BC2: Keys and digital signatures
Public and private keys, and addresses
🎯You'll be able to
Explain a key pair and how an Ethereum address is made from a public key.
🏠The everyday picture
A letterbox with a slot: anyone can find it by its address and post into it, but only the person with the key can open it.
📘What it really is
-
A key pair: a private key (a large random number, kept secret) and a public key worked out from it. Going from private to public is easy; going back is not feasible.
-
Curves: Ethereum and Bitcoin use the secp256k1 curve (ECDSA signatures). Many other systems use Ed25519.
-
Ethereum addresses: the last 20 bytes of the Keccak-256 hash of the public key, written as 40 hexadecimal characters after
0x. Mixed upper and lower case letters (EIP-55) are a checksum that catches typing mistakes. -
Accounts: an address controlled by a private key is an externally owned account. A contract also has an address, but no private key; its code decides what it does (BC5).
-
Randomness matters: a private key must come from a strong random source. Keys made from a phrase someone chose ("brain wallets") have been guessed and emptied.
📝A worked example
Input: the practice network's first test account, printed by npm run chain.
Steps:
- The private key is 64 hexadecimal characters. It's public knowledge for this practice network, so it must not hold anything of value.
- ethers.js computes the public key from it, hashes it with Keccak-256 and keeps the last 20 bytes: the address.
- Typing the address with one wrong letter fails the EIP-55 checksum, and ethers refuses it.
Expected output: an address you can share and a key you don't.
🌍Where it's used
- Wallets on phones and hardware devices.
- Code signing for apps and updates.
- TLS certificates for websites.
📝Case scenario
A developer generated a key with a simple random function seeded with the time, for a "quick test". The key was later used for real funds. Someone who guessed the approximate time searched the possible seeds and found it. A cryptographically secure generator would have made that search hopeless.
🖱️Try it
Run node -e "const {Wallet}=require('ethers');const w=Wallet.createRandom();console.log(w.address)" in the kit folder twice.
Success: two different addresses, and you didn't print or save the keys.
⚠️Common mistakes
- Weak randomness. Sign: keys from timestamps or phrases. Fix: the wallet library's secure generator.
- Sharing the private key "to check something". Sign: a key in chat or email. Fix: share only the address.
- Ignoring the checksum. Sign: addresses lower-cased and pasted by hand. Fix: keep EIP-55 case and let libraries check it.
🛠️For your project
Project 2's owners are five addresses; the vault knows nothing about the people except which addresses may approve.
✅Quick check
How is an Ethereum address made?
Show the answer
From the last 20 bytes of the Keccak-256 hash of the public key.
Why must a private key come from a strong random source?
Show the answer
A predictable key can be found by searching the possible values.