Derivation Path
A derivation path is a piece of data which tells a Hierarchical Deterministic (HD) wallet how to derive a specific key within a tree of keys. Derivation paths are used as a Bitcoin standard and were introduced with HD wallets as a part of BIP 32.
Each key in the tree of a HD wallet can be described by its derivation path, which contains information about a key’s depth and index—where it resides within the tree structure. The master key is simply refered to as ’m’.
For example, the first child of the master key has a derivation path of “m/0”, and the fifth child of that child key has a derivation path of “m/0/4”. The depth of each child is given by the number of levels—each separated by a slash—between itself and the master key, and the index of each child is its number at that level, starting with zero. The key at “m/0/4” has a depth of 2 and an index of 4.
Bitcoin Improvement Proposal 32 allows for 2^32 children keys to be derived by each parent key. Children numbered 0-2^31 — 1 are considered unhardened, meaning a parent public key can derive child public keys. However, for children numbered 2^31-2^32 — 1, parent public keys are incapable of deriving children. Only the parent private key is capable of deriving a child private key, which can then be used to derive the child public key. This specification allows for flexbility within the HD wallet standard. When a key is hardened, it is denoted with a prime symbol ‘.
For example, the first hardened child of the master key has a derivation path of “m/0’”, and that key’s fifth unhardened child has a derivation path of “m/0’/4”.
WTF Is A Derivation Path?
How does one address turn into UNLIMITED addresses?
Using a wallet in the land of crypto is far different than the traditional world. There are new words, new concepts, and, depending on the type of account you make, the process can be confusing. You can create a private key, a keystore file (a private key protected by a password), or a mnemonic phrase (a string of words that can access multiple private keys).
Aside from having different security features, the biggest difference between each of these is that a private key or keystore file only creates one account. Creating a mnemonic phrase gives you control of many accounts, all accessible with that same phrase.
How does a single phrase create more than one address?
A mnemonic phrase — otherwise known as a “Hierarchical Deterministic Wallet” — generates addresses by taking the phrase and combining it with a piece of information called a derivation path. Together, they create any number of accounts, using Complex Math™ aka cryptography.
So, what is a derivation path?
Before we try to understand what a derivation path is, let’s look at what the word derive means. The standard definition of derive is “to obtain something from a specified source.” In a mathematical context, the definition is a bit more specific: “To obtain [a function or equation] from another by a sequence of logical steps, for example by differentiation.”
This, put more simply, is to obtain something, from something else, in a very specific way. “Derivation Path” is just a fancy way of saying “this is the thing you use to get all your accounts from your mnemonic phrase.”
The anatomy of a derivation path
This is what a derivation path looks like: m/44'/60'/0'/0'/0
Each of the numbers in that sequence play a part and each changes what the private key, public key, and address would be. If you’re interested in learning a little more about the technical aspects of this, you can read more here. The most important takeaway is that if you want the next address from a phrase, you just increase the last number by one:
(In programming, you start counting at 0. 0…1…2…3… rather than 1…2….3….This different than how we count in our day-to-day lives, so it can be confusing at first.)
History lesson: Addresses in Bitcoin (UTXO) versus Ethereum
Bitcoin and Ethereum operate differently whenever you send a transaction. On the Bitcoin network, when you send coins from one address to another, you typically send your entire balance. Part of what you send goes to a receiver address, and the remainder goes to a secondary, or “change,” address. This is called “UTXO” or “Unspent Transaction Output.” In order to know the balance, you actually have to add up all the UTXO’s. A technical explanation of this can be found here.
Ethereum, on the other hand, uses an account-based system, which operates more like a traditional banking system would. This means that each account, or address, directly spends or receives value. There are several advantages to using this system, such as ease of tracing transactions and how double spending is prevented. It also allows for smart contracts to hold a balance in the same way a “normal” account would. Because of this, each Ethereum address can have a balance, contract code, and data storage, and the system allows the balance to change for any address with each transaction.
The complexity and robustness of the Ethereum Virtual Machine, which executes the contract code, is more easily served by the account method. Having the value, contract, and storage information bound to a single address saves space in the current state of the chain. A more in-depth article on these differences can be found here.
Regardless, the reason behind the mnemonic phrase, derivation path, and seemingly unnecessary complexity comes from Bitcoin. The specification was made before Ethereum even existed and helped solve a very specific problem: it allowed you to send bitcoin to the receiver and send all the “change” to a new address that you controlled without having to create, backup, and secure a new private key each time. Nifty, right?
Derivation paths and HD Wallets in general are a great example of how, slowly but surely, we are improving how we interact with the blockchain. You might have seen one when accessing a wallet via mnemonic phrase or when using a Ledger or a Trezor. Hopefully when you look at a derivation path now, it’s less meaningless numbers and more awe-inspiring technology.
