11
$\begingroup$

Bitcoin's HD (Hierarchical Deterministic) Keys as described in BIP32 allow for a master key to be created (a private key and a chain code) such that a tree of both public and private keys can be derived from a master key, each which can have additional keys derived from it. In addition, some of hierarchy can be 'hardened' to prevent further children from being created.

Bitcoin's HD Keys allow for some fairly powerful functionality in Bitcoin and address a number of important use cases, including key storage UX innovations, auditability, etc. There are also related schemes such as 'pay to contract' that use similar cryptographic approaches that HD keys use.

However, Bitcoin's curve (secp256k1) is not considered to be fully 'safe'.

The most popular safe curve 25519 unfortunately requires secret keys to have specific bits to be set and unset, making them incompatible with the linearity that BIP32 and related schemes (pay to contract) require.

Are any of the other 'safe' curves linear and thus allow for HD Key functionality?

Improve this question
$\endgroup$
4
  • $\begingroup$ Library requests are off topic here, so I removed that part. $\endgroup$
    – otus
    Commented Dec 18, 2015 at 11:00
  • 1
    $\begingroup$ "equires secret keys to have specific bits to be set and unset" - This is what Bernstein requires you to do. This however is fully independent of Curve25519 and you can use that with any curve. If you don't need to be 100% compliant in that department (after all who knows that you broke the rules? - only you) you can drop the requirement (quite) safely. $\endgroup$
    – SEJPM
    Commented Dec 19, 2015 at 14:05
  • $\begingroup$ You need to set those bits crypto.stackexchange.com/questions/12425/… $\endgroup$
    – Christopher Allen
    Commented Dec 21, 2015 at 3:27
  • $\begingroup$ Does anyone know if curve 41417 has similar bits unset? $\endgroup$
    – Christopher Allen
    Commented Dec 21, 2015 at 4:36

1 Answer 1

Reset to default
4
$\begingroup$

Jason Law and Dmitry Khovratovich published a paper on how to do this with the Ed25519 curve. http://ieeexplore.ieee.org/document/7966967/?reload=true

I don't know for sure if this exact method can be applied to curve 41417 but I bet with further research it probably could.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.