Keys

Four days before Christmas 2013, a Bloomberg TV anchor named Matt Miller handed his two co-hosts a gift on air: paper certificates loaded with bitcoin, part of a cheerful "12 Days of Bitcoin" segment. For roughly ten seconds, the camera lingered on one certificate's QR code. That code encoded the private keyA 256-bit secret number; whoever knows it can spend the coins locked to its public key. It is never "stored on the blockchain" — only proofs derived from it are.. A viewer at home — a Reddit user called milkywaymasta — paused the frame, scanned the screen, and swept the funds before the segment ended. Nothing was hacked. No password was cracked. The ledger simply did what it always does: it obeyed the key. The sum was about twenty dollars; the lesson was priceless, and Miller took it graciously. Whoever knows the number owns the money. This module is about that number.

A Bitcoin private keyA 256-bit secret number; whoever knows it can spend the coins locked to its public key. It is never "stored on the blockchain" — only proofs derived from it are. is not a file, a password, or a certificate issued by anyone. It is a number — a 256-bit integer, picked at random from a range of about 1.16 × 10⁷⁷ possibilities. Nearly any number in range is a valid key; there is no registration, no issuer, no list. What turns a mere number into money is a one-way function: a computation easy to run forwards and computationally infeasible to run backwards. You met one already — the hashThe fixed-size fingerprint of any data, from a one-way function: easy to compute, infeasible to reverse, and wildly different if one bit of input changes. that fingerprints blocks. Bitcoin's ownership machinery stacks several one-way steps in a row, so that a secret can mint public artefacts — keys, addresses, signatures — which reveal nothing usable about the secret that made them. The whole craft of owning bitcoin is walking down that one-way street and never back up.

The first step: private keyA 256-bit secret number; whoever knows it can spend the coins locked to its public key. It is never "stored on the blockchain" — only proofs derived from it are. to public keyThe point on the secp256k1 curve derived from a private key by one-way maths; safe to reveal, impossible (in practice) to reverse.. Bitcoin uses a curve called secp256k1, on which sits a fixed, public generator point G. Your public key is G "multiplied" by your private key — really, G added to itself along the curve that many times, which doubling shortcuts compute in a few hundred operations. Reversing it — recovering the multiplier from the result — is the elliptic-curve discrete logarithm problem, and the best known attacks need on the order of 2¹²⁸ curve operations: enough to keep every computer on Earth busy for longer than the universe has existed. Honesty requires two caveats. "Hard" means no efficient algorithm is known, not proven impossible; and a large, fault-tolerant quantum computer would one day changeThe output a transaction sends back to the spender's own wallet, because UTXOs must be consumed whole. the game. Today, the wall stands.

The second step: public keyThe point on the secp256k1 curve derived from a private key by one-way maths; safe to reveal, impossible (in practice) to reverse. to addressA short, checksummed encoding of the conditions for spending — usually a hash of a public key or script. An invoice identifier, not an account.. An address is not the public key; it is a hashThe fixed-size fingerprint of any data, from a one-way function: easy to compute, infeasible to reverse, and wildly different if one bit of input changes. of it — SHA-256 first, then RIPEMD-160, two different fingerprint functions stacked so that both would have to fail together — wrapped in a checksummed, human-copyable encoding such as the bech32 format behind bc1q… strings. The checksum exists for you: mistype a character and software rejects the string rather than sending coins into the void. So the full chain runs 256-bit secret → public key → 160-bit hash → address, every arrow one-way or checksum-only. You can print your address on a billboard. Making the reverse journey — address back to key — is precisely what the mathematics forbids.

Spending is the third act: the signatureA cryptographic proof, made with a private key, that the key-holder authorised this exact message — without revealing the key itself.. To move coins, you sign the transactionA signed message consuming existing UTXOs as inputs and creating new ones as outputs; the only way state ever changes in Bitcoin. — a computation combining your private keyA 256-bit secret number; whoever knows it can spend the coins locked to its public key. It is never "stored on the blockchain" — only proofs derived from it are. with the exact details of the spend — producing a proof that anyone can check against your public keyThe point on the secp256k1 curve derived from a private key by one-way maths; safe to reveal, impossible (in practice) to reverse. in microseconds. A valid signature demonstrates two things at once: the key-holder authorised it, and authorised exactly this transaction, unaltered. It exposes nothing about the key, which is why one key can sign thousands of spends safely. Unless the signing is botched: ECDSA needs a fresh random nonceThe counter a miner varies to change the block header's hash on each attempt — billions of guesses per second hunting one below the target. for every signature, and reusing one lets simple algebra extract the private key. Sony signed PlayStation 3 firmware with a constant nonce and lost its master signing key to three hackers on a Berlin stage in 2010; broken Android randomness repeated nonces in 2013 and wallets were drained straight off the public chain.

Now assemble the consequences, because they are unlike anything in banking. Ownership in Bitcoin is knowledge of a number — nothing more. There is no recovery desk, because no institution holds your account. No one can freeze the coins, because no intermediary sits between you and the ledger. No appeal exists, because the ledger obeys valid signatures with no opinion about who should control them — as Bloomberg's anchor learned when a viewer holding his key became, in every sense the protocol recognises, the owner. The same indifference that makes bitcoin seizure-resistant makes it unforgiving: leak the key and the coins are gone; lose the key and they are frozen in place forever, visible on the ledger and touchable by no one.

From here, a famous slogan stops being a slogan and becomes a theorem. If ownership is knowledge of the private keyA 256-bit secret number; whoever knows it can spend the coins locked to its public key. It is never "stored on the blockchain" — only proofs derived from it are., then coins held "for you" on an exchange are coins whose keys the exchange knows and you do not. What you own is not bitcoin but a promise — an IOU from a company, exactly the trusted-third-party arrangement Module 1 showed Bitcoin was built to escape. "Not your keys, not your coins" — popularised by Andreas Antonopoulos across years of talks, though nobody can date its coining — is simply this deduction compressed. Nothing about it is moralising; it is a description of where control mechanically resides. The next module asks the question this one has been quietly assuming: where does a number nobody can guess actually come from?