<p>Here's a short explanation that might help you understand it. It's grossly oversimplified but just designed to help you get the general idea.</p>

<p>Imagine a world in which multiplication and addition were irreversible. That is, division and subtraction do not exist. It is not too difficult mathematically to create a world where division and subtraction are trillions of times more difficult than multiplication and addition, so for practical purposes, division and subtraction are impossible.</p>

<p>Now, let's say we all agreed on a very large number. Call it G. It's some big number we all agree on.</p>

<p>Now, you can pick a random number and store this someplace very safe. Call it your "private key", S (for secret). Now, multiply it by G. Call the result your "public key", P. You can tell anyone your public key. Since they can't divide it by G, your private key will stay private.</p>

<p>Now, say you want to "sign" something, O. What you do is you take that something, add your secret key to it, and publish the resulting number. So you publish: <code>O+S</code>, that's your signature</p>

<p>First, nobody can tell your private key from that number. They'd have to subtract, and that's not practical. And nobody else can produce that number, they'd have to know your private key to know what to add to O.</p>

<p>So all we need is for someone to be able to prove that's the "right" number and we're there -- and they can do that. Why? Because <code>G * (O+S) = G * O + G * S</code>.</p>

<p>They know what you claim is <code>O+S</code> ... the signature. <code>G*S</code> is your public key. And they know <code>O</code>. So with just some addition and multiplication, they can compute both <code>G * (O+S)</code> and <code>G*O + G*S</code>. So they can check if the number you published really is <code>O+S</code> if those two are equal, thus that the person who computed it knew your private key, and thus it functions as a signature.</p>

<p>The challenge, of course, is to create systems in which multiplication and addition are possible but subtraction and division are not. And there the math gets complicated. Bitcoin uses a <a href="http://en.wikipedia.org/wiki/Elliptic_curve_cryptography" rel="nofollow">system where division requires discrete logarithms</a> and a change to the algorithm so that it doesn't matter if addition is reversible.</p>

CC BY-SA 3.0
2012-01-05T03:51:30.730Z
Excellent explanation, thank you.  On another note I was reading on the wikipedia link you gave and it said this: "The hardest ECC scheme (publicly) broken to date had a 112-bit key for the prime field case and a 109-bit key for the binary field case. For the prime field case this was broken in July 2009 using a cluster of over 200 PlayStation 3 game consoles and could have been finished in 3.5 months using this cluster when running continuously (see [17])."  Am I correct when to think that Bitcoin uses 2^80 bit key?
shoeless joe
CC BY-SA 3.0
2012-01-05T06:23:30.807Z
Bitcoin uses 256-bit keys, specifically [secp256k1](http://www.secg.org/index.php?action=secg,docs_secg).
David Schwartz
CC BY-SA 3.0
2012-01-04T03:06:20.083Z
2012-01-04T04:41:20.943Z
2012-01-04T04:41:20.943Z
David Schwartz
<p>Wikipedia is a wonderful source for this. First, note that there is no <a href="http://en.wikipedia.org/wiki/Encryption" rel="nofollow">encryption</a> in the Bitcoin protocol - there are techniques from the more general field of <a href="http://en.wikipedia.org/wiki/Cryptography" rel="nofollow">cryptography</a>, such as <a href="http://en.wikipedia.org/wiki/Digital_signature" rel="nofollow">digital signatures</a> and <a href="http://en.wikipedia.org/wiki/Hash_function" rel="nofollow">hashing</a>.</p>

<p>Digital signatures are an example of <a href="http://en.wikipedia.org/wiki/Public-key_cryptography" rel="nofollow">public-key cryptography</a>, which can be used not only for digital signatures but for a type of encryption which is different from traditional <a href="http://en.wikipedia.org/wiki/Symmetric_encryption" rel="nofollow">symmetric encryption</a>.</p>

