<ul>
<li><p><strong>First</strong>, you can see on this forum <strong>how to calculate the public key from the private key</strong> using Elliptic Curve (EC) maths: <em><a href="https://bitcoin.stackexchange.com/questions/25024/how-do-you-get-a-bitcoin-public-key-from-a-private-key#29880">How do you get a Bitcoin Public Key from a Private Key</a></em></p>

<p>The G point stated there is the "base point" in EC and it is a known parameter. You can see all the parameters used by the EC used in bitcoin here:
<em><a href="https://en.bitcoin.it/wiki/Secp256k1" rel="nofollow noreferrer">https://en.bitcoin.it/wiki/Secp256k1</a></em></p>

<p>In brief, the EC for bitcoin is known as <em>secp256k1</em>: <em>y^2 = x^3 + 7</em>,
and the public key is formed by repetitive <a href="https://www.johannes-bauer.com/compsci/ecc/#anchor18" rel="nofollow noreferrer">point doubling and scalar point multiplications</a>.</p>

<p>So as you see, the problem is trying to <strong>reverse a series of modular multiplications</strong>, or what in EC maths is called <strong>the discrete logarithm problem</strong> (in analogy to the <em>real</em> discrete logarithm problem in other cryptosystems such as DSA and DH): given two points <strong>P</strong> and <strong>Q</strong> (which belong to a subgroup of an EC) find out the integer x that satisfies the equation <strong>Q = x·P</strong></p></li>
<li><p><strong>So now</strong> you can use different algorithms to try to reverse the operation: the most well known are <strong>the baby-step, giant-step algorithm</strong>, and <strong>Pollard's rho method</strong>.</p>

<p>You can find a step-by-step description of them here: <em><a href="http://andrea.corbellini.name/2015/06/08/elliptic-curve-cryptography-breaking-security-and-a-comparison-with-rsa/" rel="nofollow noreferrer">http://andrea.corbellini.name/2015/06/08/elliptic-curve-cryptography-breaking-security-and-a-comparison-with-rsa/</a></em></p></li>
</ul>

<p>I think this can serve as a start point.</p>

CC BY-SA 4.0
2019-05-22T09:18:34.387Z
How to find at least one private key from a large list of compressed public keys secp256k1 I assume that there are new methods and ways to do this. Please describe how this can be done? https://crypto.stackexchange.com/questions/70006/how-to-find-at-least-one-private-key-from-a-large-list-of-compressed-public-keys
Rozwrcd
CC BY-SA 4.0
2019-05-22T09:43:26.367Z
@Rozwrcd: what you ask is infeasible.
RedGrittyBrick
CC BY-SA 3.0
2018-01-29T19:31:10.243Z
2018-01-29T19:31:10.243Z
circulosmeos
<p>This is simply <strong>practically not possible</strong>; it's one of the basic premises of <a href="https://en.wikipedia.org/wiki/Public-key_cryptography" rel="nofollow noreferrer">public-key cryptography</a>:</p>

<blockquote>
  <p>The strength of a public key cryptography system relies on the computational effort (<em>work factor</em> in cryptography) required to find the private key from its paired public key. If so, effective security only requires keeping the private key private; the public key can be openly distributed without compromising security.</p>
</blockquote>

<p>Unless somebody breaks the cryptographic algorithm used to generate the keys, your best bet is to simply generate random keys and check whether the corresponding public key matches the one you already have. (Well, that's a slight exaggeration but you get the point.)</p>

CC BY-SA 3.0
2018-01-29T12:10:19.980Z
Yes, brute force the private key and check if generated public keys match is about the only conceivable method presently.
Willtech
CC BY-SA 3.0
2018-01-29T10:12:29.067Z
2018-01-29T10:19:50.140Z
2018-01-29T10:19:50.140Z
Glorfindel
<p>I think its not possible to get back the public key, someone would have applied supercomputing power to get back all the bitcoins and become super rich. </p>

CC BY-SA 3.0
2018-01-29T10:09:33.793Z
2018-01-29T10:09:33.793Z
Support Blockchain
<p>A public key is derived from a private key. To derive the public key you need an Elliptic Curve, Bitcoin chose to use secp256k1. Your public key is your private key multiplied by the generator point (which is a constant set in the secp256k1 standard), so it's a point on the curve</p>

CC BY-SA 4.0
2019-05-22T09:30:26.510Z
2019-05-22T09:30:26.510Z
Ammar Younis
<p>I did go thru a lot of articles which say's It's highly impossible to break the bitcoin public-key and get a private key from it.
I understand that the public key does hold some info of it's corresponding private key.
Can anyone suggest me some steps for manual calculation and reversing the scalar multiplication from the public key so I obtain the private key?
I'm not looking for any scripts for doing this but I'm looking for mathematical steps in-order to reverse the public key to private key.</p>

