Private/Public Key Cryptography

The course is part of this learning path

Start course
1h 1m

This course covers Ethereum denominations, the ABI array, Ethereum networks, private/public key cryptography, and much more!


In this lecture, we are going to talk about what exactly an account is. And we are also talking about how an address is created internally, what are the private keys, and how they are used. So, when you are sending ether, you are usually sending them from one address to another. Let's just assume for a moment that you want to send one ether to your friend, Bob. The ether that you are sending, they are not directly in a wallet, they are saved on the Blockchain. So, when you send from one address to another, then you basically instruct the Blockchain to debit and credit ether from one address to another. So, it's going to be stored in the database. But how does the Blockchain or a minor know if you are really allowed to do so? And that is where cryptography comes in, in particular, private public keys. Private key in Ethereum is nothing else than 64 random hex characters. As a short reminder, hexadecimal is going from 0-f, which is 0-15 in decimal numbers. So, there are 64 random values between 0-15 or 0-f. That translates to 256 bits or 32 bytes. You could literally go in and create your own private key, let's say 0x123123123123 and so on. The trick here is to make it really random so that nobody can go ahead and guess it because the private key is quite important. And that is why you should not create your own private key yourself from the top of your head. You should have a program that is really good at randomizing these values. From the private key, the public key is derived. And this is done with something called ECDSA or Elliptic Curve Digital Signature Algorithm. How that exactly works is not so important to you. Just keep the following in mind; The public he is for the public and the private key is always only for you. And here is why it's going to be discussed in a second. Okay. If I lost your attention somewhere along the way, that's the important part. There are two keys, the public key and the private key. But how is the Ethereum address generated now? Ethereum, you take the public key and you hash it with SHA3, then you should get a 64-character long string that are 32 bytes. To get the final address, you take the last 40 characters or 20 bytes. These 20 bytes are the Ethereum address. Additionally, the private key can also be encrypted again with a password, and that is fairly standard. So, when you open your wallet, for example, you have to enter a password. Or if you send off transactions you first have to enter a password to unlock your account. Many key stores make it pretty hard to get access to the real unencrypted private keys, and that's a good reason because the private key is very important. But what is the private key for anyways, and why is it so important? With the private key, with the private public key cryptography, you can create signatures, and that is making use of the private key. This does not reveal the private key, but make sure the content was authorized by you or the person who owns the private key, then anybody could go ahead and verify his signature and so on. So, let's think this through. We want to send the transaction, we want to send one ether from this address 0x44ffabc and so on, so 40 characters to 0x412abf and so on, whatever comes after that. So, we have the same address here and we have the private key for this address. We are the owners of this private key. Now we try to send this off, so we create a transaction object from two with a value, but this one needs to be signed. And the way this works is by taking the private key and creating a signature, and then you end up with three additional fields, r s v, and they are populated with the signature from the private key without revealing the private key. And with those three fields plus the actual message that was signed, you can verify or what they do with ecrecover. You can go from the actual message value back to the account, so you can verify that the whole content plus the signature is going to be the same as the account again, and then you have a verified signature. And this is how it's working with the private public key cryptography on the Ethereum network. The last reminder is again, and this is quite important, especially to people who are new, never give out your private keys and always make sure they are safe. Because when you have access to the private keys, you can send transactions in your name and possibly get access to the ethers that are stored on the address that you have in control.


About the Author

Tom is a CTO, senior back-end developer, and systems architect with over twenty years of hands-on development experience in a variety of languages and systems. He has a CS master's degree and has been working with Ethereum and blockchain technologies since 2016.

Covered Topics