Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?

Question

I have a following use case:

User has his master public (pk) - private (sk) key pair (Ed25519). In DB we store a public key. Is there any derivation mechanism D, where when knowing a derivation parameter x we can use it derive a new private key sk2 = D(sk, x) and public key (knowing only public key in DB): pk2 = Dx(pk, x) such that we can verify signature done by sk2 using pk2 ?

In other words, I would like to have a derivation mechanism I can use on the user side and server side, where server doesn't know private key. Best if it works with Ed25519 keys.

Answer 1

Yes! You can use the ephemeral key derivation mechanism that is for example used in Monero (they call it stealth keys there).

Consider public key $A=aG$, with private key $a$. Then, a derived key can be generated, parametrised by the random scalar $r$:

$$A'=H_s(rA)G+A$$

and the party that knows $a$ can use the public parameter $R=rG$ to compute their ephemeral private key $a'=H_s(aR)+a$. You can for example store $R$ with your signature.

---

Note 1: We add $A$ resp. $a$ to the public resp. private key to ensure that the party that derives a key cannot compute the private key.

Note 2: This derivation is basically a Diffie-Hellman key exchange with a random ephemeral key $R$.

Note 3: $R$ can also be used to "check" whether the user has access to this specific key. He just needs to check whether $A'=H_s(aR)+A$ holds.

Answer 2

Yes, this is possible using Hierarchical Deterministic (HD) Keys. There are 2 variations for key generation, hardened and non-hardened. In hardened, generating child keys (both public and private) requires knowledge of parent private key but in non-hardened, child public key can be generated using parent public key. You need non-hardened key generation. The cryptocurrency Cardano does this for ed25519 keys, here is their doc with more explanation. It is based on this paper.