Okay so I'm trying to derive a child public key from an EC public key. I've come up with a couple ideas and now I'd like to know which is more secure.

Mp: The master key pair, this includes a private key (denoted Mpri) and an extended public key (denoted Mpub, more on this in a second).

i: Some kind of input from the user, it may or may not be random / high entropy.

P: RIPEMD160 hash of i.

Now there's a CKD (child key derivation) function that will return 512 bits (either from HMAC-SHA512 or SCrypt). The first 256 bits will be the key while the latter 256 bits will be the chain code (denoted as C). The total 512 bits is the extended public key.

I could use HMAC-SHA512(Key = C, Data = P), or I could use SCrypt(Password = P, Salt = C, N = 2^16, p = 1, dLen = 512), or SCrypt(Password = P || c, Salt = null, N = 2^16, p = 1, dLen = 512) to derive the new key from the previous.

There might be multiple child keys for one parent (think multiple leaves per branch) so the value of C might not change while the value of i (and P) does.

Which is the most secure? Would providing other values of N and p make SCrypt a better choice than HMAC-SHA512; if so, what are those values and which SCrypt option is the better of the two? Does the possibility of SCrypt having a repeated salt / no salt make HMAC-SHA512 a better choice?

  • $\begingroup$ This seems to be used in bitcoin like transactions, a description of the key derivation can be found here $\endgroup$
    – Maarten Bodewes
    Dec 29, 2015 at 14:16
  • $\begingroup$ Yeah, BTC uses HMAC-SHA512 (here); I'm already using SCrypt in other parts of my project so I wanted to know the difference in security. $\endgroup$
    – jamcar23
    Dec 29, 2015 at 17:14

1 Answer 1


SCrypt is a Password Based Key Derivation Function or PBKDF. In general you don't need such a function if your input is already a key. In that case you need a Key Based Key Derivation Function - a KBKDF.

Currently the best KBKDF is probably HKDF. This can take a key (e.g. the public key), info (e.g. $i$ or the hash over $i$) and possibly a salt. As it is based on HMAC, there is little need to perform any hashing in advance (so using a specific encoding of $i$ would suffice).

For key material where the bits are fully random you may also just use HKDF-Expand (the first part of HKDF, HKDF-Extract just compresses the random bits in the key material in case they are not well distributed).

  • $\begingroup$ Note that Bitcoin uses a special construct to derive public keys. Public keys are part of key pairs. I'm not sure if either construct allows you to use the key as planned. $\endgroup$
    – Maarten Bodewes
    Dec 30, 2015 at 2:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.