HD wallet public to public key derivation and non-hardened keys

Question

This question is about hierarchical deterministic wallets and the bip32 standard which, as I understand it, allows you to deterministically derive child private/public key pairs from a master seed phrase or master private/public key pair.

My question is about derivation from parent public key to child public key only, based on reading a bit on the bip32 standard, my understanding is that it's possible only for "non-hardened keys".

https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Public_parent_key_rarr_public_child_key

Would it be possible (and safe) to reveal two public keys, one which corresponds to your parent address, and the other, one of the child addresses derived via the standard, and let an outsider prove or verify that the child address belongs to you (the owner of the master seed account)?

The use case would be to allow you to send a signed message from the child account, and let a verifier prove that the signed message comes from an account which you own (or in other words, is a child of the public key corresponding to your master seed phrase). You should only be revealing public keys to prove the relationship.

I am envisioning that the verifier would use ecrecover() to get the child address and could then (potentially) prove it lies within the deterministic tree for a parent, but not sure if this is really possible.

Answer 1

You can come close to that what you want by letting the owner prove that he knows the private keys of both addresses.

Something like:

function proveOwnership(address masterAddr, address childAddr, uint8[2] v, bytes32[2] r, bytes32[2] s) {
    bytes32 h = keccak256(childAddr, masterAddr);
    require(ecrecover(h, v[0], r[0], s[0]) == masterAddr);
    require(ecrecover(h, v[1], r[1], s[1]) == childAddr);
    masterKeys[childAddr] = masterAddr;
}

Later in the process, you can check if the childAddress is linked to a masterAddress. Of course you can not avoid that the masterAddress and childAddress are from two different HDWallets, but at least you can ensure that the sender is knowing both private keys.