Keys and Digital Signatures
No bank checks Asha's identity before her payment goes through. The network does not even know her name. So how does every node know that "Asha pays Meera 4" really came from Asha, and that nobody changed the 4 to 40 along the way? The answer is a pair of keys and a digital signature.
The rule
Sign with the private key; anyone verifies with the public key.
- Private key. A very large secret number chosen at random; on Bitcoin and Ethereum it is 256 bits. Whoever knows it controls the funds tied to it.
- Public key. Computed from the private key using elliptic-curve mathematics. Easy to compute in that direction, infeasible to reverse.
- Address. A shorter identifier made by hashing the public key, sometimes with a format prefix and a checksum added. It is what you give people so they can pay you.
private key → public key → address
secret shareable shareableEach arrow is one-way.
A digital signature is computed from two things: the private key and the exact transaction data. Checking it takes three things: the signature, the transaction data and the public key. A valid signature answers two questions at once:
- Authenticity. Was this signed by whoever holds that key?
- Integrity. Is the data exactly what was signed? Change one digit and the check fails.
Signing hides nothing. The transaction and its signature are public, so everyone can read them and verify them. And there is no "forgot password": lose the private key and nobody can ever sign for those funds again.
The shortcut
For any "is this transaction genuine?" question, run the verify check: which key made the signature, what data did it cover, and is anything different now?
Asha signs
Her wallet signs "Asha pays Meera 4" with her private key and broadcasts the transaction together with the signature.
The traps: thinking the public key is secret (it is meant to be shared), thinking a signature encrypts the transaction (it does not), and thinking a lost private key can be reset (it cannot).
Drills
Answer fast — trust the rule.
Which of these must stay secret?
Meera wants Kabir to pay her. What should she send him?
An attacker changes the amount in a signed transaction but keeps the original signature. What happens?
Which statement about a signed transaction is true?
Why can nobody work out Asha's private key from her address?
Remember
- Sign with the private key; anyone verifies with the public key.
- Shortcut: which key signed, what data did it cover, and has anything changed? Any edit breaks the signature.
- Trap: signatures prove and protect but do not hide. A lost private key cannot be reset.