Sorry, this might be a stupid question but the more questions are here the easier you can use the Internet. To sign your message in Bitcoin network, Alice uses his private key and message content. Bob verifies it with Alice's public key and message content.

Why can't a new user Fred just choose Alice's public key and generate his new private key? Then sign message with his new private key? So others who don't know Alice will think that Fred is Alice.

  • 3
    $\begingroup$ Then how is Fred supposed to generate the matching private key? Elliptic-curve discrete logarithm is a super hard problem unless you have a quantum computer. $\endgroup$
    – DannyNiu
    Sep 21, 2017 at 8:15
  • 2
    $\begingroup$ … because that's not how it works. $\endgroup$
    – e-sushi
    Sep 21, 2017 at 9:19
  • $\begingroup$ @DannyNiu Regarding the level of the question, mentioning quantum computers is causing just confusion. It sounds like it would be an actual threat and not something we don't know if mankind will ever be able to create them in the necessary size. $\endgroup$
    – tylo
    Sep 21, 2017 at 9:20

2 Answers 2


Short answer: Because the public key is derived from the private key.

Recall that when we are working with elliptic curves, we rely on the elliptic curve discrete logarithm problem (ECDLP). That is that we assume that if we have:

$$ Q = [k]P $$

given the points $P, Q$ on our elliptic curve, it is hard to compute the scalar $k$.

Bitcoin uses ECDSA over the Secpk1 curve. In ECDSA, we have the public generator point $G$. Alice's private key $d_a$ is randomly selected, as a large random number. With this $d_a$, her public key $Q_a$ is computed as follows:

$$ Q_a = [d_a]G $$

This closely mirrors the equation above, about the discrete logarithm. Now your question is whether Fred can just use Alice's key $Q_a$, and generate his own private key $d_f$. He will only be able to choose a private key for which holds that $Q_a = [d_f]G$, but for this he would have to solve the ECDLP. In the case of for the Secpk1, this is practically infeasible (unless the scheme is broken).


Why can't a new user Fred just choose Alice's public key and generate his new private key?

Because private and public keys are not independent.

Example with RSA (simpler to explain that ECC):

The private key consists of (p, q, d) and public key is (n, e) where n=(p*q) mod N (very simplified explanation).


you just cannot generate or simply compute a private key which would fit the public key. The public key is a function of values of the private key. The whole PKI security is based on a premise/assumption that it is very difficult compute the inverse function.

  • $\begingroup$ Your example is RSA, while the OP asks about ECC. $\endgroup$ Sep 21, 2017 at 8:27
  • 1
    $\begingroup$ Indeed, but the principle stays. The public key is (more or less) a trapdoor function of a private key, Just with RSA it's simpler to explain :) $\endgroup$
    – gusto2
    Sep 21, 2017 at 8:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.