Understanding Public Keys, Addresses, and Signatures in Crypto

Public-key cryptography underpins every cryptocurrency transaction. A private key is a randomly generated 256‑bit number, while the public key is derived from it using elliptic‑curve multiplication on the secp256k1 curve. This operation is fast in one direction but infeasible to reverse, ensuring that the public key cannot be used to recover the private key.

Key Pair Basics

Each wallet contains a pair of keys:

• Private key: the secret that signs transactions.
• Public key: the value shared publicly to verify signatures.

The private key can sign a transaction message, proving ownership of the associated address without revealing the key itself. Nodes verify the signature using the public key; a valid signature authorises the transfer.

From Public Key to Wallet Address

Wallet addresses are shortened, hashed representations of public keys. In Bitcoin, the 512‑bit uncompressed (or 257‑bit compressed) public key is hashed with SHA‑256 then RIPEMD‑160, a version byte and checksum are added, and the result is encoded in Base58Check. Ethereum hashes the 512‑bit public key with Keccak‑256 and uses the last 20 bytes, prefixed with “0x”. Addresses are easier to share and add a layer of protection against future quantum attacks, because an address that has never been used does not expose its public key on‑chain.

Compressed vs. Uncompressed Public Keys

Uncompressed public keys contain both x and y coordinates (65 bytes). Compressed keys store only the x coordinate and a single bit for the y parity (33 bytes), saving space and reducing transaction fees. Since 2012, most Bitcoin software defaults to compressed keys. Using a different compression format changes the derived address, which can cause confusion when importing keys.

Deterministic Wallets and Seed Phrases

Modern wallets generate a master seed from entropy encoded as a 12‑ or 24‑word mnemonic (BIP‑39). The seed is processed with PBKDF2 to produce a 512‑bit master seed, which BIP‑32 uses to derive a hierarchical tree of key pairs. The seed phrase is the root of all keys; anyone who obtains it can recreate every private key, public key, and address in the wallet.

Security Implications and Real‑World Failures

Secure key generation is essential. In July 2026, a firmware issue in the Coldcard hardware wallet caused weak private‑key generation, leading to the loss of roughly $116 million in Bitcoin. Earlier incidents, such as the 2013 Android SecureRandom vulnerability and a 2022 vanity‑address generator using a 32‑bit seed, illustrate how flawed randomness can compromise otherwise strong cryptography.

Why Public Keys Matter

Although users typically interact only with addresses and QR codes, understanding the underlying public‑key mathematics clarifies why losing a private key means permanent loss of funds and why sharing a public key or address poses no security risk.