What is public-key cryptography?

Public-key cryptography gives each person a private key that stays secret and a public key that anyone can see. A signature made with the private key can be checked with the public key, so no secret has to be shared in advance.

Also called asymmetric cryptography or public key cryptography.

How a key pair works

A key pair is two linked values, where the public value is easy to compute from the private one and very hard to reverse. Diffie and Hellman described the idea in 1976, and Rivest, Shamir and Adleman gave a working scheme for both encryption and signatures in 1977.

What a signature proves

A digital signature shows that the holder of a private key approved a message, and anyone can check that claim with the public key. Diffie and Hellman described this as the equivalent of a written signature, and Rivest, Shamir and Adleman noted that a signer cannot later deny one. On Bitcoin, the usual spend needs a signature like this one.

Why the public key becomes a liability

  • A public key is meant to be shared, so once it appears on the chain, anyone can read it.
  • On Bitcoin, an address is a hash of the public key, and the public key appears on the chain when its coins are spent.
  • Ordinary computers cannot feasibly recover a private key from its public key, which is why a public key can be shared without exposing the private key.
  • A large quantum computer running Shor’s algorithm could recover the private key from a visible public key, which makes an exposed public key a risk.

In Redacted

In bunker mode, your account is 256 random bits, kept as 25 words, and it is never derived from a wallet signature. A broken wallet key therefore does not open your private balance.

Bunker mode →

Related terms

Exposed public keyA public key is exposed once it is visible on the chain, which usually happens the first time its address spends. Until then most addresses show only a hash of the key, which gives a key-breaking attacker nothing to start from.ECDSAECDSA is the elliptic-curve signature scheme behind most Bitcoin and Ethereum wallets. It proves that the holder of a private key approved a message without revealing the key, and its security rests on the secp256k1 curve.Elliptic curve cryptographyElliptic curve cryptography builds key pairs from points on an elliptic curve over a finite field. It gives about the strength of 3072-bit RSA with 256-bit keys, and Bitcoin signs with the secp256k1 curve.Shor’s algorithmShor’s algorithm is a quantum method, described by Peter Shor in 1994, that factors large numbers and computes discrete logarithms in polynomial time. A large enough quantum computer running it would break RSA and elliptic-curve signatures such as ECDSA.Hash-based signatureA hash-based signature proves that the holder of a private key approved a message, and its security rests only on a hash function. Leslie Lamport described the basic idea in 1979, and SLH-DSA, published as FIPS 205 in 2024, is a modern version.Extended public keyAn extended public key, or xpub, lets anyone derive every receiving address of a wallet account without being able to spend. Whoever holds it can see all of those addresses and their full history.

Sources: New Directions in Cryptography, Whitfield Diffie and Martin Hellman, 1976 · A Method for Obtaining Digital Signatures and Public-Key Cryptosystems, Rivest, Shamir and Adleman, 1977 · Transaction, Bitcoin Wiki

Updated November 1, 2026. All terms