Understanding Private and Public Keys in Blockchain Security

Protecting private keys ensures secure transaction signing and prevents unauthorized access to accounts.

### Understanding Cryptography: The Role of Keys in Blockchain Transactions
* 🔑 The security of your blockchain accounts relies heavily on three key components: the **secret phrase (mnemonic)**, the **private key**, and the **public key**.
* 🔒 The secret phrase grants access to **all accounts created in your wallet**, while the private key provides access to a **single account**, emphasizing the need to **keep it confidential**.
* 🛠 In MetaMask, new accounts are generated by **hashing the mnemonic phrase with a sequential number**, creating **unique private keys** for each account.
* ✍ Transactions are signed using your **private key**, which acts like a **password**, allowing you to **authenticate your actions** without revealing the key itself.
* 📜 The public key is derived from the private key and can be **shared publicly**, enabling others to **verify transactions you've signed** without compromising your security.
* 🔄 The Ethereum address is generated from the public key by **hashing it and taking the last 20 bytes**, highlighting the layered relationship between these keys.
* 🛡 It's crucial to **protect your private key and mnemonic phrase**, as unauthorized access can lead to **loss of funds and control over your accounts**.
* ✅ By understanding the **cryptographic principles** behind these keys, you can effectively **manage and secure** your blockchain transactions.

So now we're going to talk a little bit about signing these transactions and private keys and some other cryptography pieces, right? Because in this blockchain demo here, we can see we have all these fantastic transactions, right? All these things went through, but how do we know that it was Darcy who is the one to send 25 to Bingley, right? How do we know that actually happened? And this is where all those pieces that we just learned about in our test net in our Metamask account are really going to start to come to life here a little bit here. So here we have an example of public and private keys. Okay, at the top, we have this private key, right, that was randomly generated. A private key is, you know, as it kind of states, is a key that you really want to keep a secret because you're going to be using this as kind of your secret password for all your transactions, right? I can really pick, you know, any private key, anything that I want, and

with it, uh, this algorithm. They're going to use an algorithm, you know, for Ethereum and Bitcoin. They both use this elliptic curve digital signature, uh, algorithm. It's a variant of just a digital signature algorithm, and it's going to create this public key, right? I'm really not going to go at all into kind of this digital signature algorithm, but just know it does use some of these, uh, some of the hash, uh, knowledge that we just learned, combined with some other pieces, uh, to kind of get this, this public key here. So, I'm not going to go too deep into it, but we have this private key that we create, and we get this public key. Now, this public key, we want everybody to have access to, right? This is, yeah, the whole world can see this. This private key, we really want it to be, uh, private. We don't want people to see this. We're going to use this private key as like a password to quote-unquote digitally sign transactions, and then people can verify them with this public key. So, let's, let's see what this

actually looks like let's pick a random key, a more secure key, right? Because the longer it is, the more secure it's going to be. And if we go to signatures now, right, um, let's say we have this, uh, this message that we want, right, with say hi world, right? We want this to be the message. What's going to happen is this private key that we've created, we can use to sign this data, right? Remember how in the blockchain demo, you know, we were kind of, we were hashing stuff, right? We were using this SHA-256 hash to get this hash. Well, we're doing something similar, but instead of hashing, we're using this digital signature algorithm to create this message signature. Now, what's really powerful about how this, uh, this algorithm works is that you can create this message signature with your private key, but somebody else can't derive your private key from the message signature. And that's what makes this really, really powerful. However, if we go to verify using this public key, right? And so this is the, this is that 0403, this is that

same public key using this public key. Anybody can verify. Let's go ahead and sign it again. Anybody can verify that this signature is yours, right? So, you have a public key, a private key just for you, so you can sign things, and a public key that anybody can verify something, right? So, anybody can verify this, and let's say somebody tries to fake a transaction from you. They say, Hey, you know, this is their transaction. All they have to do is verify that this signature against your public key, and very easily, this whole thing turns red because it isn't verified, right? The algorithm says, Hey, uh, that's wrong. So, we can go ahead and take that into transactions in this exact same way. So, if I want to send money, you know, if I want to send 400 from, you know, my address to another address using my private key, I can sign that transaction, and anybody else in the world can then verify this transaction, right? And this is why when people say, Hide your keys, you know, protect your keys, this is what we're talking about in

our accounts here, right? If we go to settings, and again, the only reason that I'm showing you guys my mnemonic and my private key is because this is a dumpster account. I'm going to throw this away at the end of this video, or I'm just not going to put any real money in it. But when we look at our MetaMask here, we have this mnemonic phrase, which allows us to easily get these different private keys, right? So, mnemonic phrase combined with, you know, whatever account number, we'll get us a private key. So, mnemonic phrase combined with one, we're gonna get this private key. And this is when we look at Account Details, export private key, password, confirm. This is going to be the private key that we're going to use to sign our transactions, right? This, if anybody else gets access to this private key, they then can sign transactions for us, and they can send transactions for us. And that's why we want to keep these private. So, uh, it works the exact same way, right? So, this is why it's so

