public change and address indices. 5. PATH, m/84'/0'/0'/0/0. The path is part of wallet policy. The same seed at another path produces another wallet branch.

1. State transitionWhat exists, what changes, and what results

BEFORE

Interpret m/84'/0'/2'/1/5 for a common single-signature mainnet wallet.

MECHANISM

BIP32 applies a Hash-based Message Authentication Code using Secure Hash Algorithm 512, shortened to HMAC-SHA512, to seed material to produce a master private key and chain c…

AFTER

A seed can generate the same tree only when the derivation scheme and script policy are also known.

Text equivalent: Starting from Interpret m/84'/0'/2'/1/5 for a common single-signature mainnet wallet. The mechanism begins when BIP32 applies a Hash-based Message Authentication Code using Secure Hash Algorithm 512, shortened to HMAC-SHA512, to seed material to produce a master private key and chain code. The resulting lesson is A seed can generate the same tree only when the derivation scheme and script policy are also known.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 5

Create the master node

BIP32 applies a Hash-based Message Authentication Code using Secure Hash Algorithm 512, shortened to HMAC-SHA512, to seed material to produce a master private key and chain code.

Complete path: 1. Create the master node: BIP32 applies a Hash-based Message Authentication Code using Secure Hash Algorithm 512, shortened to HMAC-SHA512, to seed material to produce a master private key and chain code. 2. Derive child nodes: For a normal child, HMAC-SHA512 receives the compressed parent public key, child index, and parent chain code. Its left half is a scalar tweak: child private key equals parent private key plus tweak modulo the curve order; the right half is the child chain code. 3. Choose hardened boundaries: Normal public derivation permits an extended public key to derive descendant public keys. Hardened derivation blocks that public-only path. 4. Follow wallet path conventions: Wallet standards assign path levels to purpose, coin type, account, change branch, and address index. Recovery needs the convention as well as the seed. 5. Understand normal-child recovery: A parent xpub reveals the public key and chain code, so anyone can recompute a normal child's tweak. If that child private key leaks, parent private key equals child private key minus the tweak modulo the curve order. Hardened derivation prevents public-only tweak computation.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

Each path component is parsed below 2³¹; normal public descent is available from an xpub while hardened descent requires private parent data.

CHANGED CONDITION

A parent xpub plus one leaked normal-child private key can expose the parent key, while the same public data cannot cross a hardened boundary.

Important distinction: The mnemonic alone always tells recovery software which addresses to scan. The same seed supports many paths and output types. Recovery may require purpose, account, branch, gap assumptions, and descriptor information.

Text equivalent: The accepted path is enforced by Each path component is parsed below 2³¹; normal public descent is available from an xpub while hardened descent requires private parent data. If the required condition changes, A parent xpub plus one leaked normal-child private key can expose the parent key, while the same public data cannot cross a hardened boundary.

Loading lesson visuals...

Learn the idea

An HD wallet is hierarchical deterministic: it derives a tree of child keys from one root seed. BIP32 extended keys combine key material with a 32-byte chain code. An xpub is a serialized extended public key containing a public key plus chain code; it can derive normal public descendants but not hardened children. A derivation path such as m/84'/0'/0'/0/5 names a route through the tree. A hardened child, marked with an apostrophe, uses private parent data and cannot be derived from only the parent xpub.

GUIDED EXPLANATION1/5 ideas inspected

Create the master node

BIP32 applies a Hash-based Message Authentication Code using Secure Hash Algorithm 512, shortened to HMAC-SHA512, to seed material to produce a master private key and chain code.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“The mnemonic alone always tells recovery software which addresses to scan.”

The same seed supports many paths and output types. Recovery may require purpose, account, branch, gap assumptions, and descriptor information.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.