user323: I'm wondering whether disclosing a consecutive number of HD private keys derived from a given master key would allow someone to compute what the next private key in the sequence would be before it is revealed?
So given HD-derived private keys n, n+1, n+2, ..., n+m, can one figure out what is the private key n+m+1?

user29893: No, this cannot be found out if we assume



(which is a desired property of BIP32 and which I'm going to refer to as Φ describing the problem φ) to be true and assume that n+m <= 2^32 - 2
Assume you have an efficient solver ξ : P^m → P for the problem you described with
P := { a ∈ ℕ | 1 <= a <= 0xFFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFE BAAE DCE6 AF48 A03B BFD2 5E8C D036 4140}

being the set of valid secp256k1 ECDSA standard private keys.
Let Ψ = (r_1, r_2, ..., r_{m+1}) be an instance of a problem impossible to solve efficiently if Φ is true.
Solve φ as follows: If and only if ξ(r_1, r_2, ..., r_m) = r_{m+1}, return true, otherwise return false. This contradicts Φ.

323: <p>I'm wondering whether disclosing a consecutive number of HD private keys derived from a given master key would allow someone to compute what the next private key in the sequence would be before it is revealed?</p>

<p>So given HD-derived private keys n, n+1, n+2, ..., n+m, can one figure out what is the private key n+m+1?</p>
 29893: <p>No, this cannot be found out if we assume</p>

<blockquote>
  <p><img src="https://i.imgur.com/KjPC8jE.png" alt=""></p>
</blockquote>

<p>(<a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Security" rel="nofollow noreferrer">which is a desired property of BIP32</a> and which I'm going to refer to as <code>Φ</code> describing the problem <code>φ</code>) to be true and assume that <code>n+m &lt;= 2^32 - 2</code></p>

<p>Assume you have an efficient solver <code>ξ : P^m → P</code> for the problem you described with</p>

<pre><code>P := { a ∈ ℕ | 1 &lt;= a &lt;= 0xFFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFE BAAE DCE6 AF48 A03B BFD2 5E8C D036 4140}
</code></pre>

<p>being the set of valid secp256k1 ECDSA standard private keys.</p>

<p>Let <code>Ψ = (r_1, r_2, ..., r_{m+1})</code> be an instance of a problem impossible to solve efficiently if <code>Φ</code> is true.</p>

<p>Solve <code>φ</code> as follows: If and only if <code>ξ(r_1, r_2, ..., r_m) = r_{m+1}</code>, return <code>true</code>, otherwise return <code>false</code>. This contradicts <code>Φ</code>.</p>
