<p>To validate transactions, Bitcoin uses Elliptic Curve cryptography. Specifically, an Elliptic Curve Digital Signature Algorithm (ECDSA) on the curve secp256k1.</p>

<p>ECDSA includes three important pieces of data. The private key (a large random number), the public key and a digital signature. These pieces of data have a mathematical relationship such that the public key and a digital signature can inexpensively be computed from the private key, but the private key cannot be computed inexpensively from either the public key or a single digital signature.</p>

<p>There also exists a mathematical relationship between the public key and a digital signature which allows anyone to inexpensively verify that a digital signature was computed from the same private key used to compute the public key. Knowledge of the private key is not required to know that a digital signature was computed from the same private key as the public key.</p>

<p><strong><em>How can we know that a digital signature is authentic without knowledge of the private key?</em></strong></p>

<p>By knowledge of the Elliptic Curve parameters and the four following equations...</p>

<p>(1) <strong>Qa = dA * G</strong></p>

<p>(2) <strong>P = k * G</strong></p>

<p>(3) <strong>S = k^-1 (z + dA * R) mod p</strong></p>

<p>(4) <strong>P = S^-1 * z * G + S^-1 * R * Qa</strong></p>

<p>where...</p>

<p><strong>Qa</strong> is the public key,</p>

<p><strong>dA</strong> is the private key,</p>

<p><strong>G</strong> is the point of reference in our curve parameters,</p>

<p><strong>P</strong> is a point on our Elliptic Curve,</p>

<p><strong>k</strong> is a large random number (not the private key),</p>

<p><strong>S</strong> is the second half of the digital signature,</p>

<p><strong>z</strong> is the hash of the message being signed (encoded as a large integer),</p>

<p><strong>R</strong> is the first half of the digital signature (and also the <strong>x</strong> coordinate of <strong>P</strong>),</p>

<p><strong>p</strong> is a very large prime number defined by our curve parameters.</p>

<p>And then, by substituting (1) into (4) we have...</p>

<p>(5) <strong>P = S^-1 * z * G + S^-1 * R * dA * G</strong></p>

<p>Factorizing (5) leaves us with...</p>

<p>(6) <strong>P = S^-1 (z + R * dA) * G</strong></p>

<p>Now, substituting in (2), we have...</p>

<p>(7) <strong>k * G = S^-1 (z + R * dA) * G</strong></p>

<p>Which can be simplified to...</p>

<p>(8) <strong>k = S^-1 (z + R * dA)</strong></p>

<p>Lastly, we invert <strong>k</strong> and <strong>S</strong> leaving us with...</p>

<p>(9) <strong>S = k^-1 (z + R * dA)</strong></p>

<p>Which is the equation first used to create the signature by the private key holder.</p>

<p>This proof informs us that if the <strong>x</strong> coordinate of <strong>P</strong> from (4) is equal to <strong>R</strong>, then the digital signature <strong>(R, S)</strong> was generated from the private key <strong>dA</strong>.</p>

<p>Please see <a href="http://kakaroto.homelinux.net/2012/01/how-the-ecdsa-algorithm-works/" rel="nofollow noreferrer">here</a> for a longer explanation and <a href="https://en.bitcoin.it/wiki/Secp256k1" rel="nofollow noreferrer">here</a> and <a href="https://github.com/bitcoinbook/bitcoinbook/blob/second_edition/ch04.asciidoc" rel="nofollow noreferrer">here</a> to understand how ECDSA is applied in the Bitcoin system.</p>

CC BY-SA 3.0
2018-01-04T21:22:26.857Z
2018-01-04T21:35:12.953Z
2018-01-04T21:35:12.953Z
Matthew Stannard
<p>technically you're not sending to a private key, but to public-key, and through blockchain and coin base other nodes noticed that the bitcoins were in that bitcoin address moved to another bitcoin address also when broadcasting the transaction while sending.</p>

<p>I apologize for not being word-perfect in English</p>

CC BY-SA 3.0
2018-01-04T18:15:52.613Z
2018-01-04T18:23:15.660Z
2018-01-04T18:23:15.660Z
Tailer
<p>Perhaps an ignorant question, my background is in finance not cryptography.  After a transaction is made and "signed" with the sender's private key, how can other nodes verify it without knowing the private key?</p>

<p>It seems in all the videos / text I've reviewed in trying to better understand Bitcoin &amp; blockchain tech, people quickly gloss over the transaction verification piece and don't really explain how it works.</p>

