5

I'm looking to identify the EC key derivation method used in Hyperledger Fabric. I can't find anything in the docs or the protocol specs, but the functions' code is here for the private key and the public key.

The derivation function seems to be very simple, DerivedPrivate = MasterPrivate + (k+1) and DerivedPublic = MasterPublic + (k+1) * G all mod N with k being a random derivation data. And yet, I don't seem to be able to find the name or the source of this method.

I'd like to know about the patent and copyright status of this derivation method, and to do that I need something to google for. I'm also looking for a more formal description of this method.

Fozi
  • 193
  • 1
  • 9

1 Answers1

4

Common terms for this include hierarchical key derivation, hierarchical deterministic keys, and key blinding. It is sometimes called ‘hierarchical’ because you can repeatedly derive subkeys $Q = [k_1]G + P$, $R = [k_2]G + Q$, etc., and the process is a deterministic function of the tags $k_1$ and $k_2$ and the initial point $P$. It is sometimes called ‘blinding’ because knowledge of $Q = [k]G + P$ and the standard base point $G$ without the blinding $k$ gives no information about $P$.

You can find practical examples in Bitcoin's BIP32 and related protocols, in the Tor v3 onion service protocol, and in the PrivacyPass protocol.

The two common variants are additive and multiplicative blinding: $[k]G + P$ vs. $[k]P$, both of which are invertible, by $Q - [k]G$ or $[k^{-1} \bmod n]Q$ where $n$ is the order of the group. The additive variant has the advantage that it always uses fixed-base scalar multiplication, and only a single curve addition, which may or may not make a difference in your protocol.

The analogues in the finite field setting are, of course, $G^k\cdot P$ and $P^k$ with inverses $Q/G^k$ and $Q^{k^{-1} \bmod n}$, but while you'll see this notation in the PrivacyPass paper nobody verbalizes talk of this because while we can say ‘multiplicative’, who can bring themselves to verbalize ‘exponentiative’ without getting distracted wondering whether the word even exists?

Squeamish Ossifrage
  • 49,816
  • 3
  • 122
  • 230