jb_the math break

explainer · keys and elliptic curves

How a crypto key works, in six diagrams.

Every Bitcoin and Ethereum wallet is one secret number and one curve. No maths background needed: by the end you’ll know what a private key is, why the public key can’t be run backwards, and the one assumption all of it depends on.

  1. 1 · the one-way door
  2. 2 · the curve
  3. 3 · clock arithmetic
  4. 4 · the scale
  5. 5 · key to address
  6. 6 · signing
  7. the catch

1 · the big idea

A door that only opens one way

Your private key is just a random number, written d. Run it through a fixed recipe on a curve and out comes your public key, Q. You share Q with the world.

Going forward takes a laptop a fraction of a millisecond. Going backward, from Q to d, has no known shortcut. That gap is the entire security model.

d private key a random number Q public key a point on the curve × G · fast ~256 doubling steps, under 1 ms ? ÷ G · no known shortcut best known attack: ~2¹²⁸ steps
G is a fixed starting point everyone agrees on. Recovering d from Q is called the elliptic-curve discrete logarithm problem.

2 · the curve

Adding points with a ruler

Bitcoin and Ethereum both use the curve y² = x³ + 7, named secp256k1. Its points have a strange kind of addition. Draw a line through two points and it hits the curve exactly once more. Flip that point across the horizontal axis and you have their sum.

P Q line hits here R = P + Q flip y² = x³ + 7
add

Two points make a third

Line through P and Q, find the third crossing, flip it. That’s P + Q.

double

One point makes a second

To add P to itself, use the line that just touches the curve at P (the tangent). That’s 2P.

multiply

Repeat to multiply

“d · G” means adding G to itself d times. Doubling lets you jump: G, 2G, 4G, 8G… so even a 77-digit d takes only about 256 doublings.

3 · clock arithmetic

The real curve is scattered dots

Computers can’t store infinitely precise numbers, so the real system does all of this maths “on a clock”: every result wraps around a prime number, the way 13:00 wraps to 1 o’clock. The smooth curve turns into a cloud of dots with no visible pattern.

Here’s the same curve on a tiny clock of size 211. It has 199 points (counting a special “zero” point). Move the slider: that’s your private key. The highlighted dot is your public key. Notice how neighbouring keys land nowhere near each other.

Bitcoin’s real clock has 78 digits, not 3.

4 · the scale

Why guessing is hopeless

On the 211 clock, a computer finds a hidden key instantly by trying every option. The real curve has about 1.16 × 10⁷⁷ possible keys. The cleverest known method still needs roughly the square root of that: about 2¹²⁸ steps.

make a public key~2⁸ steps crack the 211 toy curve~2⁸ all Bitcoin mining, 1 year~2⁹⁵ hashes best attack on secp256k1~2¹²⁸ try every key2²⁵⁶
Each step right doubles the work. The gap between the top bar and the orange one is about 2¹²⁰: a billion billion billion billion times more work than it takes to make the key. That gap only holds as long as nobody finds a better method.

5 · key to address

From secret number to wallet address

Your address is a fingerprint (a hash) of your public key. Two different one-way steps sit between the secret and what people see. Here’s a fresh, real secp256k1 key, made in your browser right now and never sent anywhere.

private key d never shared public key Q revealed when you spend address shared freely × G curve maths hash SHA-256 / Keccak
private key d
—
public key Q (compressed)
—
fingerprint SHA-256(Q)
—

Demo only: a key shown on a web page is not safe to use. Bitcoin adds RIPEMD-160 after SHA-256; Ethereum takes the last 20 bytes of a Keccak-256 hash. The idea is the same.

6 · signing

Proving you own d without revealing it

To move funds, your wallet signs a message with d. Anyone can check the signature against Q, but the signature doesn’t give d away. This scheme is called ECDSA.

SIGN · on your device message → hash z private key d one-time kfresh every time r = x of k·G s = (z + r·d) / k (r, s) VERIFY · anyone message + (r, s) + public key Q valid ✓ / invalid ✗ If k is ever reused, or is even slightly predictable, two signatures are enough to solve for d. This is the most common way real keys are lost, and it needs no new maths at all.
live demo

Watch a reused k leak a key

Real secp256k1 maths in your browser, on a throwaway key.

open the demo → scan

Check what your code signs with

Paste a package.json or requirements.txt and see which libraries carry these assumptions.

scan dependencies →

the catch

“No known shortcut” is not “no shortcut”

Nobody has proven that reversing Q = d·G is hard. It’s hard because many smart people have tried for about 40 years and failed. That’s evidence, not a guarantee. Three things could open the door:

quantum

Shor’s algorithm

A large enough quantum computer solves this exact problem quickly. That’s known for certain (Shor, 1994); the hardware just doesn’t exist yet. This is “Y2Q”.

new maths

A better classical attack

A new shortcut on an ordinary computer. Unlikely on any given day, but AI is now producing real results on problems that stumped mathematicians for decades.

implementation

Bad randomness or reused k

The maths holds but the code leaks. This is how keys are actually lost today, and AI is getting faster at finding these bugs too.

sources

Check our work

  1. SEC 2: Recommended Elliptic Curve Domain Parameters, v2 (secp256k1 definition)
  2. FIPS 186-5: Digital Signature Standard (ECDSA)
  3. NIST SP 800-57 Part 1 Rev. 5: 256-bit curves give about 128-bit security
  4. Shor, Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer (1994/1997)
  5. Ethereum Yellow Paper: addresses from Keccak-256 of the public key
  6. BIP-340: Schnorr signatures for secp256k1 (on nonce generation)