<p>Thanks.</p>

CC BY-SA 3.0
2018-01-04T18:05:43.670Z
By using Elliptic Curve cryptography. Specifically, an Elliptic Curve Digital Signature Algorithm (ECDSA) on the curve secp256k1. Would you like a full and detailed explanation of the mathematics and Bitcoin Script involved in validating transactions?
Matthew Stannard
CC BY-SA 3.0
2018-01-04T18:39:38.743Z
If you have an explanation in laymans terms, then sure.  If not, I know it will go way over my head hah.
Adam Smith
<private-key><transaction-verification>
Private Keys / Transaction Verification
Adam Smith
# Private Keys / Transaction Verification

(Asked by: username_0 on 2018-01-04)

Perhaps an ignorant question, my background is in finance not cryptography. After a transaction is made and "signed" with the sender's private key, how can other nodes verify it without knowing the private key?

It seems in all the videos / text I've reviewed in trying to better understand Bitcoin & blockchain tech, people quickly gloss over the transaction verification piece and don't really explain how it works.

Thanks.

**Tags:** private-key, transaction-verification

> **Comments:**
> **username_1**: By using Elliptic Curve cryptography. Specifically, an Elliptic Curve Digital Signature Algorithm (ECDSA) on the curve secp256k1. Would you like a full and detailed explanation of the mathematics and Bitcoin Script involved in validating transactions?  
> **username_0**: If you have an explanation in laymans terms, then sure.  If not, I know it will go way over my head hah.  

---

## 2 answers

### Answer by username_1 on 2018-01-04. Score: 2 | Accepted answer

To validate transactions, Bitcoin uses Elliptic Curve cryptography. Specifically, an Elliptic Curve Digital Signature Algorithm (ECDSA) on the curve secp256k1.

ECDSA includes three important pieces of data. The private key (a large random number), the public key and a digital signature. These pieces of data have a mathematical relationship such that the public key and a digital signature can inexpensively be computed from the private key, but the private key cannot be computed inexpensively from either the public key or a single digital signature.

There also exists a mathematical relationship between the public key and a digital signature which allows anyone to inexpensively verify that a digital signature was computed from the same private key used to compute the public key. Knowledge of the private key is not required to know that a digital signature was computed from the same private key as the public key.

***How can we know that a digital signature is authentic without knowledge of the private key?***

By knowledge of the Elliptic Curve parameters and the four following equations...

(1) **Qa = dA \* G**

(2) **P = k \* G**

(3) **S = k^-1 (z + dA \* R) mod p**

(4) **P = S^-1 \* z \* G + S^-1 \* R \* Qa**

where...

**Qa** is the public key,

**dA** is the private key,

**G** is the point of reference in our curve parameters,

**P** is a point on our Elliptic Curve,

**k** is a large random number (not the private key),

**S** is the second half of the digital signature,

**z** is the hash of the message being signed (encoded as a large integer),

**R** is the first half of the digital signature (and also the **x** coordinate of **P**),

**p** is a very large prime number defined by our curve parameters.

And then, by substituting (1) into (4) we have...

(5) **P = S^-1 \* z \* G + S^-1 \* R \* dA \* G**

Factorizing (5) leaves us with...

(6) **P = S^-1 (z + R \* dA) \* G**

Now, substituting in (2), we have...

(7) **k \* G = S^-1 (z + R \* dA) \* G**

Which can be simplified to...

(8) **k = S^-1 (z + R \* dA)**

Lastly, we invert **k** and **S** leaving us with...

(9) **S = k^-1 (z + R \* dA)**

Which is the equation first used to create the signature by the private key holder.

This proof informs us that if the **x** coordinate of **P** from (4) is equal to **R**, then the digital signature **(R, S)** was generated from the private key **dA**.

Please see [here](http://kakaroto.homelinux.net/2012/01/how-the-ecdsa-algorithm-works/) for a longer explanation and [here](https://en.bitcoin.it/wiki/Secp256k1) and [here](https://github.com/bitcoinbook/bitcoinbook/blob/second_edition/ch04.asciidoc) to understand how ECDSA is applied in the Bitcoin system.


---

### Answer by username_2 on 2018-01-04. Score: 0

technically you're not sending to a private key, but to public-key, and through blockchain and coin base other nodes noticed that the bitcoins were in that bitcoin address moved to another bitcoin address also when broadcasting the transaction while sending.

I apologize for not being word-perfect in English


---

