BA-04 · LESSON 10

Private keys, public keys, and key hashes

KEY DEFINITIONS

Terms used in this lesson

Hash160: SHA-256 followed by RIPEMD-160, producing the 20-byte hash used by several Bitcoin spending conditions.
P2PKH: Pay to Public Key Hash, a legacy Bitcoin output template that commits to the hash of a public key.
P2WPKH: Pay to Witness Public Key Hash: a native SegWit output for one public-key hash.
SHA-256: A cryptographic hash function used throughout Bitcoin to produce fixed-size 256-bit digests.
RIPEMD-160: A 160-bit cryptographic hash function used in Bitcoin’s HASH160 construction.
Witness: Signatures, scripts, or other data supplied to satisfy a Bitcoin output’s spending condition.

Inspect valid scalar bounds, compressed curve points, public-key hashes, authorization, and the difference between a key, address, script, and spendable output.

45 min Difficulty 2/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · key anatomyOne private scalar becomes a validated public-key commitmentSelect any state to inspect its exact role.

RELATIONSHIP MAPOrdered mechanism flow

01
SCALARd = 1
A private key is an integer from 1 through group order minus 1.
02
POINTP = dG
Scalar multiplication derives an on-curve secp256k1 point.
03
ENCODING02 + 32-byte x
Compressed bytes must parse to a real point and preserve y parity.
04
KEY HASHHASH160(compressed P)
P2PKH and P2WPKH commit the exact serialized public key.
05
SIGNATUREVerify exact sighash
The full public point verifies authorization; its hash alone cannot.

Rule shown: Scalar range, on-curve point parsing, exact serialization, key hashing, and transaction authorization are separate checks.

STAGE 1 OF 5SCALAR: d = 1

A private key is an integer from 1 through group order minus 1.

Governing relationship: Scalar range, on-curve point parsing, exact serialization, key hashing, and transaction authorization are separate checks. Complete path: 1. SCALAR, d = 1. A private key is an integer from 1 through group order minus 1. 2. POINT, P = dG. Scalar multiplication derives an on-curve secp256k1 point. 3. ENCODING, 02 + 32-byte x. Compressed bytes must parse to a real point and preserve y parity. 4. KEY HASH, HASH160(compressed P). P2PKH and P2WPKH commit the exact serialized public key. 5. SIGNATURE, Verify exact sighash. The full public point verifies authorization; its hash alone cannot.

1. State transitionWhat exists, what changes, and what results

BEFORE

Use the disposable scalar 1, never a real wallet key.

MECHANISM

Zero, the group order, larger integers, and malformed byte lengths are invalid. Secure wallet software samples or derives a uniformly unpredictable valid scalar without modul…

AFTER

Private scalar, public point, serialized key, key hash, address, script, and output are six distinct layers.

Text equivalent: Starting from Use the disposable scalar 1, never a real wallet key. The mechanism begins when Zero, the group order, larger integers, and malformed byte lengths are invalid. Secure wallet software samples or derives a uniformly unpredictable valid scalar without modulo bias. The resulting lesson is Private scalar, public point, serialized key, key hash, address, script, and output are six distinct layers.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 5

Validate the private scalar

Zero, the group order, larger integers, and malformed byte lengths are invalid. Secure wallet software samples or derives a uniformly unpredictable valid scalar without modulo bias.

Complete path: 1. Validate the private scalar: Zero, the group order, larger integers, and malformed byte lengths are invalid. Secure wallet software samples or derives a uniformly unpredictable valid scalar without modulo bias. 2. Derive the curve point: Multiply the fixed generator G by private scalar d to obtain public point P. The reverse discrete-log problem is computationally infeasible at secp256k1 scale. 3. Serialize the public key: Compressed encoding stores x and one prefix that identifies y parity. A parser must prove that the bytes encode an actual point on secp256k1 rather than accepting any 33 bytes. 4. Hash only when the script requires it: HASH160 applies SHA-256 then RIPEMD-160 to the exact serialized public key. Changing compressed versus uncompressed encoding changes the hash even when both encodings represent the same curve point. 5. Connect the key to an output: A script commits a key, key hash, or aggregate key. The wallet finds matching outputs and signs the transaction commitment, while full nodes verify the signature and script.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

The scalar must be in range, the public bytes must parse to an on-curve point, the hash must use the exact serialization, and signature verification must use the committed message.

CHANGED CONDITION

Zero is not a key, arbitrary 33-byte input is not necessarily a public point, and a matching key hash does not authorize a different transaction message.

Important distinction: A public-key hash is a shorter public key that can verify signatures by itself. The hash is a commitment. The spend reveals a public key whose serialization must match the hash, then signature verification uses the full point.

Text equivalent: The accepted path is enforced by The scalar must be in range, the public bytes must parse to an on-curve point, the hash must use the exact serialization, and signature verification must use the committed message. If the required condition changes, Zero is not a key, arbitrary 33-byte input is not necessarily a public point, and a matching key hash does not authorize a different transaction message.

Loading lesson visuals...

Learn the idea

A Bitcoin private key is an integer from 1 through the secp256k1 group order minus 1. The corresponding public key is the curve point produced by scalar multiplication. A compressed public key is exactly 33 bytes: a 02 or 03 parity prefix followed by the 32-byte x coordinate. HASH160 of those serialized bytes is a separate 20-byte commitment commonly used by P2PKH and P2WPKH.

GUIDED EXPLANATION1/5 ideas inspected

Validate the private scalar

Zero, the group order, larger integers, and malformed byte lengths are invalid. Secure wallet software samples or derives a uniformly unpredictable valid scalar without modulo bias.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“A public-key hash is a shorter public key that can verify signatures by itself.”

The hash is a commitment. The spend reveals a public key whose serialization must match the hash, then signature verification uses the full point.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.