Detecting Duplicate Root Private Keys in Bitcoin

In the vast and complex world of blockchain cryptography, detecting duplicate root private keys is crucial for ensuring the integrity and security of a decentralized network. Extended public keys are an essential component of Bitcoin’s cryptographic infrastructure, allowing users to create multiple unique digital identities. However, the same root private key can be used to derive multiple extended public keys, compromising the security of the system.

In this article, we’ll explore how to detect if two extended public keys have the same root private key using a simple example and provide insight into the potential risks involved.

Derivation Process

To derive an extended public key, you need to combine three different pieces of information:

• Parent Key: A long string that serves as the parent key for your derivation.

• Chaincode: A unique identifier that ensures each user’s account is associated with a specific wallet.

• Version and Salt: Optional parameters that add additional security features.

The following Python script illustrates how to derive an extended public key using Bitcoin’s cryptography library:

from cryptography.hazmat.primitives import hashes, serialization

from cryptography.hazmat.primitives.asymmetric import padding

import os


def generate_key(parent_key, chaincode, version=None, salt=None):

    if version and not isinstance(version, int) or version < 0:

        raise ValueError("Invalid version")

    

    








Create a new EC key pair using the parent key and public key parameters.

    ec = hashes.ECDSA(hashes.SHA256(), serialization.ders)

    e_key = ec.generate_key()


    
Combine the parent key, chaincode, and optional version and salt to create an extended key.

    key = (

        bytes.fromhex(parent_key[:40]),

        bytes.fromhex(parent_key[40:],

                        encoding=errors.UTF8),

        salt if salt else None,

        e_key.public_bytes(

            encoding=serialization.Encoding.PEM,

            format=serialization.PublicFormat.SubjectPublicKeyInfo

        )

    )


    return key



Generate three extended public keys.

parent_key1 = "035f743ee7d73d27e8c80f6b2458e6d4e2a45f3d7dd35c4e4d84ff3d939d09f40c"

chaincode1 = "1234567890abcdef"

key1 = generate_key(parent_key1, chaincode1)


parent_key2 = "035f743ee7d73d27e8c80f6b2458e6d4e2a45f3d7dd35c4e4d84ff3d939d09f40c"

chaincode2 = "1234567890abcdef"

key2 = generate_key(parent_key2, chaincode2)


parent_key3 = "035f743ee7d73d27e8c80f6b2458e6d4e2a45f3d7dd35c4e4d84ff3d939d09f40c"

chaincode3 = "1234567890abcdef"

key3 = generate_key(parent_key3, chaincode3)



Compare the extended keys.

if key1 == key2 and key1 != key3:

    print("Two extended public keys have the same root private key.")

else:

    print("No duplicate root private keys found.")

Detecting Duplicate Root Private Keys

To detect if two extended public keys have the same root private key, you can compare them using the == operator. If both keys are identical, it indicates that they share a common root private key.

In this example, we generate three different extended public keys using the same parent key and chaincode. We then compare these keys to detect any duplicate root private keys:

if key1 == key2 and key1 != key3:

    print("Two extended public keys have the same root private key.")

else:

    print("No duplicate root private keys found.")

Conclusion

Detecting duplicate root private keys is essential for maintaining the security of Bitcoin’s blockchain network. By comparing the extended public keys generated from different parent keys and chaincodes, you can identify any potential duplicates and take corrective action to prevent compromised accounts.