Keys

Four days before Christmas 2013, a Bloomberg TV anchor named Matt Miller handed his two co-hosts a gift on air: paper certificates loaded with bitcoin, part of a cheerful "12 Days of Bitcoin" segment. For roughly ten seconds, the camera lingered on one certificate's QR code. That code encoded the private key. A viewer at home — a Reddit user called milkywaymasta — paused the frame, scanned the screen, and swept the funds before the segment ended. Nothing was hacked. No password was cracked. The ledger simply did what it always does: it obeyed the key. The sum was about twenty dollars; the lesson was priceless, and Miller took it graciously. Whoever knows the number owns the money. This module is about that number.

A Bitcoin private key is not a file, a password, or a certificate issued by anyone. It is a number — a 256-bit integer, picked at random from a range of about 1.16 × 10⁷⁷ possibilities. Nearly any number in range is a valid key; there is no registration, no issuer, no list. What turns a mere number into money is a one-way function: a computation easy to run forwards and computationally infeasible to run backwards. You met one already — the hash that fingerprints blocks. Bitcoin's ownership machinery stacks several one-way steps in a row, so that a secret can mint public artefacts — keys, addresses, signatures — which reveal nothing usable about the secret that made them. The whole craft of owning bitcoin is walking down that one-way street and never back up.

The first step: private key to public key. Bitcoin uses a curve called secp256k1, on which sits a fixed, public generator point G. Your public key is G "multiplied" by your private key — really, G added to itself along the curve that many times, which doubling shortcuts compute in a few hundred operations. Reversing it — recovering the multiplier from the result — is the elliptic-curve discrete logarithm problem, and the best known attacks need on the order of 2¹²⁸ curve operations: enough to keep every computer on Earth busy for longer than the universe has existed. Honesty requires two caveats. "Hard" means no efficient algorithm is known, not proven impossible; and a large, fault-tolerant quantum computer would one day change the game. Today, the wall stands.

The second step: public key to address. An address is not the public key; it is a hash of it — SHA-256 first, then RIPEMD-160, two different fingerprint functions stacked so that both would have to fail together — wrapped in a checksummed, human-copyable encoding such as the bech32 format behind bc1q… strings. The checksum exists for you: mistype a character and software rejects the string rather than sending coins into the void. So the full chain runs 256-bit secret → public key → 160-bit hash → address, every arrow one-way or checksum-only. You can print your address on a billboard. Making the reverse journey — address back to key — is precisely what the mathematics forbids.

Spending is the third act: the signature. To move coins, you sign the transaction — a computation combining your private key with the exact details of the spend — producing a proof that anyone can check against your public key in microseconds. A valid signature demonstrates two things at once: the key-holder authorised it, and authorised exactly this transaction, unaltered. It exposes nothing about the key, which is why one key can sign thousands of spends safely. Unless the signing is botched: ECDSA needs a fresh random nonce for every signature, and reusing one lets simple algebra extract the private key. Sony signed PlayStation 3 firmware with a constant nonce and lost its master signing key to three hackers on a Berlin stage in 2010; broken Android randomness repeated nonces in 2013 and wallets were drained straight off the public chain.

Now assemble the consequences, because they are unlike anything in banking. Ownership in Bitcoin is knowledge of a number — nothing more. There is no recovery desk, because no institution holds your account. No one can freeze the coins, because no intermediary sits between you and the ledger. No appeal exists, because the ledger obeys valid signatures with no opinion about who should control them — as Bloomberg's anchor learned when a viewer holding his key became, in every sense the protocol recognises, the owner. The same indifference that makes bitcoin seizure-resistant makes it unforgiving: leak the key and the coins are gone; lose the key and they are frozen in place forever, visible on the ledger and touchable by no one.

From here, a famous slogan stops being a slogan and becomes a theorem. If ownership is knowledge of the private key, then coins held "for you" on an exchange are coins whose keys the exchange knows and you do not. What you own is not bitcoin but a promise — an IOU from a company, exactly the trusted-third-party arrangement Module 1 showed Bitcoin was built to escape. "Not your keys, not your coins" — popularised by Andreas Antonopoulos across years of talks, though nobody can date its coining — is simply this deduction compressed. Nothing about it is moralising; it is a description of where control mechanically resides. The next module asks the question this one has been quietly assuming: where does a number nobody can guess actually come from?