BA-02 · LESSON 04

Elliptic-curve keys

KEY DEFINITIONS

Terms used in this lesson

Taproot: A Bitcoin output and spending design that can combine a public-key path with privately committed alternative scripts.
BIP340: The Bitcoin Improvement Proposal specifying Schnorr signatures for the secp256k1 curve.

A private key is a secret number. Bitcoin multiplies it by a fixed curve point to create a public key, a one-way operation used to authorize spending.

65 min Difficulty 1/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · secp256k1 keyA private scalar selects one public curve pointSelect any state to inspect its exact role.

RELATIONSHIP MAPOrdered mechanism flow

01
SCALARk = 1
A valid private key is an integer from 1 through n minus 1.
02
GENERATORG on secp256k1
The curve and generator are fixed Bitcoin parameters.
03
MULTIPLY1G = G
Scalar multiplication repeats point addition using efficient double-and-add algorithms.
04
POINT0279be66...f81798
Compressed encoding stores the x coordinate plus one parity byte.
05
USEVerify authorization
Bitcoin scripts use the public point to verify a signature without revealing the private scalar.

Rule shown: The public key is k times the secp256k1 generator point; recovering k from the point is computationally infeasible.

STAGE 1 OF 5SCALAR: k = 1

A valid private key is an integer from 1 through n minus 1.

Governing relationship: The public key is k times the secp256k1 generator point; recovering k from the point is computationally infeasible. Complete path: 1. SCALAR, k = 1. A valid private key is an integer from 1 through n minus 1. 2. GENERATOR, G on secp256k1. The curve and generator are fixed Bitcoin parameters. 3. MULTIPLY, 1G = G. Scalar multiplication repeats point addition using efficient double-and-add algorithms. 4. POINT, 0279be66...f81798. Compressed encoding stores the x coordinate plus one parity byte. 5. USE, Verify authorization. Bitcoin scripts use the public point to verify a signature without revealing the private scalar.

1. State transitionWhat exists, what changes, and what results

BEFORE

Use y² = x³ + 2x + 2 modulo 17 with generator G = (5,1) of order 19. This tiny group is intentionally insecure, is not secp256k1, and exists only to make every addition inspe…

MECHANISM

A wallet uses a cryptographically secure random source or deterministic derivation to choose a valid scalar. Predictable values are unsafe.

AFTER

The public key is mathematically linked to the private key, but it is not an encrypted copy that can simply be decrypted.

Text equivalent: Starting from Use y² = x³ + 2x + 2 modulo 17 with generator G = (5,1) of order 19. This tiny group is intentionally insecure, is not secp256k1, and exists only to make every addition inspectable. The mechanism begins when A wallet uses a cryptographically secure random source or deterministic derivation to choose a valid scalar. Predictable values are unsafe. The resulting lesson is The public key is mathematically linked to the private key, but it is not an encrypted copy that can simply be decrypted.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 7

Sample a private scalar

A wallet uses a cryptographically secure random source or deterministic derivation to choose a valid scalar. Predictable values are unsafe.

Complete path: 1. Sample a private scalar: A wallet uses a cryptographically secure random source or deterministic derivation to choose a valid scalar. Predictable values are unsafe. 2. Add distinct points: For P=(x1,y1) and Q=(x2,y2), compute slope lambda=(y2-y1)(x2-x1)^-1 mod p, then x3=lambda^2-x1-x2 and y3=lambda(x1-x3)-y1 mod p. 3. Double one point: When P=Q, use lambda=(3x1^2+a)(2y1)^-1 mod p, then the same x3 and y3 formulas. Every inverse and coordinate is reduced modulo p. 4. Multiply the generator: Repeated point addition or double-and-add computes P=dG. The in-app secp256k1 engine returns the complete compressed point and records its on-curve check. 5. Encode the public point: A compressed secp256k1 public key stores the x-coordinate plus one byte identifying the y-coordinate parity. Taproot uses an x-only 32-byte representation under BIP340 rules. 6. Derive spending conditions: Bitcoin outputs commit to a public key or a hash or transformation of key and script data. The private scalar does not appear on chain. 7. Prove control by signing: A signature uses the private scalar to authorize a message, while verifiers use the public key and message to check it.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

The engine range-checks a 32-byte scalar, performs real secp256k1 generator multiplication, and compares the complete compressed public point.

CHANGED CONDITION

Scalar zero or a scalar at least the group order is rejected, while a claimed point for another scalar fails the exact comparison.

Important distinction: A Bitcoin address is the public key and the private key is stored inside it in encrypted form. An address encodes a spending condition. A public key may be part of that condition, while the private scalar remains separate and is not recoverable by decoding the address.

Text equivalent: The accepted path is enforced by The engine range-checks a 32-byte scalar, performs real secp256k1 generator multiplication, and compares the complete compressed public point. If the required condition changes, Scalar zero or a scalar at least the group order is rejected, while a claimed point for another scalar fails the exact comparison.

Loading lesson visuals...

Learn the idea

A Bitcoin private key is a nonzero integer in the secp256k1 group's allowed range. A public key is the elliptic-curve point obtained by multiplying the curve's generator point G by that private scalar. Scalar multiplication is easy to compute forward, while recovering the scalar from the public point is believed infeasible.

GUIDED EXPLANATION1/7 ideas inspected

Sample a private scalar

A wallet uses a cryptographically secure random source or deterministic derivation to choose a valid scalar. Predictable values are unsafe.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“A Bitcoin address is the public key and the private key is stored inside it in encrypted form.”

An address encodes a spending condition. A public key may be part of that condition, while the private scalar remains separate and is not recoverable by decoding the address.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.