<p>Bitcoin uses <em>cryptography</em> to create digital signatures and cryptographic hash functions for various purposes such as transaction ids, block ids, and to commit to specific transactions in blocks. The Bitcoin protocol itself does not use encryption anywhere, but many wallets use encryption to secure private key material. There is also a Bitcoin Improvement Proposal (BIP) that aims to introduce encrypted peer-to-peer communication between Bitcoin nodes.</p>

<p>To follow-up on the question in the comments:</p>

<blockquote>
  <p>"You have a bit-stream and you use a means called 'private key' to generate a bit-stream based on the original and then you use a 'public key' to uncover the original bit-stream - you use encryption."</p>
</blockquote>

<p>The signatures in Bitcoin are created by means of the Elliptic Curve Digital Signature Algorithm (ECDSA). ECDSA uses two functions: </p>

<ul>
<li><code>sign(privkey, message)</code> which returns a signature</li>
<li><code>verify(pubkey, message, signature)</code> which returns <code>true</code> or <code>false</code></li>
</ul>

<p>ECDSA does not qualify as an encryption algorithm, because the signature does not transport the message and there is no way to "recover the original bit-stream" from the signature. The verification of the signature validates that the correct key committed to the given message. This happens by means of evaluating an equation testing a mathematical relationship the triplet of <code>pubkey,message,signature</code> must fulfill for a valid signature.</p>

<p>H/T Pieter Wuille, David Schwartz, and John Newbery for the helpful comments.</p>

CC BY-SA 4.0
2019-11-15T19:25:44.900Z
To create the signature in Bitcoin you use ENCRYPTION by mean of a variant of El-Gamal elliptic curve Private Key. To authenticate you use DECRYPTION to "open" the signature with Public Key. So why you claim that encryption is not used - unless the above is wrong? For some reason persons in the field "assume" that encryption is relevant only of you are encrypting the message itself - encryption of an HASH is still encryption.
Moti
CC BY-SA 4.0
2019-11-15T20:25:50.840Z
While ECDSA is closely related to ECIES, and they both use elliptic curve cryptography, the purpose of a signature algorithm is that of authenticating the origin of a message to any verifier whereas an encryption scheme's purpose is to obfuscate a message from anyone but the recipient who holds the corresponding secret. Given the different purposes, the algorithms differ in trade-offs and attack surface. ECDSA is not an encryption algorithm.
Murch
CC BY-SA 4.0
2019-11-15T21:44:36.560Z
The integrity of the document is assured by the hash (given the low probability to create a document with same hash). The user authentication is assured by encrypting the hash with the private key and later decrypt the encrypted hash with the public key (assuming that it is extremely difficult to find the private key). The purpose of the signature (thus the use of private key) is to authenticate the sender of the message and the purpose of the hash is to maintain the integrity of the message. Encryption is a process that maintains message while avoiding exposure. Hashing kills the message
Moti
CC BY-SA 4.0
2019-11-15T22:12:58.063Z
I am seeking a response to the argument - someone that claimed to be an expert on Bitcoin claimed that there is no ENCRYPTION and I am trying to understand what is wrong with my argument. As far as I understand, when you have a bit-stream and you use a means called "private key" to generate a bit-stream based on the original and than you use a "public key" to uncover the original bit-stream - you use encryption. And this what is done in Bitcoin to the best of my understanding, in Bitcoin. Am I wrong? Where?
Moti
CC BY-SA 4.0
2019-11-15T22:20:04.943Z
While the math is similar, it's not an encryption algorithm, because you're "encrypting" to public information. It's like saying steering a boat and locking a vault is the same thing because you turn a wheel. It's superficially similar, except in all the ways that matter.
Murch
CC BY-SA 4.0
2019-11-15T22:39:09.533Z
There is no encryption involved, and ECDSA is not an encryption algorithm. This is trivial to see because there is no way to "decrypt" and get the message hash back out of the signature, even if you'd have the private key. There is a sign(privkey,message) algorithm that produces a signature, and a verify(pubkey,message,signature) algorithm that returns true or false. Verification in no way "decrypts" the signature; it's just an equation that holds for valid signatures, and not otherwise.
Pieter Wuille
CC BY-SA 4.0
2019-11-17T08:21:35.737Z
I agree that ECDSA does not require the decryption, the only reason is because the HASH is available (the document). As result you could verify that the HASH was used to generate the encrypted version of it, that was sent with the document. I believe that the only reason for this is simplifying the computation rather than go through the decryption of the signature. So, is half decryption for convenience is regarded using encryption or not?:)
Moti
CC BY-SA 4.0
2019-11-17T21:46:21.853Z
Hi Moti. You seem unpersuaded by Pieter and Murch. Perhaps you'll find it more convincing from the person who invented Bitcoin: "Bitcoin does not use any encryption." (Satoshi Nakamoto, Bitcoin v0.1: https://github.com/bitcoin/bitcoin/blob/4405b78d6059e536c36974088a8ed4d9f0f29898/readme.txt#L36)
jnewbery
CC BY-SA 4.0
2019-11-18T19:04:27.280Z
@Moti Verification does not involve either decryption, or re-encrypting and comparing. It's simply this equation: a signature is a point R and a number s such that *sR = HASH(message)G + (R.x)P* (where *G* is a constant, and *P = dG* is the public key, with *d* the private key). Given *s* and *R*, and *P* (or even *d*), there is no way to compute even *HASH(message)*. Note that you cannot divide by a point - that's the computational hardness assumption ECDSA is based on.
Pieter Wuille
CC BY-SA 4.0
2019-11-19T05:24:40.410Z
"*As far as I understand, when you have a bit-stream and you use a means called 'private key' to generate a bit-stream based on the original and than you use a 'public key' to uncover the original bit-stream - you use encryption.*" Right, and bitcoin doesn't do this. There is no "uncover the original bit-stream". What exactly do you think is recovered?
David Schwartz
CC BY-SA 4.0
2019-11-19T20:42:03.830Z
I accept the fact that the intent is not to "hide" information but only to verify that the "signature" is authentic by means of the public key.
Moti
CC BY-SA 4.0
2019-11-19T22:36:28.290Z
@Moti (r=0x35c744204f46c0856598cdcc087657eb729c9b75c3c0046f034f9fcf27ab1d8f, s=0x2e0a825c693a34d7044562c0020d3157e621f714f80e1c79fe99957859cb096f) is a valid secp256k1 ECDSA signature for public key 0x0279BE667E F9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798 (the generator, with private key 1). If this is an encryption scheme, you should be able to figure out what the message (or even message hash) is (even without access to the private key, because verifiers generally don't have that). Turns out that recovering the message from the signature is just as hard as forging a signature.
Pieter Wuille
CC BY-SA 4.0
2019-11-15T18:57:36.063Z
2019-11-19T21:44:14.943Z
2019-11-19T21:44:14.943Z
Murch
<p>To the best of my understanding Bitcoin uses encryption to create the digital signature, basically, by encrypting the hashed message (transaction?).</p>