Derivation Paths
The cool thing about extended keys is that they can derive children, and these child keys can derive more children, and so on. This allows you to create a tree of extended keys, with each key having its own unique derivation path from the master key.
You can derive keys in any way you want. But to help with compatibility between wallets, we have a set structure for how we derive keys for use in a hierarchical deterministic wallet.
The most common derivation paths used are:
-
: m/44’/0’/0′ (for 1addresses ) : m/49’/0’/0′ (for 3addresses ) : m/84’/0’/0′ (for bc1addresses )
1. Notation
First of all, we have a basic notation for describing the derivation path for a specific extended key. For example:
The slashes / indicate a new level in the tree (a new child). The numbers (e.g. 0 ) indicate the child number from the parent.
The only other thing you need to know about the notation is that a ‘ or h indicates a hardened child extended private key (which means that the public keys it creates cannot be derived by the extended public key ):
- 0 — Normal Child (index 0 )
- 0′ — Hardened Child (index 2147483648 )
This ‘ just saves us having to write the full index numbers for hardened children. For example, 3’ means index 2147483651 .
Tip: You can derive up to 4294967296 children from a single extended key. The first half are for normal children, and the second half are for hardened children.
Note: Deriving hardened children is the default. Normal children are only derived when it would be useful to have a corresponding extended public key for deriving the same public keys.
2. Wallet Structure
To help with consistency between wallets, BIP 44 introduced the following structure:
The levels in the tree have a meaning. m : Master
The master key (created from a seed).
m/44′ : Purpose (hardened)
This specifies the upcoming wallet structure.
There are three schemes currently being used by wallets:
Tip: The number reflects the number of the BIP . New schemes can use different BIP numbers.
m/44’/0′ : Coin Type (hardened)
The cryptocurrency the keys will be used for.
Different cryptocurrencies can use the same private keys and public keys derived from a seed. So instead of having separate seeds for different currencies (or using the same public keys on different chains), we can use the same seed with different derivation paths instead.
This is useful in hardware wallets, where you can have a single seed and use it for holding a variety of different coins.
m/44’/0’/0′ : Account (hardened)
This allows you to create separate accounts for funds. The default account is 0′ .
For example, you can use the same seed yet still create separate “pots” for receiving payments. The coins in these separate accounts will never be mixed.
Tip: You could obviously create many different accounts at various indexes at this level. But to keep recovery simple, a wallet should create accounts in sequential order, and not create a new account if a previous one has not been used.
m/44’/0’/0’/0 : Change
The keys and addresses we use are separated in to “Receiving” and “Change”.
- Receiving = 0 — Addresses that we will give out to people for receiving payments.
- Change = 1 — Addresses we use for sending change back to ourselves when we make transactions.
This means you will always be able to identify the coins that arrived from external payments.
m/44’/0’/0’/0/0 : Index
These are the extended keys that you use for their private keys and public keys for actual usage in the wallet.
So as you can see, the first few levels in the path are just used to structure the hierarchical deterministic wallet in a practical way.
The actual keys used for addresses are in lowest level of the tree.
3. Derivation Paths
Here are some actual derivation paths used by wallets.
BIP 32: m/0’/0/0 (deprecated)
This is the original derivation path specification in BIP 32.
It just used the first child for accounts, and the next two children below for separating external and internal addresses. The children of these are used for their actual private keys and public keys to create addresses .
This is a nice and simple derivation path, but it doesn’t allow for the option of creating alternative derivation path schemes.
This is where BIP 44, BIP 49, and BIP 84 come in.
BIP 44: m/44’/0’/0’/0/0
BIP 44 builds upon the original BIP 32 scheme to include a purpose 1 (which is like a version number to identify the upcoming scheme), as well as a coin type so that the same seed can be used to generate keys for different cryptocurrencies.
The public keys are encoded to 1addresses ( P2PKH ).
BIP 49: m/49’/0’/0’/0/0
BIP 49 uses the same structure as BIP 44, but is used to indicate that the public keys should be encoded in to 3addresses ( P2WPKH-P2SH ).
BIP 49 Serialization
The extended keys in the BIP 49 derivation path use the version bytes 049d7878 “yprv” or 049d7cb2 “ypub” during serialization. This allows you to identify an extended key when it is part of the BIP 49 scheme.
BIP 84: m/84’/0’/0’/0/0
BIP 84 uses the same structure as BIP 44, but is used to indicate that the public keys should be encoded in to bc1addresses ( P2WPKH ).
BIP 84 Serialization
The extended keys in the BIP 84 derivation path use the version bytes 04b2430c “zprv” or 04b24746 “zpub” during serialization. This allows you to identify an extended key when it is part of the BIP 84 scheme.
4. Example
The following takes a seed (mnemonic sentence or hex) and derivation path, and shows you the address for the private extended key in that path (along with the next few children too).
