Why hardended xpub key cannot generate child public key?
Non-hardened parents effectively use the public key to derive their children, where hardened parents derive their children from the private key.

The derivation of a child private key from a non-hardened parent private key k uses the following hash function:

HMAC-SHA512(chainCode, point(k) || i)


We know that K = point(k), where K is the parent public key. Thus, if we only know K and not necessarily k, we are still able to derive the child key by replacing point(k) with K, and follow the regular process.

With hardened private keys, the hashing is done differently:

HMAC-SHA512(chainCode, 0x00 || k || i)


Here you can see that there is no possible way that you could compute this hmac without knowing k. Just knowing the public key K will not help.



It looks as though you need to use the deriveHardened function in bitcoinjs rather than plain derive.