Private keys, public keys and secp256k1

Wonder

1. Why does multiplying a point by a number take milliseconds while reversing it would take longer than the age of the universe?
2. What makes secp256k1 structurally different from the NIST curves used in most other digital signatures?
3. How can a 32-byte value control assets worth billions without revealing who controls them?

Explore

1. A bitcoin private key is a random integer between 1 and n−1, where n is the order of the curve’s generator point. This number n is approximately 1.158 × 10^77, a 78-digit number, not far below the estimated number of atoms in the observable universe (about 10^80). The public key is derived by scalar multiplication: multiplying this integer k by the fixed generator point G on the elliptic curve. Because G is constant for all bitcoin users, each unique k produces a unique, deterministic point K on the curve.
2. The secp256k1 curve is defined by the equation y² = x³ + 7 over a prime field where p = 2^256 − 2^32 − 977. This specific parameter set was established in the SEC 2 standard by Certicom. The choice of secp256k1 in 2009 was unusual; it is a Koblitz curve, named after Neal Koblitz, whose special structure (an efficiently computable endomorphism) allows faster scalar multiplication, and whose parameters leave little room for hidden choices, unlike curves generated from unexplained random seeds. Satoshi Nakamoto never explained the selection.
3. Scalar multiplication is fast because implementations use the double-and-add algorithm, processing the binary representation of the private key bit by bit. Doubling a point and adding another point are basic curve operations that computers execute in microseconds. However, reversing this operation—deriving k from K and G—is known as the elliptic-curve discrete logarithm problem (ECDLP). No efficient classical algorithm for ECDLP on secp256k1 is known; brute-force searching the key space is computationally infeasible, providing roughly 128-bit security against classical attacks.
4. Public keys are serialized in specific formats for storage and transmission. An uncompressed public key is 65 bytes long, starting with the prefix 04 followed by the x and y coordinates. A compressed public key is 33 bytes, using prefixes 02 or 03 to indicate the parity of the y-coordinate, allowing reconstruction from just the x-coordinate. Taproot, activated in November 2021, utilizes a further optimization called x-only keys, which are 32 bytes and omit the prefix entirely, relying on the Schnorr signature scheme’s properties.
5. The relationship between private and public keys is strictly one-way. Sharing a public key reveals nothing about the private key because the discrete logarithm problem remains unsolved for this curve size. Conversely, holding the private key allows immediate computation of the corresponding public key. This asymmetry forms the foundation of bitcoin’s ownership model: anyone can verify that a signature was created by a specific private key without ever seeing the key itself.
6. To verify these mechanisms, open any block explorer and locate a transaction input. For a native SegWit (P2WPKH) spend, the witness holds the signature and the 33-byte compressed public key; for a Taproot key-path spend, the 32-byte key sits in the output itself and the witness holds only the signature. Compare this with the address in the previous output; while the address is a hash of the public key, the raw key appears here during spending. Note that the public key coordinates are hexadecimal strings representing points on the curve, distinct from the 20-byte and 32-byte hashes used in SegWit version 0 addresses.

Key facts

Exercise nine, six, three, one

Fact check

Dates, figures and claims checked against the published sources listed below.

• SEC 2: Recommended Elliptic Curve Domain Parameters (Certicom, 2010)
• A. M. Antonopoulos & D. A. Harding, Mastering Bitcoin, 3rd ed. (2023), ch. 4
• BIP340: Schnorr Signatures for secp256k1