How do you prove a coin is yours without showing the key that unlocks it?

What needs to be true

Three properties at once: (a) only you can produce a valid signature for a given message, (b) anyone can check it, (c) checking it does not reveal what made it producible. No password scheme satisfies all three — passwords must be shown to be checked. We need a one-way function: easy in the producing direction, impossible in the recovering direction, with a clean algebraic identity tying the two together.

The one-way function — scalar multiplication on a curve

Take an elliptic curve $y² = x³ + 7$ over a finite field. The points of this curve form a group: any two points have a sum, computed by the very chord-and-tangent construction that makes Bezout’s count work. Pick a generator $G$; repeated addition gives scalar multiplication : $kG = G + G + ⋯ + G$ (k times).

Computing $kG$ from $(k, G)$ takes about $\log₂ k$ additions (double-and-add). Recovering $k$ from $(G, kG)$ is the discrete logarithm problem; for cryptographic curves like secp256k1 , no algorithm is known that beats roughly $\sqrt{n}$ work, where $n ≈ 2²⁵⁶$. That is the asymmetry the entire scheme stands on.

# Toy curve E: y² = x³ + 7 over F_17.
# Same shape (a=0, b=7) as secp256k1, microscopic prime.
P, A, B = 17, 0, 7
INF = None  # the point at infinity is the group identity

def add(P_, Q_):
    if P_ is INF: return Q_
    if Q_ is INF: return P_
    x1, y1 = P_; x2, y2 = Q_
    if x1 == x2 and (y1 + y2) % P == 0:
        return INF
    if P_ == Q_:
        lam = (3 * x1 * x1 + A) * pow(2 * y1, -1, P) % P
    else:
        lam = (y2 - y1) * pow(x2 - x1, -1, P) % P
    x3 = (lam * lam - x1 - x2) % P
    y3 = (lam * (x1 - x3) - y1) % P
    return (x3, y3)

def scalar_mul(k, P_):
    R = INF
    while k > 0:
        if k & 1: R = add(R, P_)
        P_ = add(P_, P_)
        k >>= 1
    return R

G = (1, 5)             # generator
N = 9                  # order of G — 9G = INF
scalar_mul(2, G)       # → (2, 10)
scalar_mul(3, G)       # → (5, 9)
scalar_mul(9, G)       # → None (= O)

Keys — the move that anyone can do, no one can undo

Pick a random integer $d ∈ {1, …, n−1}$ and keep it secret — that is your private key . Compute $Q = dG$ and publish it — that is your public key . Anyone can compute $Q$ from $d$ in milliseconds. Nobody can recover $d$ from $Q$ in this universe.

In the widget, drag the private key d slider and watch Q hop around the curve while G stays fixed. Every $d$ in ${1, …, 8}$ lands on a different point of the subgroup. The puzzle: given the position of Q on the plot, can you tell which $d$ produced it without trying all eight? On the toy curve you can; on secp256k1 you cannot.

Sign — commit to the message, hide the key

The signature on a message hash $h$ is two numbers $(r, s)$. Pick a fresh random nonce $k$, compute $R = kG$, take $r = R.x \mod n$, and set $s = (h + r·d) · k⁻¹ \mod n$. The $k⁻¹$ hides $d$: with $k$ random and secret, $s$ looks random too. Without the nonce, two signatures from the same key would be a linear system in $d$ — anyone could solve it.

In the widget, the signer panel shows the equations live. Drag d, h, or k and the signature recomputes. Note the line labelled verifier · only knows h, (r, s), Q: the boundary between what leaves the signing device and what stays in it.

# Sign a message hash with private key d, nonce k.
def sign(d, h, k):
    R = scalar_mul(k, G)
    r = R[0] % N
    s = (h + r * d) * pow(k, -1, N) % N
    if r == 0 or s == 0:
        raise ValueError("retry with another k")
    return r, s

# Toy: d = 5 (private), h = 3 (message hash), k = 7 (nonce)
sign(5, 3, 7)  # → (2, 7)

Verify — the identity that holds iff you knew the key

The verifier is given $h$, $(r, s)$, and $Q$ — nothing else. Compute $u₁ = h · s⁻¹ \mod n$, $u₂ = r · s⁻¹ \mod n$, then $V = u₁G + u₂Q$. Accept the signature iff $V.x ≡ r (\mod n)$. Watch the algebra:

V = u₁·G + u₂·Q
= (h/s)·G + (r/s)·dG
= ((h + r·d)/s)·G                       ← group up by G
= ((h + r·d) · k / (h + r·d))·G        ← s = (h + r·d)/k
= k·G
= R                                      ← so V.x = R.x = r ✓

The line $s = (h + r·d)/k$ hides $d$ from anyone who only sees $(r, s, h, Q)$; the same line, plugged into $V = u₁G + u₂Q$, makes $V$ exactly equal $R$. The verifier never recovers $d$ and yet arrives at the same point the signer used. That coincidence — produced only by knowing $d$, checked without — is the signature of the entire scheme, in both senses of the word.

# Verify uses only public information: h, (r, s), Q.
def verify(h, r, s, Q):
    s_inv = pow(s, -1, N)
    u1 = h * s_inv % N
    u2 = r * s_inv % N
    V = add(scalar_mul(u1, G), scalar_mul(u2, Q))
    return V is not INF and V[0] % N == r

Q = scalar_mul(5, G)            # public key matching d = 5
verify(3, 2, 7, Q)              # → True

# The algebra: V = u1·G + u2·Q
#                = (h/s)G + (r/s)·dG
#                = ((h + r·d)/s)·G
#                = ((h + r·d) · k / (h + r·d))·G   # because s = (h+r·d)/k
#                = k·G = R.   So V.x mod N = r.
# Verifier never sees d. The identity holds iff signer knew d.

secp256k1 — the same algorithm, bigger numbers

Bitcoin runs the same group law and the same ECDSA equations on secp256k1 : $y² = x³ + 7$ over the prime $p = 2²⁵⁶ − 2³² − 977$. The widget above is a microscopic version: 17 instead of $2²⁵⁶$, subgroup order 9 instead of $~2²⁵⁶$. The algorithm is identical. The only thing that scales is the gap between multiplying (still $O(\log k)$) and recovering (now $~2¹²⁸$). That gap is the only reason your wallet is safe.