<p>I usually use the following analogy to oversimplify things: The secret key is how far you walk along a known curve starting from a known point and the public point is where on the curve you wind up when you finish. If you repeat the same walk, you will always wind up at the same place. The operation is irreversible because the curve is complex, you can only figure out where you wind up by taking steps. Given a destination, you cannot figure out how to get there because you must walk in integer steps.</p>

CC BY-SA 3.0
2014-01-27T01:06:44.057Z
For being so simple, that analogy is surprisingly accurate!
Pieter Wuille
CC BY-SA 3.0
2014-01-24T12:41:49.190Z
2014-01-27T01:11:16.323Z
2014-01-27T01:11:16.323Z
David Schwartz
<p>This answer is probably too late for the OP, but it might clear things up for whoever ends up with the same question later. So here it goes:</p>

<p>I'm assuming you (as I did until a moment ago) have the misconception that the private key is also a pair of (x, y) coordinates in the elliptic curve, just as the public key. Well simple answer, it is not. The private key is actually just a number which here is called the "secret exponent". This number is multiplied by the Generator Point and that's how you get your public key.</p>

<p>So we have:</p>

<p>K = k * G</p>

<p>Where K is the public key, k is the private key and G is the generator point. So this generator point G; a constant given by the specification is the actual point here. Your private key is just a number. The number of times the generator point as to be added with itself to give you the public key. </p>

<p>This can be confusing because people keep calling that the "exponent" making it look like there are repeated multiplications here, when in fact what we have is repeated sums. So it should probably be called the "secret factor". But keep in mind that this is elliptic curve multiplication, not regular every day multiplication, so I assume you can name it however you want. </p>

<p>Is just that calling it "exponent" is somewhat misleading.</p>

CC BY-SA 3.0
2015-09-22T13:54:02.637Z
2015-09-22T13:54:02.637Z
Bilthon
<p>I'm trying to understand better how bitcoin works and I'm stuck. I've read a blog showing how to construct the WIF from the 256-bit secret integer and up to that point, I think I follow.</p>

<p>However I'm "lost" when it comes to the (X,Y) point.</p>

<p>In the following facetious example (where the 256-bit secret exponent as been set to '1' on purpose), what defines the value of X and Y?</p>

<p>A related question: for the same secret exponent ('1' in this case), could we have ended up with a different (X,Y)?</p>

<pre><code>secret exponent: 1
  hex:           1
WIF:             KwDiBf89QgGbjEhKnhXJuH7LrciVrZi3qYjgd9M7rFU73sVHnoWn
  uncompressed:  5HpHagT65TZzG1PH3CSu63k8DbpvD8s5ip4nEB3kEsreAnchuDf
public pair x:   55066263022277343669578718895168534326250603453777594175500187360389116729240
public pair y:   32670510020758816978083085130507043184471273380659243275938904335757337482424
  x as hex:      79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
  y as hex:      483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8
y parity:        even
key pair as sec: 0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
  uncompressed:  0479be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798\
                   483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8
hash160:         751e76e8199196d454941c45d1b3a323f1433bd6
  uncompressed:  91b24bf9f5288532960ac687abb035127b1d28a5
Bitcoin address: 1BgGZ9tcN4rm9KBzDn7KprQz87SZ26SAMH
  uncompressed:  1EHNa6Q4Jz2uvNExL497mE43ikXhwF6kZm
</code></pre>

<p>That example has been generated with an utility you can find here:</p>

<p><a href="http://blog.richardkiss.com/?p=371" rel="nofollow">http://blog.richardkiss.com/?p=371</a></p>

CC BY-SA 3.0
2014-01-23T20:18:35.770Z
What is your question? I only see a "related question".
Pieter Wuille
CC BY-SA 3.0
2014-01-23T20:23:46.277Z
@PieterWuille: *"what defines the value of X and Y?"*... It's in the paragraph above the one with the related question.  I want to know, once you have the secret exponent (the 256-bit integer, which is '1' in that example), how do you compute X and Y?
bitcoinNeverSleeps
CC BY-SA 3.0
2014-01-23T21:55:02.803Z
You want an explanation of the elliptic curve cryptography that is used to compute (X,Y)?
Pieter Wuille
CC BY-SA 3.0
2014-01-23T23:44:08.670Z
@Pieter Wuille: I want to know whether, for a given secret exponent, there is only one (X,Y) pair or an infinity of (X,Y) pairs. So in the example I gave I want to know if the secret exponent '1' shall *always* give X = 55066263... or not.  In other words: does *secret_exponent = 1* imply *X = 55066263..." or not!?
bitcoinNeverSleeps
CC BY-SA 3.0
2014-01-24T07:50:48.440Z
The answer is yes.
Pieter Wuille
CC BY-SA 3.0
2014-01-26T22:49:47.053Z
Unbelievable. Why do people downvote this? It's a very real technical question which has a definitve answer and most people don't know what the answer is.
bitcoinNeverSleeps
<address><address-generation><base58><secp256k1>
Does the 256-bit integer secret exponent define the X, Y pair?
bitcoinNeverSleeps
# Does the 256-bit integer secret exponent define the X, Y pair?

