Secure Hierarchical Deterministic Wallet Supporting Stealth Address

Over the past decade, cryptocurrency has been undergoing a rapid development. Digital wallet, as the tool to store and manage the cryptographic keys, is the primary entrance for the public to access cryptocurrency assets. Hierarchical Deterministic Wallet (HDW), proposed in Bitcoin Improvement Proposal 32 (BIP32), has attracted much attention and been widely used in the community, due to its virtues such as easy backup/recovery, convenient cold-address management, and supporting trust-less audits and applications in hierarchical organizations. While HDW allows the wallet owner to generate and manage his keys conveniently, Stealth Address (SA) allows a payer to generate fresh address (i.e., public key) for the receiver without any interaction, so that users can achieve “one coin each address” in a very convenient manner, which is widely regarded as a simple but effective way to protect user privacy. Consequently, SA has also attracted much attention and been widely used in the community. However, as so far, there is not a secure wallet algorithm that provides the virtues of both HDW and SA. Actually, even for standalone HDW, to the best of our knowledge, there is no strict definition of syntax and models that captures the functionality and security (i.e., safety of coins and privacy of users) requirements that practical scenarios in cryptocurrency impose on wallet. As a result, the existing wallet algorithms either have (potential) security flaws or lack crucial functionality features.

In this work, after investigating HDW and SA comprehensively and deeply, we formally define the syntax and security models of Hierarchical Deterministic Wallet supporting Stealth Address (HDWSA), capturing the functionality and security (including safety and privacy) requirements imposed by the practice in cryptocurrency, which include all the versatile functionalities that lead to the popularity of HDW and SA as well as all the security guarantees that underlie these functionalities. We propose a concrete HDWSA construction and prove its security in the random oracle model. We implement our scheme and the experimental results show that the efficiency is suitable for typical cryptocurrency settings.

1. 1.

   Note that we change the term from “one coin each address” to “one coin each cold-address”, to explicitly emphasize that it is not only for the privacy-preservation but also for the safety of coins.

2. 2.

   Note that the payee can detect such malicious behaviors easily.

3. 3.

   [13] discussed how to support dynamic hierarchy but does not give formal model or proof, and discussed a method to achieve transaction unlinkability, but will lose the master public key property.

4. 4.

   This separation is borrowed from the stealth address mechanisms in [12, 17].

5. 5.

   Actually, an individual user can also be regarded as a special organization, for example, a user may manage his wallets in a hierarchy manner.

6. 6.

   Note that we are abusing the concept of ‘\(\in \)’. In particular, if there exists a tuple \((ID, \textsf{wpk}_{ID}, \textsf{wsk}_{ID}) \in L_{wk}\) for some \((\textsf{wpk}_{ID}, \textsf{wsk}_{ID})\) pair, we say that \(ID \in L_{wk}\).

7. 7.

   Note that \(\textsf{WalletKeyDelegate}(\cdot , \cdot , \cdot )\) is a deterministic algorithm, so that querying \(\textsf{OWKeyDelegate}(\cdot )\) on the same identifier will obtain the same response.

8. 8.

   Note that actually the adversary \(\mathcal {A}\) here should not make such a query with \(t=0\) (as required by the success conditions defined in later Output Phase). In later definition of unlinkability, the adversary may query this oracle on ID with \(t=0\).

9. 9.

   Note that we are abusing the concepts of ‘\(\in \)’. In particular, if there exists a pair \((\textsf{dvk}, ID) \in L_{dvk}\) for some ID, we say that \(\textsf{dvk} \in L_{dvk}\).

This work was supported by the National Natural Science Foundation of China (No. 62072305, 62132013), and Shanghai Key Laboratory of Privacy-Preserving Computation.

Authors and Affiliations

1. Shanghai Jiao Tong University, Shanghai, 200240, China

   Xin Yin, Zhen Liu, Guoxing Chen & Haojin Zhu

2. Singapore Management University, Singapore, 178902, Singapore

   Guomin Yang

3. State Key Laboratory of Cryptology, P.O. Box 5159, Beijing, 100878, China

   Zhen Liu

4. Shanghai Qizhi Institute, Shanghai, 200232, China

   Zhen Liu

Corresponding author

Correspondence to Zhen Liu .

Editors and Affiliations

1. Rutgers University, Newark, NJ, USA

   Vijayalakshmi Atluri

2. Hamad Bin Khalifa University, Doha, Qatar

   Roberto Di Pietro

3. Technical University of Denmark, Kongens Lyngby, Denmark

   Christian D. Jensen

4. Technical University of Denmark, Kongens Lyngby, Denmark

   Weizhi Meng

Reprints and permissions

© 2022 The Author(s), under exclusive license to Springer Nature Switzerland AG

Policies and ethics