First question comes from Karl. “Can you explain the cryptography employ than the Bitcoin network in digital signatures in a little more detail please.”
All right Karl, challenge accepted. I’ll give it my best.
The cryptography employed primarily in Bitcoin and in fact in almost all of the other crypto currencies is based on a field of mathematics called “elliptic curve cryptography”, and elliptic curve cryptography has been chosen for this task because in the field of elliptic curve basic arithmetic works almost the same as arithmetic in the real numbers or the integers with one important cash.
Addition and multiplication work exactly the same as normal arithmetic but there is no subtraction or division and so if you multiply two numbers together you can easily get the product of those numbers but, if you try to divide you cannot do that the only way to do division is to try all possible factors.
A brute force search and that is the basis on which elliptic curve cryptography operates. So this is effectively a one-way function and this type of one-way function is used in many different ways in cryptography.
Now you might be thinking: “how is it possible to create a one-way function?”. I think one of the best examples I’ve seen and you can see this online in a YouTube video in fact is comparing this to mixing paints. Let’s say I take a blue color and a yellow color. Is it easy to mix those two colorstogether? Very easy to mix them together. I can mix them together and it will produce some shade of green. Now if I show you that shade of green, can you tell exactly which two shades of blue and yellow I use to produce it? The truth is you can’t. If you’ve ever tried to paint your house and gone to the store and said can you make me the exact same colors I have on my walls you will quickly discover that people have difficulty doing that, they don’t know which paints you mixed exactly to produce that color.
So elliptic curve works in a very similar way. Digital signatures use some of the tricks of addition and multiplication, knowing that division is impossible, to produce a proof that the person who has created the digital signature had possession of the private key, but without revealing that private key, so when you produce a digital signature you are generating a number and that number is the result of multiplying and adding together a random number and your private key and producing a new number, which we can prove by comparing it to the public key that was produced by the private key, but we don’t know what the private key is.
So that little trick is how you do digital signatures. The digital signature allows you to prove that you know the private key and anyone who has the public key can check that it is a signature produced related to that public key so they know it’s from the private key but they don’t know what the private key is. So that proof of knowledge, knowing what the private key is without revealing the private key is the essence of digital signatures. The specific algorithm that’s used called ECDSA, or elliptic curve digital signature algorithm, is detailed in a bunch of different places, you can also find it in chapter 6 of “mastering Bitcoin”. On the github repository, for example, if you go and look under the section for ECDSA math, you will find a brief description of the formula that’s used.
Specifically, in order to create a digital signature, first we create a random number, and we use that randomnumber, which is called “the ephemeralprivate key” to produce a point on theelliptic curve by multiplying it with a generator point. And we then take the x-value of that, add to it our known private key and multiply that by the……sorry, we multiply that by our known private key and then we add that to the hash of the message, which produces a specific value, that we use as a part of our signature. And it’s better to look at the equation to understand how that works.
And if you don’t understand the equation – it doesn’t matter. The important thing to realize is this: a private key is a number, a public key is a point on the elliptic curve that’s produced by multiplying that private key number with a specific other point, called “the generator point”. And as long as you know the private key you can create the public key. If you know the public key you cannot figure out what the private key is. So that’s how the security of…That’s how the security of this system works.