Parent Key (HD Wallet)

2 min read

Pronunciation

[pair-uhnt kee]

Analogy

Think of a parent key as a branch on a family tree from which smaller branches (child keys) directly grow. Just as genetic information flows from parents to children in a family, cryptographic information flows from parent keys to child keys in predetermined ways. And just as you can trace your ancestry through your parents and grandparents, you can trace any key in an back to its parent keys, ultimately leading to the master key (the trunk of the tree).

Definition

A in a from which child keys are mathematically derived. Parent keys combine with chain codes and indices to generate children, creating a tree-like structure of keys that enables organization, compartmentalization, and single-seed backup for numerous addresses.

Key Points Intro

Parent keys serve as cryptographic anchors in hierarchical key structures with several important properties.

Key Points

Derivation source: Provides the base key material from which child keys are mathematically generated.

Hierarchical positioning: May simultaneously be a child of a higher-level key and a parent to lower-level keys.

Recovery capability: Possessing a parent key and its chain code allows regeneration of all its non-hardened children.

Access control boundaries: Can function as security domains, with different parent keys assigned to different applications or purposes.

Example

A exchange uses an infrastructure where different parent keys represent separate security levels. The parent key at m/44'/0'/0' generates child keys for the exchange's , with limited funds for immediate withdrawals. A different parent key at m/44'/0'/1', stored with higher security protocols, generates child keys for the warm with additional operating funds. Both parent keys can ultimately be restored from the master seed stored in the exchange's ultra-secure vault, but day-to-day operations never require accessing this master seed.

Technical Deep Dive

In hierarchical wallets, a parent key works in conjunction with a 256-bit chain code to derive child keys. Extended keys (xprv or xpub) contain both the key itself and the chain code necessary for derivation. When creating a child key, the derivation function uses -SHA512 with the chain code as the key and input data constructed from either the parent private or (depending on whether private or public derivation is used) combined with a 32-bit index number. For normal derivation (indices 0-231-1), the parent's can be used in the derivation function, enabling the creation of child public keys without knowing the parent's —a feature critical for watch-only wallets. For hardened derivation (indices 231-232-1), the parent's must be used in the derivation, creating a security barrier that prevents child key compromise from affecting the parent. The derivation process creates both a new and a new chain code, forming a complete extended key that can itself act as a parent.

Security Warning

Compromising a parent key compromises all of its children (and their children, recursively). For critical security boundaries, use hardened derivation, as non-hardened parent keys can potentially be reverse-engineered if multiple child private keys are compromised. Consider using separate parent keys for different types or security contexts to limit exposure in case of a breach.

Caveat

While parent keys provide organizational structure, the practical security of the entire ultimately depends on the security of the master seed. The theoretical compartmentalization offered by separate parent keys is often undermined by backup practices that focus on the master seed, which can access all keys in the hierarchy. Additionally, different implementations may handle parent keys differently, potentially causing interoperability issues when attempting to use the same hierarchy across multiple platforms.

Related Terms

Hierarchical Deterministic Wallet

Derivation Path

BIP-32

Blockchain & Cryptocurrency Glossary

Parent Key (HD Wallet) - Related Articles