(Asked by: username_0 on 2014-01-23)

I'm trying to understand better how bitcoin works and I'm stuck. I've read a blog showing how to construct the WIF from the 256-bit secret integer and up to that point, I think I follow.

However I'm "lost" when it comes to the (X,Y) point.

In the following facetious example (where the 256-bit secret exponent as been set to '1' on purpose), what defines the value of X and Y?

A related question: for the same secret exponent ('1' in this case), could we have ended up with a different (X,Y)?

```
secret exponent: 1
  hex:           1
WIF:             KwDiBf89QgGbjEhKnhXJuH7LrciVrZi3qYjgd9M7rFU73sVHnoWn
  uncompressed:  5HpHagT65TZzG1PH3CSu63k8DbpvD8s5ip4nEB3kEsreAnchuDf
public pair x:   55066263022277343669578718895168534326250603453777594175500187360389116729240
public pair y:   32670510020758816978083085130507043184471273380659243275938904335757337482424
  x as hex:      79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
  y as hex:      483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8
y parity:        even
key pair as sec: 0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
  uncompressed:  0479be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798\
                   483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8
hash160:         751e76e8199196d454941c45d1b3a323f1433bd6
  uncompressed:  91b24bf9f5288532960ac687abb035127b1d28a5
Bitcoin address: 1BgGZ9tcN4rm9KBzDn7KprQz87SZ26SAMH
  uncompressed:  1EHNa6Q4Jz2uvNExL497mE43ikXhwF6kZm

```

That example has been generated with an utility you can find here:

<http://blog.richardkiss.com/?p=371>

**Tags:** address, address-generation, base58, secp256k1

> **Comments:**
> **username_1**: What is your question? I only see a "related question".  
> **username_0**: @username_1: *"what defines the value of X and Y?"*... It's in the paragraph above the one with the related question.  I want to know, once you have the secret exponent (the 256-bit integer, which is '1' in that example), how do you compute X and Y?  
> **username_1**: You want an explanation of the elliptic curve cryptography that is used to compute (X,Y)?  
> **username_0**: @username_1: I want to know whether, for a given secret exponent, there is only one (X,Y) pair or an infinity of (X,Y) pairs. So in the example I gave I want to know if the secret exponent '1' shall *always* give X = 55066263... or not.  In other words: does *secret_exponent = 1* imply *X = 55066263..." or not!?  
> **username_1**: The answer is yes.  
> **username_0**: Unbelievable. Why do people downvote this? It's a very real technical question which has a definitve answer and most people don't know what the answer is.  

---

## 2 answers

### Answer by username_2 on 2014-01-24. Score: 4

I usually use the following analogy to oversimplify things: The secret key is how far you walk along a known curve starting from a known point and the public point is where on the curve you wind up when you finish. If you repeat the same walk, you will always wind up at the same place. The operation is irreversible because the curve is complex, you can only figure out where you wind up by taking steps. Given a destination, you cannot figure out how to get there because you must walk in integer steps.

> **Comments:**
> **username_1**: For being so simple, that analogy is surprisingly accurate!  

---

### Answer by username_3 on 2015-09-22. Score: 2

This answer is probably too late for the OP, but it might clear things up for whoever ends up with the same question later. So here it goes:

I'm assuming you (as I did until a moment ago) have the misconception that the private key is also a pair of (x, y) coordinates in the elliptic curve, just as the public key. Well simple answer, it is not. The private key is actually just a number which here is called the "secret exponent". This number is multiplied by the Generator Point and that's how you get your public key.

So we have:

K = k \* G

Where K is the public key, k is the private key and G is the generator point. So this generator point G; a constant given by the specification is the actual point here. Your private key is just a number. The number of times the generator point as to be added with itself to give you the public key.

This can be confusing because people keep calling that the "exponent" making it look like there are repeated multiplications here, when in fact what we have is repeated sums. So it should probably be called the "secret factor". But keep in mind that this is elliptic curve multiplication, not regular every day multiplication, so I assume you can name it however you want.

Is just that calling it "exponent" is somewhat misleading.


---

