Public key

A public key is a point on a curve, computed from your private key. Anyone can use it to check your signatures. No one can use it to find your private key.

The trick is a one-way street. Multiplying a starting point by your secret number takes a computer microseconds. Working out the secret number from the result would take every computer on Earth longer than the universe has existed. So you can show your public key to the world and keep the private key to yourself.

Try it

Multiply points on a tiny curve you can see, then watch the same idea at full size.

What is a point on secp256k1?

Pearl uses secp256k1, the same elliptic curve as Bitcoin. Its points are pairs of whole numbers (x, y) that satisfy one equation, with all arithmetic done modulo a prime p:

$$y^2 \equiv x^3 + 7 \pmod{p}, \qquad p = 2^{256} - 2^{32} - 977$$

One point is special. The generator G is fixed by the standard, and every public key is a multiple of it:

How is the public key computed?

By multiplying G by the private key d:

$$P = d \cdot G$$

“Multiplying” a point means adding it to itself d times, using the curve’s own addition rule. Computers do it with about 256 doublings and additions, not d steps, so it’s quick even for a 78-digit d.

Some easy cases:

• Key 1 gives P = G itself. That’s why the x-coordinate above appears so often in examples.
• Key 2 gives a point with x = c6047f9441ed7d6d3045406e95c07cd85c778e4b8cef3ca7abac09b95c709ee5.
• Key 3 gives x = f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9.

The x-coordinates look unrelated, even though the keys are 1, 2 and 3. That’s the point: nothing about P hints at d. Finding d from P is the discrete logarithm problem, and no known method on ordinary computers solves it for a curve this size.

What formats are there?

A point is two 32-byte numbers. There are three ways to write one down, and Pearl uses all three in different places.

Size

32 bytes

Type

x-coordinate of a curve point

Format

Big-endian

Why can you throw away y?

Because the curve is symmetric. For each x on the curve, there are exactly two points, (x, y) and (x, p − y). One y is even and the other is odd.

• A compressed key keeps one byte to say which: 02 for even y, 03 for odd y. Key 1 starts with 02; key 6 starts with 03 (03fff97bd5…297556).
• An x-only key drops even that byte. By rule (BIP-340’s “lift_x”), it always means the point with even y.

That saves a byte everywhere a key appears on chain, and Taproot was designed around it.

What does a signature prove?

A Schnorr signature proves that whoever made it knew d for this public key and this exact message, without revealing anything about d.

It is 64 bytes: the x-coordinate of a random-looking point R, then a number s. The verifier computes a challenge e from R, P and the message m, and checks one equation:

$$s \cdot G = R + e \cdot P, \qquad e = \text{TaggedHash}_{\text{BIP0340/challenge}}(R_x \parallel P \parallel m)$$

Here is a signature made with Pearl’s own code, over the message SHA256(“Pearl”):

That signature used the auxiliary random value 00…01 from BIP-340’s recipe. Flip one bit of m and verification fails.

The Schnorr page derives the equation and shows why it can’t be forged.

Where do public keys appear on Pearl’s chain?

Mostly in disguise.

• In Taproot outputs the 32 bytes are the tweaked output key Q, not your P. The Taproot tweak page explains why.
• Inside scripts a key is pushed as 20 followed by 32 bytes. The real 2-of-2 P2MR spend in block 130,822 pushes two of them, b5b010c0…4d307d and 03b77fbc…c7ae89. (That second key’s first byte happens to be 03. In an x-only key that’s just data, not a parity flag.)
• In HD wallets extended keys carry 33-byte compressed keys, and parent fingerprints hash them. These never go on chain.