Try it! — Derivation Paths
Gap Limit: When recovering a wallet from a seed, you should only check the first 20 receiving addresses for a balance. If none have been used in the past, you can consider the account as unused.
Never enter your actual seed in to a website. Websites can save what you enter and use it to steal your coins.
5. Code
To save on code, these snippets use handy libraries (bitcoin-ruby, hdkeychain) for deriving extended keys.
Can someone explain the meaning of derivation path in wallet in plain English (such as m/44'/60'/0'/0)?
Derivation paths are related to HD Wallets or HD Keys, a type of wallet where you have a single, human readable, seed phrase that unlocks a number of accounts / addresses / private keys across any supported network. These phrases typically look like brain surround have swap horror body response double fire dumb bring hazard .
The technical specification for the most commonly used HD wallets are.
-
— HD wallets specification — the mnemonic phrase / word list / etc. piece of this puzzle. — the derivation path stuff / algorithms.
Typically you have a single private key (e.g. afdfd9c3d2095ef696594f6cedcae59e72dcd697e2a7521b1578140422a4f890 ) which allows you to access your funds in it’s matching address (e.g. 0x06A85356DCb5b307096726FB86A78c59D38e08ee ). This is a keypair.
With HD wallets you have a single seed phrase (e.g. brain surround have swap horror body response double fire dumb bring hazard ) which, via math and algorithms and code and stuff, derives multiple keypairs. An infinite number of keypairs.
Additionally, there is an insecure format of wallet known as a «brain wallet» where a person can use a single, human-readable phrase and, via math and algorithms and code and stuff, turns into a single keypair.
Okay, but wtf about derivation paths?
Brain wallets allow you to turn dogsarecool12 or brain surround have swap horror body response double fire dumb bring hazard into a single private key which is then used to access your funds and sign your transactions.
For simplicity’s sake, lets represent this as
If I were to use catsarecool10 instead of dogsarecool12 as my phrase, I would get a different keypair, different address, different account.
HD wallets are similar, but each phrase has an infinite number of keypairs or accounts that it can access. Because, unlike brain wallets, it does more complex math. For simplicity’s sake, let’s represent this as
seed phrase + XYZ + �� + ABC + & + 1 => private key
If you change any one of those pieces, the private key that you get (or derive) is is going to be different, just as it was above with catsarecool10 vs dogsarecool12 . However, since all the coders follow the same rules, the pieces that get added to the seed phrase are consistent and allow users to access the same accounts across multiple products or blockchains.
These pieces are the «derviation path»
- XYZ + �� + ABC + & + 1
The actual derivation path pieces
Full path: m/44’/60’/0’/0’/0
What each number represents: m / purpose’ / coin_type’ / account’ / change / address_index
Probably just a random way to start a string so that coders can easily tell if something is a derivation path, not you starting to type «mommy».
This is always 44′ . However, if it were decided that there were a better evolution of the HD key system, you could change it to be 45′ so that, again, coders could tell the difference between an old system and a new system.
Which blockchain are you accessing? Each blockchain has a number that represents it. Bitcoin is 0 . Ethereum is 60 . Aion is 425 . When you create a new blockchain, you apply for an unused number. You can see all the chains and their numbers here: https://github.com/satoshilabs/slips/blob/master/slip-0044.md
A number that starts at 0 and increases. A layer of separation or hierarchy. (more on that below)
Sometimes used in Ethereum, sometimes not. Was created for Bitcoin originally which doesn’t really have «accounts», it has «unspent transaction outputs». Basically you never send a part of your bitcoin holdings around—you send all your bitcoin to multiple addresses. If you have 0.75 BTC but only want to send me 0.5 BTC, you would send me 0.5 BTC and then send yourself 0.25 BTC. «Yourself» could be back to the original address or to another address you have access to (for example, the next address on the «list»). This number says «send whatever I don’t want to send to my friend to the 10th address on my list. Or the 0th address on the list (aka the address I am sending from).
Another variable to get different accounts, etc.
Seperation and Hierarchy
Some of the variables above are based on external forces, like what chain I am on. Some are chosen by the user or the wallet software, like the change variable. The account and index variables give me (or my wallet) more things to change.
For example, let’s say I want to separate my personal ETH holdings from my company’s ETH holdings. I could use m/44’/60’/0’/0’/0 for the company and m/44’/60’/1’/0’/0 for my personal.
But let’s say I want to have different addresses for.
- my personal savings
- where I receive my paycheck each week
- when I personally getting paid back by friends
- displaying publicly on my personal github for donations
- all my personal school expenses
I could use m/44’/60’/1’/0’/0 for savings, m/44’/60’/1’/0’/1 for paychecks, m/44’/60’/1’/0’/2 for getting paid back by my friend, and so forth. I could also do the same with the company accounts. Yay!