I have a following use case:

User has his master public (pk) - private (sk) key pair (Ed25519). In DB we store a public key. Is there any derivation mechanism D, where when knowing a derivation parameter x we can use it derive a new private key sk2 = D(sk, x) and public key (knowing only public key in DB): pk2 = Dx(pk, x) such that we can verify signature done by sk2 using pk2 ?

In other words, I would like to have a derivation mechanism I can use on the user side and server side, where server doesn't know private key. Best if it works with Ed25519 keys.

  • $\begingroup$ There is the prior art of "implicit certificate", SEC #4 of secg.org although I'm not sure if there's a equivalent in Edward curve. $\endgroup$
    – DannyNiu
    Nov 17 '20 at 7:18

Yes! You can use the ephemeral key derivation mechanism that is for example used in Monero (they call it stealth keys there).

Consider public key $A=aG$, with private key $a$. Then, a derived key can be generated, parametrised by the random scalar $r$:


and the party that knows $a$ can use the public parameter $R=rG$ to compute their ephemeral private key $a'=H_s(aR)+a$. You can for example store $R$ with your signature.

Note 1: We add $A$ resp. $a$ to the public resp. private key to ensure that the party that derives a key cannot compute the private key.

Note 2: This derivation is basically a Diffie-Hellman key exchange with a random ephemeral key $R$.

Note 3: $R$ can also be used to "check" whether the user has access to this specific key. He just needs to check whether $A'=H_s(aR)+A$ holds.

  • $\begingroup$ What is $H_s$? Is it a hash function? $\endgroup$ Feb 14 at 19:04
  • $\begingroup$ Yes, it's specifically the hash function that maps onto the field; typically a hash function maps on a bit string $\{0, 1\}^b$. It's mostly a semantic detail though. $\endgroup$ Feb 15 at 16:47

Yes, this is possible using Hierarchical Deterministic (HD) Keys. There are 2 variations for key generation, hardened and non-hardened. In hardened, generating child keys (both public and private) requires knowledge of parent private key but in non-hardened, child public key can be generated using parent public key. You need non-hardened key generation. The cryptocurrency Cardano does this for ed25519 keys, here is their doc with more explanation. It is based on this paper.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.