4 Wallets

This chapter introduces a user-friendly mobile wallet that automates everyday tasks previously done manually, improving the experience of sending and receiving payments. The wallet generates new addresses for privacy, stores and safeguards private keys, scans payment details (e.g., via QR codes/URIs), prepares and signs payments, and tracks balances while only crediting funds after confirmation. The back-end process used by Lisa and the spreadsheet remains unchanged; the focus is on making things seamless for end users while enabling the use of many addresses without added complexity.

After highlighting the pitfalls of naïve backups (exporting keys to files or email) and the mixed results of password-encrypted backups (entropy, forgotten passwords, and changing attacker capabilities), the chapter introduces hierarchical deterministic (HD) wallets. In an HD wallet, all keys are derived from a single random seed and organized in a tree, enabling simple organization (e.g., “accounts”) and effectively infinite key generation. Extended private keys (xprv) and extended public keys (xpub) pair a key with a chain code to deterministically derive children. Backups become far simpler and safer: users write down the seed once, typically encoded as a 12–24 word mnemonic sentence with a checksum, and can later restore all keys from those words. Xpubs let systems such as web servers create fresh addresses without holding any private keys, keeping spending keys offline.

The chapter also addresses important security nuances. If an attacker obtains a child private key and the corresponding parent xpub, they may reconstruct the parent xprv; hardened derivation prevents this by making child derivation depend on private data, isolating branches and limiting blast radius. The text provides intuitive grounding for the underlying cryptography, including how public keys are derived from private keys using elliptic-curve “multiplication” and how xpub child derivation mirrors the private side with safe public-key operations. In sum, the wallet’s responsibilities—key management, address creation, payment initiation, fund tracking, and robust backup—are made practical and secure by HD wallets, mnemonic seeds, and careful use of xpubs and hardened paths.

   Bitcoin wallets

  John buys a cookie using the wallet app. The cafe generates a key and displays a QR code with payment details to John. John scans the payment details and taps "OK" to approve the payment. John’s wallet sends an email to Lisa.

John has just clicked OK in his wallet to approve the payment. The wallet takes care of the rest for John. It selects a key with enough funds and signs a message to Lisa. The signed message is then automatically emailed to Lisa.

  John’s and the cafe’s wallets check the spreadsheet every few seconds. If a new payment either incoming or outgoing is found, the wallet updates the balance of the concerned keys and notifies its user.

5. John backs up his private keys. They are sent in a text file to his email address.

  John backs up his private keys. They are sent in a file encrypted with a password that john enters into his phone.

  Create the first two of Rita’s three savings keys. A random seed is used to create a master extended private key (master xprv). This extended private key (xprv) is then used to create child extended private keys (child xprv).

  An extended private key consists of a private key and a chain code.

   Deriving Rita’s master xprv. The seed is hashed with HMAC-SHA512. The resulting hash of 512 bits is split into left 256 bits that becomes the master private key and the right 256 bits that becomes the chain code.

  Deriving a child xprv from a parent xprv. The public key and chain code of the parent and the desired index are hashed together. The parent private key is added to the left half of the hash and the sum becomes the child private key. The right half becomes the child chain code.

We are working on making a great wallet for users.

  Decoding a mnemonic sentence into the seed.

  The cafe copies its "on-line sales" xprv to the web server.

  An extended public key consists of a public key and a chain code

  Generating the tree of xpubs from the master xpub. The general pattern is the same as when generating xprvs, but the child derivation function differs.

  Extended public key derivation. The private key addition from the xprv derivation is replaced by public key "multiplication".

  Plus on the private side have a corresponding "plus" on the public side. Parent private key plus some value is the child private key. Parent public key plus the public key derived from the same value is the child public key.

  Mallory has stolen the private key m/1/1 from the cafe and the parent xpub from the web server. She can now steal all money in the on-line sales account.

  The master xpub cannot be used to generate any child keys at all because m/0' and m/1' are hardened keys.

. Whole number solutions to the elliptic curve  y2=x3+7mod11. Each such solution is a public key.

  child public key is derived by adding the parent public key with the public key derived from the left 256 bits.

  Xpub derivation and normal public key derivation. A normal public key is the start point G multiplied by a private key. A child public key is the parent public key "added" to the public key derived from left half hash.

  Each point on the curve has a symmetric point at the same x value

  The cafe’s hierarchical deterministic wallet. They use key hardening to isolate different branches of the tree from each other.

• You usually use a mobile app, called a wallet, to send and receive money, cookie tokens or bitcoins.
• The wallet is responsible for creating and storing your keys, scan or show payment details, send payments, show your balance and backup your keys. You don’t have to do that manually.
• Backup is hard to do right. Password protected backups suffer from problems with forgotten passwords, technology improvements, humans suck as random number generators.
• With hierarchical deterministic wallets, you backup your random seed and store that seed in a safe place. Do it only once.
• The seed can be encoded using a mnemonic sentence, which makes it easier for you to write down the seed.
• HD wallets generate multiple private keys from its seed and organize them in a tree structure to improve your privacy.
• The tree, or any branch of the tree, of public keys can be generated from an extended public key. This is very useful for insecure environments like web servers.
• Hardened private key derivation keeps "accounts" compartmentalized. They confine an attacker to a single account.

FAQ