important to hide your private keys and hide your mnemonics. Now, your Ethereum address is actually a piece of your public key. Now, to get our address in Ethereum, all we have to do is take this public key that we've created with our private key, hash it using that same Ethereum hashing algorithm, and then take the last 20 bytes. And that's how we'll actually derive to our address here. Now, knowing the exact methodology of how to get the address doesn't really matter because it could change blockchain to blockchain and could even change in E2, but just know that that is essentially how kind of these addresses are derived, right? There's some derivative of the public key, right? Because the public key is public, and you know, using the public key and kind of any public way is totally fine, but not the private key. So, that is how we sign our transactions. Note though, this isn't how we send the transaction. So, so this is just going to assign it, create a transaction for us to send.

we'll learn later on how to send these transactions. Oh, so that was a lot of information there too. Let's do a quick recap. Your public key is derived by using a digital signature algorithm on your private key, right? And you want to keep your private key private at all times because you're going to use your private key to sign transactions. Signing transactions with your private key, you are the only one who can actually do this because you can't get the private key from a message signature. However, using your public key, you can, anybody can very easily verify that a signature that's signed by you is in fact signed by you. In our Metamask, our private keys are located in this Account Details section. You just hit show Private keys and type in your password, and you'll get your private key here. And the address of your account is derived from this private key, and it's derived from this public key. So if you think about it, your private key creates your public key, which then can create your address, and there's a little barrier.

or a big barrier here because your private key you want to keep private, and your public key and your address can all be public information. Now remember how in our metamask we were able to actually create new accounts. Mine says account six because I've created actually a few, but how was it actually creating those accounts? Well, now that we know all this, if we go back to our blockchain demo here, what our metamask is doing is essentially taking our mnemonic or that multi-word secret phrase and then just hashing it with some number. So secret phrase plus zero gets this, and it'll set this as your private key. And for our account one, that'll be the private key, or maybe it's plus one. The exact algorithm that it's using doesn't matter, but if you want to create a new private key where you just hit this create account button, the way it actually picks this account is by taking this secret phrase and then just changing this number. So if I go, if I'm in my metamask, I do create account, this

Right now, I'm on account six because, like I said, I made a whole bunch. If I make account six, right, it's as if we just did the secret phrase plus six and created this new hash or this new private key and created this new hash, and it uses this to make a private key. And this is why, in your MetaMask, if you share that secret phrase, if you share that mnemonic device, they will have access to all the accounts that you ever created. However, if you share your private key, it will just give them access to that single account. Secret phrase has access to all the accounts created in your MetaMask or your wallet. Your private key is access to that single account, and the public key or address, anybody can access to, and it's cool for anybody to have access to. So, when I'm thinking about the security of my MetaMask or my wallet, this is kind of the order that I think of it in. The seed phrase or mnemonic or secret phrase is incredibly important. Protect this at all costs because if somebody else gets

access to this. They will have access to all of your accounts. The second most important is the private key because if somebody gets access to that, they will get access to a single account. And then your public key or address, which whatever it's public.

Lesson 1 Part 7  | What is a signed transaction? - Solidity & Foundry Full Course

Book a smart contract audit here 👇
https://www.cyfrin.io/


Cyfrin Audits

Understanding Private Keys and Transaction Signing in Blockchain

Private keys are randomly generated and serve as a secret password for transactions, making them crucial to keep confidential.

The mnemonic phrase in MetaMask helps generate different private keys, which are used to sign transactions.

If someone else gains access to a private key, they can sign and send transactions on behalf of the account owner, highlighting the importance of keeping these keys private.

The Role of Public and Private Keys in Cryptocurrency

Cryptocurrency, like Ethereum and Bitcoin, uses an elliptic curve digital signature algorithm to create a public and private key pair.

The public key is meant to be shared with everyone, while the private key should remain confidential, acting as a password to digitally sign transactions.

This system allows anyone to verify transactions using the public key, ensuring security and authenticity in the transfer of funds.

Understanding Ethereum Address Derivation

Your Ethereum address is derived from your public key, which is created using your private key.

The address is obtained by hashing the public key and taking the last 20 bytes.

It's crucial to keep your private key private, as it is used to sign transactions, while the public key can be used by anyone to verify your signature.

The secret phrase in MetaMask provides access to all created accounts, while the private key grants access to a single account.

The public key or address is accessible to anyone.

The seed phrase is crucial for security, and the digital signature algorithm allows for message signing without revealing the private key.

Understanding Account Access and Creation in Metamask

Access to accounts is determined by the seed phrase, private key, and public key, with the private key being crucial for accessing individual accounts.

Metamask creates new accounts by hashing the mnemonic secret phrase with different numbers to generate unique private keys.

The process of creating a new account in Metamask involves changing the number used in the hashing algorithm.