Would it be better to use HKDF or SCrypt for deriving a child key?

Question

Okay so I'm trying to derive a child public key from an EC public key. I've come up with a couple ideas and now I'd like to know which is more secure.

Mp: The master key pair, this includes a private key (denoted Mpri) and an extended public key (denoted Mpub, more on this in a second).

i: Some kind of input from the user, it may or may not be random / high entropy.

P: RIPEMD160 hash of i.

Now there's a CKD (child key derivation) function that will return 512 bits (either from HMAC-SHA512 or SCrypt). The first 256 bits will be the key while the latter 256 bits will be the chain code (denoted as C). The total 512 bits is the extended public key.

I could use HMAC-SHA512(Key = C, Data = P), or I could use SCrypt(Password = P, Salt = C, N = 2^16, p = 1, dLen = 512), or SCrypt(Password = P || c, Salt = null, N = 2^16, p = 1, dLen = 512) to derive the new key from the previous.

There might be multiple child keys for one parent (think multiple leaves per branch) so the value of C might not change while the value of i (and P) does.

Which is the most secure? Would providing other values of N and p make SCrypt a better choice than HMAC-SHA512; if so, what are those values and which SCrypt option is the better of the two? Does the possibility of SCrypt having a repeated salt / no salt make HMAC-SHA512 a better choice?

Answer 1

SCrypt is a Password Based Key Derivation Function or PBKDF. In general you don't need such a function if your input is already a key. In that case you need a Key Based Key Derivation Function - a KBKDF.

Currently the best KBKDF is probably HKDF. This can take a key (e.g. the public key), info (e.g. $i$ or the hash over $i$) and possibly a salt. As it is based on HMAC, there is little need to perform any hashing in advance (so using a specific encoding of $i$ would suffice).

For key material where the bits are fully random you may also just use HKDF-Expand (the first part of HKDF, HKDF-Extract just compresses the random bits in the key material in case they are not well distributed).