Elliptic curves

Here’s the trapdoor at last. Bitcoin’s keys live on an elliptic curve — a gently looping shape with one magical feature: you can “add” points on it, hopping around the curve in a way that’s easy to do forwards and effectively impossible to undo. That asymmetry is what links your private and public keys.

A curve with an addition rule

An elliptic curve is the set of points satisfying an equation like y² = x³ + ax + b. What makes it special is a rule for “adding” two points: draw a straight line through them, find the third place it crosses the curve, and reflect that point across the x-axis. The result is defined to be the sum. It sounds arbitrary, but it obeys tidy algebraic laws — and it lets us do repeatable, well-defined jumps around the curve.

See the rule in action

Below is the smooth curve y² = x³ + 7 — the real-number version of the very curve Bitcoin uses. Drag P and Q along it. In “Add” mode a straight line is drawn through the two points to its third crossing, then reflected across the x-axis to give P + Q. Switch to “Double” to add a point to itself — the line becomes the tangent at P.

Drag P and Q along the curve.

The same rule, over a finite field

Bitcoin doesn’t use the smooth real curve. For cryptography the identical rule runs over a finite field — the whole numbers up to a huge prime, wrapping around like clock arithmetic. That shatters the tidy curve into a scatter of points, but “draw a line, take the third point, reflect” still works exactly the same. Start at the generator P and keep adding it — P, 2P, 3P… — and watch where the points land:

The trapdoor: scalar multiplication

Adding P to itself n times is called scalar multiplication: n × P. This is exactly how a public key is born:

Your PRIVATE key is a giant secret number, n.
Your PUBLIC key is the point you land on after adding the generator to itself n times: n × P.

Going forwards is easy — even for an astronomically large n, clever doubling lets a computer reach n × P in a flash. But going backwards — being shown the final point and asked “how many hops was that?” — is the “elliptic-curve discrete logarithm problem”, and nobody knows how to solve it. As the demo hints, the landing points give no clue about the number of steps.

That is the whole trapdoor in one line: public key = private key × generator. Easy to compute your public key from your secret; impossible to recover your secret from your public key. Bitcoin uses a specific curve, secp256k1 (y² = x³ + 7), over an unimaginably large field — so large that the number of possible private keys rivals the count of atoms in the observable universe.

You now have every ingredient: hard money’s missing digital form, peer-to-peer networks with no centre, hashes to fingerprint data, and keys and signatures to prove ownership. The next section assembles them into the thing itself — Bitcoin.

Key takeaways

Elliptic curves give the same security as RSA with much smaller keys (a 256-bit EC key ≈ a 3072-bit RSA key) — ideal for phones and chips.
Bitcoin’s trapdoor: your public key = your private key added to a generator point n times; easy forwards, impossible to reverse.

Check yourself

Why did Bitcoin choose elliptic curves over RSA?

How is a Bitcoin public key created from a private key?

Spotted an error or have feedback on this lesson? Suggest a correction ↗