<p>Would like to get your expert opinion to my claim the encryption is used by the Bitcoin protocol/algorithm.</p>

<signature><encryption>
Bitcoin and encryption
Moti
# Bitcoin and encryption

(Asked by: username_0 on 2019-11-15)

To the best of my understanding Bitcoin uses encryption to create the digital signature, basically, by encrypting the hashed message (transaction?).

Would like to get your expert opinion to my claim the encryption is used by the Bitcoin protocol/algorithm.

**Tags:** signature, encryption


---

## 1 answers

### Answer by username_1 on 2019-11-15. Score: 4 | Accepted answer

Bitcoin uses *cryptography* to create digital signatures and cryptographic hash functions for various purposes such as transaction ids, block ids, and to commit to specific transactions in blocks. The Bitcoin protocol itself does not use encryption anywhere, but many wallets use encryption to secure private key material. There is also a Bitcoin Improvement Proposal (BIP) that aims to introduce encrypted peer-to-peer communication between Bitcoin nodes.

To follow-up on the question in the comments:

> "You have a bit-stream and you use a means called 'private key' to generate a bit-stream based on the original and then you use a 'public key' to uncover the original bit-stream - you use encryption."

The signatures in Bitcoin are created by means of the Elliptic Curve Digital Signature Algorithm (ECDSA). ECDSA uses two functions:

* `sign(privkey, message)` which returns a signature
* `verify(pubkey, message, signature)` which returns `true` or `false`

ECDSA does not qualify as an encryption algorithm, because the signature does not transport the message and there is no way to "recover the original bit-stream" from the signature. The verification of the signature validates that the correct key committed to the given message. This happens by means of evaluating an equation testing a mathematical relationship the triplet of `pubkey,message,signature` must fulfill for a valid signature.

H/T username_2 username_2, username_4 username_4, and John Newbery for the helpful comments.

