# Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?

I have a following use case:

User has his master public (sk) - private (pk) key pair (Ed25519). In DB we store a public key. Is there any derivation mechanism D, where when knowing a derivation parameter x we can use it derive a new private key sk2 = D(sk, x) and public key (knowing only public key in DB): pk2 = Dx(pk, x) such that we can verify signature done by sk2 using pkd2 ?

In other words, I would like to have a derivation mechanism I can use on the user side and server side, where server doesn't know private key. Best if it works with Ed25519 keys.

Yes! You can use the ephemeral key derivation mechanism that is for example used in Monero (they call it stealth keys there).

Consider public key $$A=aG$$, with private key $$a$$. Then, a derived key can be generated, parametrised by the random scalar $$r$$:

$$A'=H_s(rA)G+A$$

and the party that knows $$a$$ can use the public parameter $$R=rG$$ to compute their ephemeral private key $$a'=H_s(aR)+a$$. You can for example store $$R$$ with your signature.

Note 1: We add $$A$$ resp. $$a$$ to the public resp. private key to ensure that the party that derives a key cannot compute the private key.

Note 2: This derivation is basically a Diffie-Hellman key exchange with a random ephemeral key $$R$$.

Note 3: $$R$$ can also be used to "check" whether the user has access to this specific key. He just needs to check whether $$A'=H_s(aR)+A$$ holds.

Yes, this is possible using Hierarchical Deterministic (HD) Keys. There are 2 variations for key generation, hardened and non-hardened. In hardened, generating child keys (both public and private) requires knowledge of parent private key but in non-hardened, child public key can be generated using parent public key. You need non-hardened key generation. The cryptocurrency Cardano does this for ed25519 keys, here is their doc with more explanation. It is based on this paper.