Glossary / Addresses & keys
Child key
Also known as Child public key, Child private key.
- Definition
- A child key comes out of a derivation step rather than a random number generator, identified by the index its parent used to produce it.
Specified in BIP-32.
Nothing about a child key is weaker than the key above it. A child is a full 256-bit private key with a chain code of its own, able to sign transactions and to have children in turn. The word describes a position in a tree, and in a standard wallet the keys actually holding your coins sit five levels down from the root.
How it works
Deriving a child takes one hash and one addition. The parent's chain code becomes the key to HMAC-SHA512, the data is the parent key material followed by a four-byte index, and the 64-byte result splits in half. The right 32 bytes become the child's chain code. The left 32 bytes are added to the parent private key, modulo the order of the secp256k1 curve, and the sum is the child private key.
That addition is why public derivation is possible at all. Adding a number to a private key corresponds to adding a point to the public key, so software holding only the public side can compute the same child public key without ever seeing a secret. BIP-32 also covers the case where the hash output falls outside the valid range, which it puts at a probability below 1 in 2 to the power of 127, and the instruction is to skip that index and move to the next.
Siblings give nothing away. Two children of one parent share nothing an observer can spot from their addresses, which is what makes a fresh address per payment worth doing. The relationship is recoverable only by somebody holding the parent extended public key.
Where you see it
Child keys are what a wallet is actually built from, so you meet them as index numbers rather than as keys.
Open a coin control screen in Sparrow or Electrum and every address carries its path: m/84'/0'/0'/0/7 is the eighth receiving address of the first account, counting from zero. Confirm a withdrawal on a Trezor or a Ledger and the device prints that same path next to the address, which is how you check the destination belongs to your own tree rather than to whoever compromised the computer.
Depth is worth reading too. The master key sits at depth 0, and under a BIP-44 style path the key that signs for a payment sits at depth 5. Every level between them is a child of the one above and a parent to the one below, so both words describe a relationship rather than a rank.
One habit follows from all of this. Never export an individual child private key from an HD wallet unless you intend to abandon the branch entirely. A non-hardened child private key combined with the parent extended public key reveals the parent extended private key, so a single careless export can surrender a whole account rather than one address.
Child key vs parent key
A child key and a parent key are the same kind of object viewed from opposite ends of one derivation step. Every key except the master is somebody's child, and every key that has been derived from is somebody's parent, so a node at m/84'/0'/0' is both at once. The asymmetry lies in what each can compute. A parent derives its children endlessly, while a child on its own says nothing about the key above it. That one-way property is the entire security model of the tree, and hardened derivation is what keeps it one-way.