# Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?

I have a following use case:

User has his master public (pk) - private (sk) key pair (Ed25519). In DB we store a public key. Is there any derivation mechanism D, where when knowing a derivation parameter x we can use it derive a new private key sk2 = D(sk, x) and public key (knowing only public key in DB): pk2 = Dx(pk, x) such that we can verify signature done by sk2 using pk2 ?

In other words, I would like to have a derivation mechanism I can use on the user side and server side, where server doesn't know private key. Best if it works with Ed25519 keys.

• There is the prior art of "implicit certificate", SEC #4 of secg.org although I'm not sure if there's a equivalent in Edward curve. Nov 17 '20 at 7:18

Yes! You can use the ephemeral key derivation mechanism that is for example used in Monero (they call it stealth keys there).

Consider public key $$A=aG$$, with private key $$a$$. Then, a derived key can be generated, parametrised by the random scalar $$r$$:

$$A'=H_s(rA)G+A$$

and the party that knows $$a$$ can use the public parameter $$R=rG$$ to compute their ephemeral private key $$a'=H_s(aR)+a$$. You can for example store $$R$$ with your signature.

Note 1: We add $$A$$ resp. $$a$$ to the public resp. private key to ensure that the party that derives a key cannot compute the private key.

Note 2: This derivation is basically a Diffie-Hellman key exchange with a random ephemeral key $$R$$.

Note 3: $$R$$ can also be used to "check" whether the user has access to this specific key. He just needs to check whether $$A'=H_s(aR)+A$$ holds.

• What is $H_s$? Is it a hash function? Feb 14 at 19:04
• Yes, it's specifically the hash function that maps onto the field; typically a hash function maps on a bit string $\{0, 1\}^b$. It's mostly a semantic detail though. Feb 15 at 16:47

Yes, this is possible using Hierarchical Deterministic (HD) Keys. There are 2 variations for key generation, hardened and non-hardened. In hardened, generating child keys (both public and private) requires knowledge of parent private key but in non-hardened, child public key can be generated using parent public key. You need non-hardened key generation. The cryptocurrency Cardano does this for ed25519 keys, here is their doc with more explanation. It is based on this paper.