Cryptographic Keys in Blockchain Transactions

Blockchain transactions commonly use a public-private key pair to show that a transfer or instruction has been authorised by the holder of the required private key. The private key creates a digital signature, while the mathematically related public key allows others to verify that signature without learning the private key.

What the two keys do

The keys perform different but complementary functions: one must remain secret, while the other enables public verification.

• The private key is secret cryptographic data used to sign transactions. Anyone who obtains it may be able to authorise transactions controlled by that key.
• The public key can be disclosed so that others can verify signatures. Properly implemented cryptography makes deriving the private key from the public key computationally infeasible.
• A blockchain address is an identifier used in transactions and is often derived from a public key. An address and a public key are not necessarily the same thing.

How a transaction is authenticated

Authentication links a particular transaction to the required signing key and protects the signed data against undetected alteration.

• The sender's wallet prepares the transaction data, such as the destination and amount, according to the blockchain's rules.
• The wallet uses the private key to generate a digital signature over the transaction data, typically through a cryptographic digest. The private key itself is not broadcast.
• The signed transaction is submitted to the network. Nodes use the relevant public key to check whether the signature is valid for that transaction.
• Changing the signed transaction data causes signature verification to fail. Nodes also check other rules, such as whether the funds are available and have already been spent.

What authentication does and does not guarantee

A valid signature establishes cryptographic authorisation, not the real-world identity or honest intentions of the person using the key.

• If a private key is stolen, an attacker's signature can still be cryptographically valid. Key security is therefore essential to asset security.
• Signing provides integrity and authentication, not confidentiality: a signature does not itself encrypt or hide transaction details.
• A valid signature alone does not make a transaction final. Acceptance and ordering also depend on the blockchain's validation and consensus rules.