If one leak can be tolerated, why not just specify that the final branch should only use 0 as it's index. This way no two keys of the same direct parent are ever generated.
Short answer: Every key, no matter where in the hierarchy, is ultimately a linear combination of the
m master keys. Thus, a total of
m keys gathered from anywhere in the hierarchy is enough to break the wallet.
Less-short answer: We didn't even bother to explicitly define how one generates descendant keys beyond the first level. One straightforward way to do it is as follows. (
m is overloaded; let
n be the number of master keys.) The first
n child keys
m/0 through
m/n-1 are designated as the "master" keys for m/"0", the subsequent
n child keys
m/n through
m/2n-1 are "master" keys for m/"1" and so on recursively. So, for example, m/"0"/0 and m/"1"/0 are both linear combinations of the original
n master keys d
1,...,d
n.