18:16 <stevenroose> Regarding BIP32 what was the combination of things that could lead to fund loss if revealed to an outsider? Was it an xpub and a single private key derived from the xpub's xpriv?

18:17 <stevenroose> (Ofc not considering the fact that losing a single private key can also lead to fund loss...)

18:18 <sipa> parent xpub, and child prv

18:19 <sipa> (and using unhardened derivation, of course)

18:19 <sipa> from the BIP:

18:19 <sipa> One weakness that may not be immediately obvious, is that knowledge of a parent extended public key plus any non-hardened private key descending from it is equivalent to knowing the parent extended private key (and thus every private and public key descending from it). This means that extended public keys must be treated more carefully than regular public keys. It is also the reason for the

18:19 <sipa> existence of hardened keys, and why they are used...

18:19 <sipa> for the account level in the tree. This way, a leak of account-specific (or below) private key never risks compromising the master or other accounts.

19:19 <rubikputer> sipa: is there any reason *not* to use hardened derivation for addrs derived from an xpub?

19:20 <sipa> rubikputer: if you want to be able to derive them without private key

19:20 <sipa> for a multisig setup you don't want to use hardened derivation e.g.

19:21 <sipa> every participant shares an xpub with each other, now everyone can derive all future addresses

19:21 <rubikputer> oh true

19:23 <sipa> with hardened derivation you'd need to share just all pubkeys up front

19:23 <sipa> which also works, but is a bit less convenient