CC BY-SA 3.0
2018-01-29T12:11:29.480Z
The mathematical steps that you ask for are those required for breaking the public key cryptography system. Currently, those steps are unknown.
Willtech
CC BY-SA 4.0
2019-05-22T19:05:08.283Z
Ya may want to try the `math` stack, there's LaTeX support there instead of code highlighting... From what I've read if you can get the owner of a given address to sign things improperly, see the Wiki [Signature generation algorithm](https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm) (jump to _... `it is also crucial to select different k for different signatures`..._ specifically), it's then possible to solve for the private key without an exhaustive search. Side note, this could be used for _burning_ data via private keys intentionally revealed as a final transaction.
S0AndS0
<bitcoin-core><client><private-key><public-key><ecdsa>
Bitcoin public key to private key
Harvy Sam
# Bitcoin public key to private key

(Asked by: username_0 on 2018-01-29)

I did go thru a lot of articles which say's It's highly impossible to break the bitcoin public-key and get a private key from it.
I understand that the public key does hold some info of it's corresponding private key.
Can anyone suggest me some steps for manual calculation and reversing the scalar multiplication from the public key so I obtain the private key?
I'm not looking for any scripts for doing this but I'm looking for mathematical steps in-order to reverse the public key to private key.

**Tags:** bitcoin-core, client, private-key, public-key, ecdsa

> **Comments:**
> **username_1**: The mathematical steps that you ask for are those required for breaking the public key cryptography system. Currently, those steps are unknown.  
> **username_2**: Ya may want to try the `math` stack, there's LaTeX support there instead of code highlighting... From what I've read if you can get the owner of a given address to sign things improperly, see the Wiki [Signature generation algorithm](https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm) (jump to _... `it is also crucial to select different k for different signatures`..._ specifically), it's then possible to solve for the private key without an exhaustive search. Side note, this could be used for _burning_ data via private keys intentionally revealed as a final transaction.  

---

## 4 answers

### Answer by username_3 on 2018-01-29. Score: 3 | Accepted answer

* **First**, you can see on this forum **how to calculate the public key from the private key** using Elliptic Curve (EC) maths: *[How do you get a Bitcoin Public Key from a Private Key](https://bitcoin.stackexchange.com/questions/25024/how-do-you-get-a-bitcoin-public-key-from-a-private-key#29880)*

  The G point stated there is the "base point" in EC and it is a known parameter. You can see all the parameters used by the EC used in bitcoin here:
  *<https://en.bitcoin.it/wiki/Secp256k1>*

  In brief, the EC for bitcoin is known as *secp256k1*: *y^2 = x^3 + 7*,
  and the public key is formed by repetitive [point doubling and scalar point multiplications](https://www.johannes-bauer.com/compsci/ecc/#anchor18).

  So as you see, the problem is trying to **reverse a series of modular multiplications**, or what in EC maths is called **the discrete logarithm problem** (in analogy to the *real* discrete logarithm problem in other cryptosystems such as DSA and DH): given two points **P** and **Q** (which belong to a subgroup of an EC) find out the integer x that satisfies the equation **Q = x·P**
* **So now** you can use different algorithms to try to reverse the operation: the most well known are **the baby-step, giant-step algorithm**, and **Pollard's rho method**.

  You can find a step-by-step description of them here: *<http://andrea.corbellini.name/2015/06/08/elliptic-curve-cryptography-breaking-security-and-a-comparison-with-rsa/>*

I think this can serve as a start point.

> **Comments:**
> **username_4**: How to find at least one private key from a large list of compressed public keys secp256k1 I assume that there are new methods and ways to do this. Please describe how this can be done? https://crypto.stackexchange.com/questions/70006/how-to-find-at-least-one-private-key-from-a-large-list-of-compressed-public-keys  
> **username_5**: @username_4: what you ask is infeasible.  

---

### Answer by username_6 on 2018-01-29. Score: 4

This is simply **practically not possible**; it's one of the basic premises of [public-key cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography):

> The strength of a public key cryptography system relies on the computational effort (*work factor* in cryptography) required to find the private key from its paired public key. If so, effective security only requires keeping the private key private; the public key can be openly distributed without compromising security.

Unless somebody breaks the cryptographic algorithm used to generate the keys, your best bet is to simply generate random keys and check whether the corresponding public key matches the one you already have. (Well, that's a slight exaggeration but you get the point.)

> **Comments:**
> **username_1**: Yes, brute force the private key and check if generated public keys match is about the only conceivable method presently.  

---

### Answer by username_7 on 2018-01-29. Score: 0

I think its not possible to get back the public key, someone would have applied supercomputing power to get back all the bitcoins and become super rich.


---

### Answer by username_8 on 2019-05-22. Score: 0

A public key is derived from a private key. To derive the public key you need an Elliptic Curve, Bitcoin chose to use secp256k1. Your public key is your private key multiplied by the generator point (which is a constant set in the secp256k1 standard), so it's a point on the curve


---

