Private Keys, Public Keys, and Signatures

A wallet doesn't hold coins. It holds a secret that lets you authorize moving them. This note covers what that secret is and how it relates to the public things the chain sees.

The idea

Public-key cryptography uses a pair of keys with an asymmetry:

• the private key is a secret number, kept by the owner
• the public key is computed from it, and can be shared with anyone

Computing the public key from the private key is easy. Going the other way is believed to be infeasible. A signature is a value only the holder of the private key could have produced, which anyone can check using the public key.

Elliptic curves in one page

Bitcoin and Ethereum use the curve secp256k1:

Points on this curve can be added to each other using a geometric rule, and a special point G, called the generator, is fixed by the standard. Adding G to itself d times is written as scalar multiplication:

The number of distinct multiples of G is a prime n, the group order, of about 2^256. A private key is just a number d in [1, n-1], and the public key is the point Q.

Why you can't go backwards

Given Q and G, finding d is the elliptic curve discrete logarithm problem. No known classical algorithm solves it for a well-chosen 256-bit curve in less than about 2^128 steps. Scalar multiplication in the forward direction takes only a few hundred point operations using double-and-add. That gap between easy forward and infeasible backward is the entire foundation.

A sufficiently large quantum computer running Shor's algorithm would break this, which is why post-quantum signatures are an active research area.

Public keys and addresses

A public key is a point (x, y). It's usually serialized as:

• 65 bytes uncompressed: a prefix byte plus x and y
• 33 bytes compressed: a prefix byte that records the parity of y, plus x. Since y² = x³ + 7, x plus one bit identifies y.

Addresses are shorter identifiers derived from the public key by hashing:

Ethereum:  address = last 20 bytes of Keccak-256(x ‖ y)
Bitcoin:   hash160 = RIPEMD-160(SHA-256(pubkey)),  then encoded with a checksum

Hashing also hides the public key until you spend, and the checksum in Bitcoin's encodings catches typos.

What a signature proves

To authorize a transaction, the owner signs the hash z = H(tx) with the private key d, producing a signature. The network checks it against the public key:

sign(d, z)      → σ
verify(Q, z, σ) → true / false

A valid signature shows two things: whoever made it knew d, and the transaction hasn't changed since, because altering it would change z. The private key itself is never revealed. Nothing in the signature lets a verifier work out d, as long as the signer follows the scheme properly, including never repeating the nonce.

Where keys come from

A private key is 256 bits drawn from a cryptographically secure random source. Wallets commonly derive many keys from a single seed using hierarchical deterministic derivation (BIP-32), and encode the seed as a mnemonic phrase (BIP-39), so one backup covers all of them.

The practical consequence: anyone who has the private key, or the seed, controls the funds. Nothing on-chain can undo that, which is the reason custody systems spend so much effort on how keys are stored and used.

Takeaways

• Private key: a random number d. Public key: the point Q = d·G. Address: a hash of the public key.
• Security rests on the discrete log problem being hard in the forward-easy, backward-hard direction.
• A signature binds a private key to a specific message hash without revealing the key.

Next: ECDSA and EdDSA Side by Side.