<p>Specifically, Bitcoin uses <a href="http://en.wikipedia.org/wiki/Elliptic_Curve_DSA" rel="nofollow">Elliptic Curve DSA</a> for digital signatures and <a href="http://en.wikipedia.org/wiki/SHA-2" rel="nofollow">SHA-2</a> for hashing - <a href="http://blog.ezyang.com/2011/06/the-cryptography-of-bitcoin/" rel="nofollow">here</a> is a nice review of how they are used.</p>

<p>You might also want to read up on <a href="http://en.wikipedia.org/wiki/RSA_%28algorithm%29" rel="nofollow">RSA</a> which is a very well-known public-key cryptosystem, though not used in Bitcoin.</p>

CC BY-SA 3.0
2012-08-15T02:19:31.190Z
What encryption is used for the wallet passphrase encryption in the Bitcoin.org client?
Stephen Gornick
CC BY-SA 3.0
2012-01-04T05:44:22.837Z
2012-01-04T05:44:22.837Z
Meni Rosenfeld
<p>Small clarification - encryption is generally a topic about obscuring data so it can't be read. If you are interested in the algorithms of signing things, you are not looking for encryption, but you are looking for signature algorithms.</p>

<p>Signature algorithms are generally a topic about mathematically showing that only you could've sent the data, while not necessary obscuring it.</p>

<p>For the signature algorithms used in Bitcoin:</p>

<ol>
<li><a href="http://www.google.com/search?q=ecdsa" rel="nofollow noreferrer">Google for ECDSA</a>.</li>
<li><a href="http://en.wikipedia.org/wiki/Elliptic_Curve_DSA" rel="nofollow noreferrer">Wikipedia entry for ECDSA</a>.</li>
<li><a href="https://en.bitcoin.it/wiki/ECDSA" rel="nofollow noreferrer">Bitcoin Wiki entry for ECDSA</a>.</li>
</ol>

<p>Generally, look into topic of Digital Signature Algorithms in general, and Elliptic Curve Digital Signature Algorithm in particular.</p>

<p>This topic is a field of cryptography, and is not Bitcoin specific. If you have more questions regarding it, you should check out <a href="https://crypto.stackexchange.com/">Crypto SE</a>.</p>

CC BY-SA 3.0
2012-01-03T21:50:39.093Z
2017-08-18T11:07:45.347Z
2017-08-18T11:07:45.347Z
ThePiachu
<p>Where can I go to read up on encryption methods used in Bitcoin? I am particularly interested in the idea that I can use a private key to sign something and it proves to the world I have the private key but yet does not reveal the actual key.  This is a topic of mystery to me, how this is done.</p>

<encryption>
Where can I go to read up on encryption methods used in Bitcoin?
shoeless joe
# Where can I go to read up on encryption methods used in Bitcoin?

(Asked by: username_0 on 2012-01-03)

Where can I go to read up on encryption methods used in Bitcoin? I am particularly interested in the idea that I can use a private key to sign something and it proves to the world I have the private key but yet does not reveal the actual key. This is a topic of mystery to me, how this is done.

**Tags:** encryption


---

## 3 answers

### Answer by username_1 on 2012-01-04. Score: 3 | Accepted answer

Here's a short explanation that might help you understand it. It's grossly oversimplified but just designed to help you get the general idea.

Imagine a world in which multiplication and addition were irreversible. That is, division and subtraction do not exist. It is not too difficult mathematically to create a world where division and subtraction are trillions of times more difficult than multiplication and addition, so for practical purposes, division and subtraction are impossible.

Now, let's say we all agreed on a very large number. Call it G. It's some big number we all agree on.

Now, you can pick a random number and store this someplace very safe. Call it your "private key", S (for secret). Now, multiply it by G. Call the result your "public key", P. You can tell anyone your public key. Since they can't divide it by G, your private key will stay private.

Now, say you want to "sign" something, O. What you do is you take that something, add your secret key to it, and publish the resulting number. So you publish: `O+S`, that's your signature

First, nobody can tell your private key from that number. They'd have to subtract, and that's not practical. And nobody else can produce that number, they'd have to know your private key to know what to add to O.

