user129540: I'm reading Bitcoin and Cryptocurrency Technologies. This book talks about how "hierarchical deterministic wallet" works like this:

Here it says private key generation need "k, x, y", but where is x in the equation? I mean, for "y+H(k||i)", what does it have to do with the "x"?

user51948: Hierarchical Deterministic (HD) wallets are described in BIP-32. There are a number of technical aspects to this, so for the simplicity of this answer, I'll only talk about deriving a child private key from a parent private key, using non-hardened derivation.
To keep the syntax similar to your screenshot, let y be the parent private key, so that g^y is the parent public key. In BIP-32 HD, we don't just use y though, we also need the chain code for y. They call it a random value, but in practice it is computed in a deterministic way, so that it can be retrieved later. Let's call this k, as the purpose in the screenshot seems to be similar.
To derive child i, we compute (simplified):
I = HMAC-SHA512(k, g^y || i).

where k is used as a secret to compute the HMAC function. In the screenshot they simply hashed the two together, which isn't best practice, but may be simpler to understand. They also left out g^y, so let's ignore that too.
This value I we computed is 512 bits long. Split it in half, and call the left 256 bits L and the right 256 bits R:

R is the child chain code (which you can ignore if you like), used to derive children of this child and continue the chain.
The child secret key is y + L.

Because your screenshot simply just computes a hash, you can think of it like directly computing L here without computing R. It is safe to say that x is a typo though. HD derivation only needs the chain code k and private key y to compute the child private keys.

129540: <p>I'm reading <a href="https://rads.stackoverflow.com/amzn/click/com/0691171696" rel="nofollow noreferrer" rel="nofollow noreferrer">Bitcoin and Cryptocurrency Technologies</a>. This book talks about how &quot;hierarchical deterministic wallet&quot; works like this:</p>
<p><a href="https://i.stack.imgur.com/owIn9.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/owIn9.png" alt="enter image description here" /></a></p>
<p>Here it says private key generation need &quot;k, x, y&quot;, but where is x in the equation? I mean, for &quot;y+H(k||i)&quot;, what does it have to do with the &quot;x&quot;?</p>
 51948: <p>Hierarchical Deterministic (HD) wallets are described in <a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki" rel="noreferrer">BIP-32</a>. There are a number of technical aspects to this, so for the simplicity of this answer, I'll only talk about deriving a child private key from a parent private key, using <em>non-hardened derivation</em>.</p>
<p>To keep the syntax similar to your screenshot, let <code>y</code> be the parent private key, so that <code>g^y</code> is the parent public key. In BIP-32 HD, we don't just use <code>y</code> though, we also need the <em>chain code</em> for <code>y</code>. They call it a random value, but in practice it is computed in a deterministic way, so that it can be retrieved later. Let's call this <code>k</code>, as the purpose in the screenshot seems to be similar.</p>
<p>To derive child <code>i</code>, we compute (simplified):</p>
<pre><code>I = HMAC-SHA512(k, g^y || i).
</code></pre>
<p>where <code>k</code> is used as a secret to compute the HMAC function. In the screenshot they simply hashed the two together, which isn't best practice, but may be simpler to understand. They also left out <code>g^y</code>, so let's ignore that too.</p>
<p>This value <code>I</code> we computed is 512 bits long. Split it in half, and call the left 256 bits <code>L</code> and the right 256 bits <code>R</code>:</p>
<ul>
<li><code>R</code> is the child chain code (which you can ignore if you like), used to derive children of this child and continue the chain.</li>
<li>The child secret key is <code>y + L</code>.</li>
</ul>
<p>Because your screenshot simply just computes a hash, you can think of it like directly computing <code>L</code> here without computing <code>R</code>. It is safe to say that <code>x</code> is a typo though. HD derivation only needs the chain code <code>k</code> and private key <code>y</code> to compute the child private keys.</p>
