# Would it be better to use HKDF or SCrypt for deriving a child key?

Okay so I'm trying to derive a child public key from an EC public key. I've come up with a couple ideas and now I'd like to know which is more secure.

Mp: The master key pair, this includes a private key (denoted Mpri) and an extended public key (denoted Mpub, more on this in a second).

i: Some kind of input from the user, it may or may not be random / high entropy.

P: RIPEMD160 hash of i.

Now there's a CKD (child key derivation) function that will return 512 bits (either from HMAC-SHA512 or SCrypt). The first 256 bits will be the key while the latter 256 bits will be the chain code (denoted as C). The total 512 bits is the extended public key.

I could use HMAC-SHA512(Key = C, Data = P), or I could use SCrypt(Password = P, Salt = C, N = 2^16, p = 1, dLen = 512), or SCrypt(Password = P || c, Salt = null, N = 2^16, p = 1, dLen = 512) to derive the new key from the previous.

There might be multiple child keys for one parent (think multiple leaves per branch) so the value of C might not change while the value of i (and P) does.

Which is the most secure? Would providing other values of N and p make SCrypt a better choice than HMAC-SHA512; if so, what are those values and which SCrypt option is the better of the two? Does the possibility of SCrypt having a repeated salt / no salt make HMAC-SHA512 a better choice?

• This seems to be used in bitcoin like transactions, a description of the key derivation can be found here – Maarten Bodewes Dec 29 '15 at 14:16
• Yeah, BTC uses HMAC-SHA512 (here); I'm already using SCrypt in other parts of my project so I wanted to know the difference in security. – jamcar23 Dec 29 '15 at 17:14

Currently the best KBKDF is probably HKDF. This can take a key (e.g. the public key), info (e.g. $$i$$ or the hash over $$i$$) and possibly a salt. As it is based on HMAC, there is little need to perform any hashing in advance (so using a specific encoding of $$i$$ would suffice).