> **Comments:**
> **username_0**: To create the signature in Bitcoin you use ENCRYPTION by mean of a variant of El-Gamal elliptic curve Private Key. To authenticate you use DECRYPTION to "open" the signature with Public Key. So why you claim that encryption is not used - unless the above is wrong? For some reason persons in the field "assume" that encryption is relevant only of you are encrypting the message itself - encryption of an HASH is still encryption.  
> **username_1**: While ECDSA is closely related to ECIES, and they both use elliptic curve cryptography, the purpose of a signature algorithm is that of authenticating the origin of a message to any verifier whereas an encryption scheme's purpose is to obfuscate a message from anyone but the recipient who holds the corresponding secret. Given the different purposes, the algorithms differ in trade-offs and attack surface. ECDSA is not an encryption algorithm.  
> **username_0**: The integrity of the document is assured by the hash (given the low probability to create a document with same hash). The user authentication is assured by encrypting the hash with the private key and later decrypt the encrypted hash with the public key (assuming that it is extremely difficult to find the private key). The purpose of the signature (thus the use of private key) is to authenticate the sender of the message and the purpose of the hash is to maintain the integrity of the message. Encryption is a process that maintains message while avoiding exposure. Hashing kills the message  
> **username_0**: I am seeking a response to the argument - someone that claimed to be an expert on Bitcoin claimed that there is no ENCRYPTION and I am trying to understand what is wrong with my argument. As far as I understand, when you have a bit-stream and you use a means called "private key" to generate a bit-stream based on the original and than you use a "public key" to uncover the original bit-stream - you use encryption. And this what is done in Bitcoin to the best of my understanding, in Bitcoin. Am I wrong? Where?  
> **username_1**: While the math is similar, it's not an encryption algorithm, because you're "encrypting" to public information. It's like saying steering a boat and locking a vault is the same thing because you turn a wheel. It's superficially similar, except in all the ways that matter.  
> **username_2**: There is no encryption involved, and ECDSA is not an encryption algorithm. This is trivial to see because there is no way to "decrypt" and get the message hash back out of the signature, even if you'd have the private key. There is a sign(privkey,message) algorithm that produces a signature, and a verify(pubkey,message,signature) algorithm that returns true or false. Verification in no way "decrypts" the signature; it's just an equation that holds for valid signatures, and not otherwise.  
> **username_0**: I agree that ECDSA does not require the decryption, the only reason is because the HASH is available (the document). As result you could verify that the HASH was used to generate the encrypted version of it, that was sent with the document. I believe that the only reason for this is simplifying the computation rather than go through the decryption of the signature. So, is half decryption for convenience is regarded using encryption or not?:)  
> **username_3**: Hi username_0. You seem unpersuaded by username_2 and username_1. Perhaps you'll find it more convincing from the person who invented Bitcoin: "Bitcoin does not use any encryption." (Satoshi Nakamoto, Bitcoin v0.1: https://github.com/bitcoin/bitcoin/blob/4405b78d6059e536c36974088a8ed4d9f0f29898/readme.txt#L36)  
> **username_2**: @username_0 Verification does not involve either decryption, or re-encrypting and comparing. It's simply this equation: a signature is a point R and a number s such that *sR = HASH(message)G + (R.x)P* (where *G* is a constant, and *P = dG* is the public key, with *d* the private key). Given *s* and *R*, and *P* (or even *d*), there is no way to compute even *HASH(message)*. Note that you cannot divide by a point - that's the computational hardness assumption ECDSA is based on.  
> **username_4**: "*As far as I understand, when you have a bit-stream and you use a means called 'private key' to generate a bit-stream based on the original and than you use a 'public key' to uncover the original bit-stream - you use encryption.*" Right, and bitcoin doesn't do this. There is no "uncover the original bit-stream". What exactly do you think is recovered?  
> **username_0**: I accept the fact that the intent is not to "hide" information but only to verify that the "signature" is authentic by means of the public key.  
> **username_2**: @username_0 (r=0x35c744204f46c0856598cdcc087657eb729c9b75c3c0046f034f9fcf27ab1d8f, s=0x2e0a825c693a34d7044562c0020d3157e621f714f80e1c79fe99957859cb096f) is a valid secp256k1 ECDSA signature for public key 0x0279BE667E F9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798 (the generator, with private key 1). If this is an encryption scheme, you should be able to figure out what the message (or even message hash) is (even without access to the private key, because verifiers generally don't have that). Turns out that recovering the message from the signature is just as hard as forging a signature.  

---

