A signature on paper is always the same. You practiced it to make sure it looks the same every time, and it's this repetition that gives it authority. A digital signature is the opposite: if it appears the same twice, something is seriously wrong — and by the end of this lesson, you'll see how much money has been lost exactly this way.
Signing in Bitcoin involves producing two numbers from three things: your private key, the transaction you're authorizing, and a randomly chosen number at the moment. The two resulting numbers are called r and s, and they travel with the transaction. The calculation that produces them is covered in the advanced track; what it guarantees is relevant here.
The recipient of the transaction has the transaction, the public key, and the pair r, s. With these three things, and nothing else, anyone can perform a quick calculation and determine if those two numbers could only have come from someone with the corresponding private key. Verification takes microseconds, costs nothing, and requires no permission: that's why tens of thousands of nodes verify the same transaction without communicating with each other.
Notice what the verifier does not receive. They do not receive the private key, any part of it, and are not in a position to sign anything on your behalf. The signature does not contain the key: it is a consequence of the key, just as a footprint is a consequence of a foot and does not allow someone to recreate the foot.
The second point is what exactly is being signed, and this is where the most common misunderstanding lies. A bitcoin signature does not say "I authorize this person." It is calculated over the entire transaction content: the coins being input, the amounts, the destination addresses. Changing a satoshi's position after signing creates a different transaction, for which that signature simply doesn't work. No one can take your signature from yesterday and use it to send your money elsewhere today.
This leads to a practical consequence that wallets use all the time. Since signing doesn't move anything by itself, you can sign any message with the key of an address and show the result to someone. Whoever verifies it knows that you control that address, without a single coin moving. It's the honest way to prove ownership — and it's wise to be suspicious of anyone who proves it by asking you to transfer something.
The missing piece is the randomly chosen number, and it's the fragile part of the whole arrangement. This number, called a nonce, needs to be different and unpredictable for each signature. If the same key signs two different documents using the same nonce, the two signatures become a system of two equations, and the private key can be derived from it with high school algebra.
This is not hypothetical. In December 2010, at the Chaos Computer Club conference in Berlin, the group fail0verflow showed that Sony used a constant nonce to sign PlayStation 3 programs: the key authorizing all the console's software was deduced publicly. In August 2013, a flaw in Android's random number generator caused bitcoin wallets to repeat nonces without anyone noticing; the affected addresses were swept by those scouring the blockchain looking for exactly this.
The mathematics never failed. Implementations did, and the difference between the two is what the advanced track will explore in detail. Since 2021, Bitcoin also accepts a second type of signature, Schnorr, which is shorter and has a property the old one doesn't — multiple signatures can become one. This is a topic for another module.
You already know that a private key is a number, that the public key comes from it, that the address comes from the public key, and that the signature proves ownership without revealing anything. What's left is the question that supports all of this: why doesn't anyone simply try all the numbers until they find yours? In the next lesson, the size of 2^256.