BA-04 · LESSON 01

Private and public keys

KEY DEFINITIONS

Terms used in this lesson

Witness: Signatures, scripts, or other data supplied to satisfy a Bitcoin output’s spending condition.
Sighash: The exact transaction digest and signature mode that determine which fields a Bitcoin signature authorizes.
UTXO: Unspent transaction output: one discrete chunk of bitcoin that can be used as a transaction input.

A private key is the secret that authorizes a spend. A public key lets others verify that authorization, while an address describes where a payment can be locked.

35 min Difficulty 1/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · key to outputKeys authorize outputs; wallets organize the policySelect any state to inspect its exact role.

RELATIONSHIP MAPOrdered mechanism flow

01
PRIVATEScalar d1
The private key must be unpredictable and within the secp256k1 group order.
02
PUBLICP1 = d1G
The public point can be shared without revealing the scalar.
03
SCRIPTCommit HASH160(P1)
An output locks value to a spending condition, often derived from a public key.
04
OUTPUTValue and script
The output is the spendable protocol object, not the address text.
05
SIGNd1 authorizes P1 path
Authorization succeeds only under the exact committed key and transaction message.

Rule shown: A private scalar derives a public point, which can be committed by a spending script; the chain never stores a wallet account.

STAGE 1 OF 5PRIVATE: Scalar d1

The private key must be unpredictable and within the secp256k1 group order.

Governing relationship: A private scalar derives a public point, which can be committed by a spending script; the chain never stores a wallet account. Complete path: 1. PRIVATE, Scalar d1. The private key must be unpredictable and within the secp256k1 group order. 2. PUBLIC, P1 = d1G. The public point can be shared without revealing the scalar. 3. SCRIPT, Commit HASH160(P1). An output locks value to a spending condition, often derived from a public key. 4. OUTPUT, Value and script. The output is the spendable protocol object, not the address text. 5. SIGN, d1 authorizes P1 path. Authorization succeeds only under the exact committed key and transaction message.

1. State transitionWhat exists, what changes, and what results

BEFORE

Alice's wallet derives private key d and public key P, then displays an address encoding a condition tied to P.

MECHANISM

Wallet software obtains a valid secp256k1 scalar from secure randomness or a deterministic derivation tree. Anyone learning it can usually authorize its outputs.

AFTER

Keys authorize state transitions. Addresses communicate output conditions, and wallets coordinate discovery, construction, signing, and recovery.

Text equivalent: Starting from Alice's wallet derives private key d and public key P, then displays an address encoding a condition tied to P. The mechanism begins when Wallet software obtains a valid secp256k1 scalar from secure randomness or a deterministic derivation tree. Anyone learning it can usually authorize its outputs. The resulting lesson is Keys authorize state transitions. Addresses communicate output conditions, and wallets coordinate discovery, construction, signing, and recovery.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 5

Generate or derive a private key

Wallet software obtains a valid secp256k1 scalar from secure randomness or a deterministic derivation tree. Anyone learning it can usually authorize its outputs.

Complete path: 1. Generate or derive a private key: Wallet software obtains a valid secp256k1 scalar from secure randomness or a deterministic derivation tree. Anyone learning it can usually authorize its outputs. 2. Derive the public key: Elliptic-curve scalar multiplication produces the corresponding public point without exposing the private scalar. 3. Commit a spending condition: An output script or witness program commits to a public key, key hash, or more complex policy. An address is a checksummed human encoding used to request such an output. 4. Construct the transaction digest: When spending, the wallet builds a transaction and computes the exact signature hash required by the output type and chosen sighash mode. 5. Sign and verify: The wallet signs with the private key. Nodes use the public key and transaction context to verify authorization before consuming the output.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

The output condition, exact transaction digest, signature, and matching public key must all agree before nodes consume the UTXO.

CHANGED CONDITION

Changing the verification digest makes the retained signature fail under the real secp256k1 public key, so the prior output remains unspent. The displayed keys are disposable teaching fixtures, not operational wallet secrets.

Important distinction: Bitcoin is stored in a wallet's private-key file. Bitcoin amounts exist in blockchain outputs. The wallet stores or derives the authorization and metadata needed to find and spend matching outputs.

Text equivalent: The accepted path is enforced by The output condition, exact transaction digest, signature, and matching public key must all agree before nodes consume the UTXO. If the required condition changes, Changing the verification digest makes the retained signature fail under the real secp256k1 public key, so the prior output remains unspent. The displayed keys are disposable teaching fixtures, not operational wallet secrets.

Loading lesson visuals...

Learn the idea

A private key is secret signing material, and a public key is the corresponding value others use to verify signatures. A Bitcoin output does not store coins inside a key. It stores an amount and a spending condition. A wallet controls an output when it can produce the data that satisfies that condition.

GUIDED EXPLANATION1/5 ideas inspected

Generate or derive a private key

Wallet software obtains a valid secp256k1 scalar from secure randomness or a deterministic derivation tree. Anyone learning it can usually authorize its outputs.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“Bitcoin is stored in a wallet's private-key file.”

Bitcoin amounts exist in blockchain outputs. The wallet stores or derives the authorization and metadata needed to find and spend matching outputs.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.