BIP 0032

From Bitcoin Wiki
Revision as of 19:10, 7 May 2012 by Sipa (talk | contribs)
Jump to: navigation, search

This page describes a BIP (Bitcoin Improvement Proposal).

  BIP: 32
  Title: Hierarchical Deterministic Wallets
  Author: Pieter Wuille
  Status: Draft
  Type: Informational
  Created: 11-02-2012










In the rest of this text we will assume the public key cryptography used in Bitcoin, namely elliptic curve cryptography using the field and curve parameters defined by secp256k1 (,docs_secg). Variables below are either:

  • integers modulo the order of the curve, serialized as 32 bytes, most significant byte first.
  • coordinates of points on the curve, serialized as specified in SEC1: either compressed ([0x02 or 0x03] + 32 byte x coordinate), or uncompressed (0x04 + 32 byte x coordinate + 32 byte y coordinate).
  • byte sequences


Extended keys


We represent an extended private key as (k,c), with k the normal private key, and c the chain code. An extended public key is represented as (K,c), with K the normal public key and c the chain code.

Child key derivation function

We define the child key derivation function CKD((kpar,cpar),n), which takes a parent extended secret key (kpar,cpar) and a 32-bit integer n, to produce a child extended secret key (kn,cn).

To define (kn,cn) = CKD((kpar,cpar),n):

  • call I = HMAC-SHA512(Key=cpar, Data=kpar*G || n), where kpar*G is the public key corresponding to kpar, || is concatenation, and n is encoded as a 32 bits unsigned integer, most significant byte first.
  • kn is equal to IL*kpar.
  • cn is equal to IR.

We also define a version that operates on extended public keys instead of private ones: (Kn,cn) = CKD'((Kpar,cpar),n):

  • call I = HMAC-SHA512(Key=cpar, Data=Kpar || n), where n is encoded a 32 bits unsigned integer, most significant byte first.
  • Kn is equal to IL*Kpar.
  • cn is equal to IR.

Note that the extended public key corresponding to the evaluation of CKD(x,n) is identical to the evaluation of CKD'(X,n), with X the extended public key corresponding to x. Symbolically, CKD(x,n)*G = CKD'(x*G,n). This implies that CKD' can be used to derive all public keys corresponding to the private keys that CKD would find. It cannot be used to retrieve the private keys, however.

The HMAC-SHA512 function is specified in RFC 4231.

The key tree

The next step is cascading several CKD constructions to build a tree. We start with one root, the master extended key m. By evaluating CKD(m,n) for several values of n, we get a number of first-degree derivative nodes. As each of these is again an extended key, CKD can be applied to those as well. To shorten notation, we will write CKD(CKD(CKD(m,n1),n2),n3) as m/n1/n2/n3 now.


Serialization format

Extended public and private keys are serialized as follows:

  • 1 byte: version byte (mainnet: 0x06 public, 0x0C private; testnet: 0xC6 public, 0xCC private)
  • 4 bytes: the first 32 bits of RIPEMD160(SHA256(Kpar)), a "fingerprint" of the parent's key. Note that this corresponds to the first 32 bits of the data in the "address" corresponding to the parent's key.
  • 4 bytes: child number. This is the number n in xn = xpar/n, with xn the key being serialized. This is encoded in MSB order.
  • 32 bytes: the chain code
  • the rest: the normal public or private key serialization (65 or 33 bytes for public keys, 32 or 33 bytes for private keys).

This 74, 75 or 107 byte structure can be encoded like other Bitcoin data in Base58, by first adding 32 checksum bits (derived from the double SHA-256 checksum), and then converting to the Base58 representation. This results in a base58-encoded string of 107, 108 or 152 characters.

Wallet structure




* m/i/0/k corresponds to the k'th keypair of the external chain of account number i of the HDW derived from master m.
* m/i/1/k corresponds to the k'th keypair of the internal chain of account number i of the HDW derived from master m.

Master key generation


  • Generate a seed S of a chosen length (at least 128 bits) from a (P)RNG.
  • Split I into two 32-byte sequences, Il and Ir.
  • Use Il as master secret key, and Ir as master chain code.

Use cases

Full wallet sharing: m


Audits: M


Per-office balances: m/i


Recurrant business-to-business transactions: M/i/0


Unsecure money receiver: M/i/0



Test Vectors

