Is possible to continue the BIP32/BIP39 algorithm from a Pk and Sk pair and "climb" to the mnemonic seed?

A few days reading about the BIP algorithm and the generation of the key pairs.

Found that on the BIP 32 Paper:

Child key derivation (CKD) functions Given a parent extended key and an index i, it is possible to compute the corresponding child extended key. The algorithm to do so depends on whether the child is a hardened key or not (or, equivalently, whether i ≥ 231), and whether we're talking about private or public keys.

Private parent key → private child key The function CKDpriv((kpar, cpar), i) → (ki, ci) computes a child extended private key from the parent extended private key:

Check whether i ≥ 231 (whether the child is a hardened key). If so (hardened child): let I = HMAC-SHA512(Key = cpar, Data = 0x00 || ser256(kpar) || ser32(i)). (Note: The 0x00 pads the private key to make it 33 bytes long.) If not (normal child): let I = HMAC-SHA512(Key = cpar, Data = serP(point(kpar)) || ser32(i)). Split I into two 32-byte sequences, IL and IR. The returned child key ki is parse256(IL) + kpar (mod n). The returned chain code ci is IR. In case parse256(IL) ≥ n or ki = 0, the resulting key is invalid, and one should proceed with the next value for i. (Note: this has probability lower than 1 in 2127.) The HMAC-SHA512 function is specified in RFC 4231. Public parent key → public child key The function CKDpub((Kpar, cpar), i) → (Ki, ci) computes a child extended public key from the parent extended public key. It is only defined for non-hardened child keys.

Check whether i ≥ 231 (whether the child is a hardened key). If so (hardened child): return failure If not (normal child): let I = HMAC-SHA512(Key = cpar, Data = serP(Kpar) || ser32(i)). Split I into two 32-byte sequences, IL and IR. The returned child key Ki is point(parse256(IL)) + Kpar. The returned chain code ci is IR. In case parse256(IL) ≥ n or Ki is the point at infinity, the resulting key is invalid, and one should proceed with the next value for i.

I was wondering then, if mnemonic seed only gives you access to the first key pair and then, that key pair, gives you the next.

This will mean that you can execute the BIP 32 algorithm from a Pk,Sk combination that belongs to the herarchy marked by the mnemonic seed.

So I wanted to know if it's possible to scale from a Pk,Sk pair to the mnemonic seed (12 or 15 words from a dictionary).

Thanks.

• What do you exactly mean with "scaling" from Pk/ Sk to mnemonic seed? Somehow deriving the mnemonic phrase ? May 26, 2018 at 13:25
• The algorithm only goes from seed to key pairs, not backward, as I've read. But I'm not sure, and that's why I asked that. May 26, 2018 at 13:30

If I'm understanding your question correctly, you are asking whether you can go from any key pair in the hierarchy back to the original seed.

This is not possible since each step down the hierarchy is a HMAC-SHA512, which is a just a SHA512 hash with a little extra. SHA512 is a one-way function, so you can't reverse it aka go up in the hierarchy.

Even the master key is a HMAC-512 of the original seed (the mnemonic phrase), so it's not even possible to go from master key back to the original seed.

Edit:

HMAC-SHA512 is non-reversible, because the underlying function SHA512 is a hash function, not a cipher like ellipic curve techniques. Hash functions are not reversible by design since they map a large input space into a smaller output space, thus creating collisions, ie. different inputs that produce the same output. Therefore, it's impossible to find the definitive original input when you only have the output of a hash function.

Furthermore, SHA512 is a cryptographic hash function, which implies pre-image resistance. This means that it is infeasible to generate any of the (possibly multiple) inputs when given an arbitrary output.

HMAC-SHA512 is specified as:

``````HMAC-SHA512(Key, Data) = SHA512((Key xor opad) | SHA512((Key xor ipad) | Data)
``````

where `opad` and `ìpad` are constants.

In BIP32 the key derivation is something like (depending on the exact scenario):

``````let I = HMAC-SHA512(Key = cpar, Data = serP(Kpar) | ser32(i)).
// proceed to get the new key pair and chain code from I...
``````

So, both the new key pair and chain code are solely dependent on the output of HMAC-SHA512, which is non-reversible and thus the whole key derivation is non-reversible, too.

• What you'll need to know to be able to go backward? For example, on an elliptic curve, you can solve the discrete logarithm by knowing the multiplicative body generator. Which will be the equivalence here? Can you provide a lil bit of extra info of the Hash function used and how the derivation is really done? Please, edit your answer with this content, and I'll accept it :) May 26, 2018 at 18:54
• Edited it. I hope it answers your questions now :) May 26, 2018 at 19:55