How to use hardened key derivation properly?

Question

I am implementing a wallet for customers' deposits account. I am using ethereumjs-wallet/hdkey. I need to decide which derivation path to use:

standard for ethereum would be m/44'/60'/0'/0 but maybe I'd rather use a custom path as the wallet is for ethereum exclusive so I could at least use m/44'/60'/0' because no UTXO and no need for change addresses.

Currently I'm struggling because can not find a method to derive hardened children.

Do I understand it correctly, if children are not hardened, than any leaked child private key would compromise all the siblings and parents?

Is there a possibility to create hardened children with ethereumjs-wallet?

Answer 1

The more common path used in popular wallets is m/44'/60'/0'/0, so the first available address become m/44'/60'/0'/0/0. I see no benefit using a different path, the strength of the key is derived from the seed and not from the path.

Having a child key does not allow generation of the parent key. The security of the child key derivation relies on the security of HMAC-SHA512 algorithm. To derive the parent from the child you have to somehow be able to reverse that algorithm.

I'd suggest to consult with BIP32 to understand how the HD wallets are generated.