So all we need is for someone to be able to prove that's the "right" number and we're there -- and they can do that. Why? Because `G * (O+S) = G * O + G * S`.

They know what you claim is `O+S` ... the signature. `G*S` is your public key. And they know `O`. So with just some addition and multiplication, they can compute both `G * (O+S)` and `G*O + G*S`. So they can check if the number you published really is `O+S` if those two are equal, thus that the person who computed it knew your private key, and thus it functions as a signature.

The challenge, of course, is to create systems in which multiplication and addition are possible but subtraction and division are not. And there the math gets complicated. Bitcoin uses a [system where division requires discrete logarithms](http://en.wikipedia.org/wiki/Elliptic_curve_cryptography) and a change to the algorithm so that it doesn't matter if addition is reversible.

> **Comments:**
> **username_0**: Excellent explanation, thank you.  On another note I was reading on the wikipedia link you gave and it said this: "The hardest ECC scheme (publicly) broken to date had a 112-bit key for the prime field case and a 109-bit key for the binary field case. For the prime field case this was broken in July 2009 using a cluster of over 200 PlayStation 3 game consoles and could have been finished in 3.5 months using this cluster when running continuously (see [17])."  Am I correct when to think that Bitcoin uses 2^80 bit key?  
> **username_1**: Bitcoin uses 256-bit keys, specifically [secp256k1](http://www.secg.org/index.php?action=secg,docs_secg).  

---

### Answer by username_2 on 2012-01-04. Score: 3

Wikipedia is a wonderful source for this. First, note that there is no [encryption](http://en.wikipedia.org/wiki/Encryption) in the Bitcoin protocol - there are techniques from the more general field of [cryptography](http://en.wikipedia.org/wiki/Cryptography), such as [digital signatures](http://en.wikipedia.org/wiki/Digital_signature) and [hashing](http://en.wikipedia.org/wiki/Hash_function).

Digital signatures are an example of [public-key cryptography](http://en.wikipedia.org/wiki/Public-key_cryptography), which can be used not only for digital signatures but for a type of encryption which is different from traditional [symmetric encryption](http://en.wikipedia.org/wiki/Symmetric_encryption).

Specifically, Bitcoin uses [Elliptic Curve DSA](http://en.wikipedia.org/wiki/Elliptic_Curve_DSA) for digital signatures and [SHA-2](http://en.wikipedia.org/wiki/SHA-2) for hashing - [here](http://blog.ezyang.com/2011/06/the-cryptography-of-bitcoin/) is a nice review of how they are used.

You might also want to read up on [RSA](http://en.wikipedia.org/wiki/RSA_%28algorithm%29) which is a very well-known public-key cryptosystem, though not used in Bitcoin.

> **Comments:**
> **username_3**: What encryption is used for the wallet passphrase encryption in the Bitcoin.org client?  

---

### Answer by username_4 on 2012-01-03. Score: 0

Small clarification - encryption is generally a topic about obscuring data so it can't be read. If you are interested in the algorithms of signing things, you are not looking for encryption, but you are looking for signature algorithms.

Signature algorithms are generally a topic about mathematically showing that only you could've sent the data, while not necessary obscuring it.

For the signature algorithms used in Bitcoin:

1. [Google for ECDSA](http://www.google.com/search?q=ecdsa).
2. [Wikipedia entry for ECDSA](http://en.wikipedia.org/wiki/Elliptic_Curve_DSA).
3. [Bitcoin Wiki entry for ECDSA](https://en.bitcoin.it/wiki/ECDSA).

Generally, look into topic of Digital Signature Algorithms in general, and Elliptic Curve Digital Signature Algorithm in particular.

This topic is a field of cryptography, and is not Bitcoin specific. If you have more questions regarding it, you should check out [Crypto SE](https://crypto.stackexchange.com/).


---

