Overview
BIP32 specifies a system for deriving a tree of cryptographic key pairs from a single master seed. Known as hierarchical deterministic (HD) wallets, this approach revolutionized Bitcoin key management by allowing users to back up all current and future keys with a single seed, and to organize keys into logical hierarchies.
Key Derivation Tree
Master Seed
│
└── Master Key (m)
│
├── m/0 (Account 0)
│ ├── m/0/0 (External chain - receiving addresses)
│ │ ├── m/0/0/0 (Address 0)
│ │ ├── m/0/0/1 (Address 1)
│ │ └── ...
│ └── m/0/1 (Internal chain - change addresses)
│ ├── m/0/1/0 (Change address 0)
│ └── ...
│
└── m/1 (Account 1)
└── ...
How It Works
BIP32 uses a one-way function called HMAC-SHA512 to derive child keys from parent keys. Each derivation takes a parent key, a chain code (additional entropy), and an index number as inputs, producing a new child key and chain code. This process can be repeated indefinitely, creating an arbitrarily deep tree.
Hardened vs Normal Derivation
BIP32 defines two types of child key derivation:
- Normal derivation: The child public key can be derived from the parent public key alone. This enables watch-only wallets using extended public keys.
- Hardened derivation (indicated by an apostrophe, e.g., m/44'): Requires the parent private key, providing a security firewall so that compromise of a child key cannot lead to derivation of sibling keys.
Practical Benefits
Before BIP32, wallets had to generate and back up each key individually. Losing a backup meant losing access to any coins received at new addresses. HD wallets solved this by making all keys deterministically reproducible from a single seed, typically encoded as a BIP39 mnemonic phrase for human-readable backup.