BA-04 · LESSON 12

HD wallet trees and extended-key anatomy

KEY DEFINITIONS

Terms used in this lesson

HD wallet: Hierarchical deterministic wallet: a wallet that derives many related keys from one root.
xpub: A serialized extended public key containing a public key and chain code for deriving normal public descendants.
BIP44: A hierarchical wallet path convention originally used for legacy single-key Bitcoin addresses.
BIP49: A hierarchical wallet path convention for single-key SegWit outputs nested inside P2SH.
BIP84: The wallet derivation convention for native SegWit single-key outputs.
BIP86: A hierarchical wallet path convention for single-key Taproot outputs.
BIP32: The Bitcoin standard for deriving a tree of child keys from one extended root key.
SegWit: Segregated Witness: a Bitcoin upgrade that separates authorization data from the transaction identifier and introduces versioned witness programs.
Taproot: A Bitcoin output and spending design that can combine a public-key path with privately committed alternative scripts.
HMAC: Hash-based message authentication code: a keyed hash construction used to authenticate data or derive deterministic secret material.
HMAC-SHA512: HMAC using SHA-512; BIP32 uses it to derive a master key and chain code from seed material.
P2PKH: Pay to Public Key Hash, a legacy Bitcoin output template that commits to the hash of a public key.
P2WPKH: Pay to Witness Public Key Hash: a native SegWit output for one public-key hash.
Descriptor: A machine-readable description of the scripts, keys, and derivation paths a Bitcoin wallet watches or can spend.

Decode xpub and xprv fields, derive BIP44, BIP49, BIP84, and BIP86 branches, and identify what recovery metadata and public-key exposure imply.

65 min Difficulty 2/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · extended key treeAn extended key carries tree position, chain code, and key dataSelect any state to inspect its exact role.

RELATIONSHIP MAPOrdered mechanism flow

01
78-BYTE PAYLOADVersion, depth, parent, child
Extended-key fields identify network, key type, and tree position.
02
CHAIN CODE32 bytes
The chain code keys HMAC-SHA512 and changes every descendant.
03
KEY DATAXpub point or xprv scalar
Public and private extended keys expose different derivation capabilities.
04
PATHm/84'/0'/0'/0/5
Purpose changes native SegWit into single-key Taproot policy.
05
RECOVERYSeed, passphrase, and policy
A correct seed can still restore an apparently empty wallet under the wrong policy.

Rule shown: BIP32 derivation and wallet purpose paths must be preserved together for recovery and privacy.

STAGE 1 OF 578-BYTE PAYLOAD: Version, depth, parent, child

Extended-key fields identify network, key type, and tree position.

Governing relationship: BIP32 derivation and wallet purpose paths must be preserved together for recovery and privacy. Complete path: 1. 78-BYTE PAYLOAD, Version, depth, parent, child. Extended-key fields identify network, key type, and tree position. 2. CHAIN CODE, 32 bytes. The chain code keys HMAC-SHA512 and changes every descendant. 3. KEY DATA, Xpub point or xprv scalar. Public and private extended keys expose different derivation capabilities. 4. PATH, m/84'/0'/0'/0/5. Purpose changes native SegWit into single-key Taproot policy. 5. RECOVERY, Seed, passphrase, and policy. A correct seed can still restore an apparently empty wallet under the wrong policy.

1. State transitionWhat exists, what changes, and what results

BEFORE

This common path names native SegWit on Bitcoin mainnet.

MECHANISM

Read four version bytes, one depth byte, four parent-fingerprint bytes, four child-number bytes, a 32-byte chain code, and 33 bytes of public or private key data before valid…

AFTER

The tree is deterministic only when key material, chain code, path, network, and script policy all match.

Text equivalent: Starting from This common path names native SegWit on Bitcoin mainnet. The mechanism begins when Read four version bytes, one depth byte, four parent-fingerprint bytes, four child-number bytes, a 32-byte chain code, and 33 bytes of public or private key data before validating Base58Check. The resulting lesson is The tree is deterministic only when key material, chain code, path, network, and script policy all match.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 5

Decode the 78-byte payload

Read four version bytes, one depth byte, four parent-fingerprint bytes, four child-number bytes, a 32-byte chain code, and 33 bytes of public or private key data before validating Base58Check.

Complete path: 1. Decode the 78-byte payload: Read four version bytes, one depth byte, four parent-fingerprint bytes, four child-number bytes, a 32-byte chain code, and 33 bytes of public or private key data before validating Base58Check. 2. Derive normal children: Normal derivation feeds the compressed parent public key and child index into HMAC-SHA512 keyed by the chain code. An xpub can derive these public descendants. 3. Derive hardened children: A hardened index sets the high bit and feeds zero plus the parent private scalar into HMAC-SHA512. Public parent data alone cannot derive that branch. 4. Interpret common purpose paths: BIP44 uses purpose 44 for legacy P2PKH, BIP49 uses 49 for nested P2WPKH, BIP84 uses 84 for native P2WPKH, and BIP86 uses 86 for single-key Taproot. 5. Recover policy, not only keys: Seed, optional passphrase, network coin type, account, branch, script purpose, gap assumptions, and descriptors jointly determine which outputs the wallet finds.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

Every derivation checks index type, HMAC result, scalar validity, point validity, version, network, and complete path policy before exposing a child.

CHANGED CONDITION

Combining a parent xpub with one leaked normal-child private key can expose the parent private key. The same public data cannot compute a hardened child tweak.

Important distinction: An xpub is only one address and is harmless to publish. An xpub can reveal an entire normal public branch, future addresses, balances, and transaction links. In some leakage combinations it also threatens parent private material.

Text equivalent: The accepted path is enforced by Every derivation checks index type, HMAC result, scalar validity, point validity, version, network, and complete path policy before exposing a child. If the required condition changes, Combining a parent xpub with one leaked normal-child private key can expose the parent private key. The same public data cannot compute a hardened child tweak.

Loading lesson visuals...

Learn the idea

An extended key contains version, depth, parent fingerprint, child number, chain code, and key data. Its Base58Check text is commonly called xpub or xprv, although other prefixes can encode different script conventions. BIP32 defines derivation mathematics. BIP44, BIP49, BIP84, and BIP86 define common purpose paths for legacy, nested SegWit, native SegWit, and Taproot wallets.

GUIDED EXPLANATION1/5 ideas inspected

Decode the 78-byte payload

Read four version bytes, one depth byte, four parent-fingerprint bytes, four child-number bytes, a 32-byte chain code, and 33 bytes of public or private key data before validating Base58Check.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“An xpub is only one address and is harmless to publish.”

An xpub can reveal an entire normal public branch, future addresses, balances, and transaction links. In some leakage combinations it also threatens parent private material.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.