child key derivation

Child key derivation is the single step at the heart of every HD wallet: taking one parent key and an index number, and producing a specific child key. Repeat it down the levels of a derivation path and you get any address in the tree. The 'deterministic' promise of HD wallets is exactly this — same parent, same index, same child, every time, on every wallet.

There are two flavours, and the distinction is one of the most security-relevant details in all of wallet engineering. Non-hardened (normal) derivation mixes the parent's public key into the computation. Its superpower is that it can be done with only public data: an extended public key alone can roll out every receiving address, so an accounting server or point-of-sale terminal can generate fresh addresses without ever touching a private key. Hardened derivation instead mixes the parent's private key in, and is signalled by indices at or above 2^31 (written with an apostrophe, like 0').

Why bother with hardened keys at all? Because non-hardened derivation has a sharp edge. The same linear math that lets a public key derive child public keys means that if an attacker ever obtains both a parent extended public key and just one non-hardened child private key, they can algebraically subtract their way back to the parent private key — and from there, the whole sub-tree. Hardened derivation deliberately destroys that relationship, so a leak stays contained to the one leaked key. Standards therefore harden the structural levels (purpose, coin, account) and leave only the leaf address levels non-hardened, capturing the watch-only benefit while limiting the blast radius.