Many people imagine the private key and the public key as two halves of a pair, drawn together at the same moment. That's not what happens. There is only one number, and that number is the private key. The public key is a calculation made from it: whoever has the private key can calculate the public key in milliseconds, and reversing this process is something no one in the world knows how to do.
The private key is an integer, and nothing more than that: a number between 1 and a limit slightly below 2^256. There's no registration, no server, no issuing authority. Drawing a number within this range already means having a wallet, and that's what the previous module meant by repeating that whoever has the key moves the coins.
What transforms this number into a public key is an operation performed on a curve. Bitcoin's curve is called secp256k1, and its equation fits on one line: y² = x³ + 7. The drawing is not the smooth arc from schoolbooks: the coordinates are integers within a finite field, with p equal to 2^256 minus 2^32 minus 977. The graph is a cloud of scattered points, and the arithmetic of this cloud is the subject of the advanced track. Here, one rule is enough.
The rule is that two points on the curve, when added, give a third point on the same curve: draw a line through the two, see where it intersects the curve for the third time, and mirror this intersection to the other side of the axis. The result never escapes the curve.
There is a starting point, called G, the generator. It is not chosen by you or your wallet: it is written in the standard, with fixed coordinates, and it is the same point for all bitcoin wallets since the genesis block.
Your public key is G added to itself as many times as your private key is worth. If the private key is the number k, the public key is the point kG — a point multiplied by a number, an operation called scalar multiplication.
Adding G to itself a number of times of this magnitude, one by one, would take longer than the age of the universe — and yet the calculation is instantaneous. The trick is to double instead of adding. By adding the point to itself, you move two; by doubling, four; doubling again, eight. With 256 doublings and some additions in between, you can reach any point in the range.
The reverse has no trick. Given the point kG, knowing the start was G, discovering k is the discrete logarithm problem. After forty years of attempts, the best-known method still requires about 2^128 steps. Lesson 5 measures this number. For now, what matters is the shape of the asymmetry: easy in one direction, unfeasible in the other, like the hash function from the previous lesson — only here, on the other side, is not a file. It's your money.
The choice of the curve was strange at the time. The secp256k1 was published in 2000 by the SECG, a group linked to the Canadian company Certicom, and almost no one used it: the world worked with the P-256, from the American institute NIST. Satoshi chose the less used one. The parameters of secp256k1 are too simple to hide anything — the zero and seven in the equation, the p just below 2^256 —, while those of the P-256 come from constants that were never explained. In 2013, documents leaked by Edward Snowden showed that the NSA had paid ten million dollars to weaken another standard from the same family, the Dual_EC_DRBG. Nothing was ever proven against the P-256, and there are cryptographers who defend it to this day; what can be said is that the 2008 choice has aged well.
From this comes the most practical consequence of all: the private key never needs to leave the place where it was created. The device calculates the public key from it, and it is the public key that travels — it is what the network sees and what goes into the recipe for your address. A hardware wallet exists entirely because of this asymmetry — it stores the number and delivers the point.
What you send when you ask someone to pay you is not the public key. It is a shorter chain, which still carries a mechanism to reject a mistyped character. In the next lesson, the address constructed byte by byte.