<p>Bitcoin uses something called the <a href="https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm" rel="nofollow noreferrer">Elliptic Curve Digital Signature Algorithm (ECDSA)</a> for signing and verifying transactions. Read the linked Wikipedia article for exact process of how ECDSA works. If you understand how the modulo operator works, it should make sense as to why you can't make a signature without the private key.</p>

<hr>

<p>It's kind of hard for me to explain this as it does rely on some complex mathematics, but I will try.</p>

<p>To produce a valid ECDSA signature, you need the private key, which is a large integer. It is explicitly used in the signature creation algorithm, but the public key is not. Furthermore, the public key is not an integer like the private key; rather it is a point on an elliptic curve. So even if you know the public key, you can't create a signature with it because it is not the private key and you can't recover the private key from the public key.</p>

<p>The private key cannot be recovered from the public key because of a problem called the Elliptic Curve Discrete Logarithm Problem. From <a href="https://en.wikipedia.org/wiki/Elliptic-curve_cryptography#Rationale" rel="nofollow noreferrer">Wikipedia</a>:</p>

<blockquote>
  <p>it is assumed that finding the discrete logarithm of a random elliptic curve element with respect to a publicly known base point is infeasible: this is the "elliptic curve discrete logarithm problem" (ECDLP).</p>
</blockquote>

<p>The private key is the discrete logarithm. Although this is an assumption, it has been shown in practice that ECDLP is a hard problem, i.e. it is hard to find the discrete log given a base point and public key point. So you can't get the private key that is required in ECDSA to produce the signature.</p>

CC BY-SA 3.0
2017-11-09T10:05:22.413Z
thanks this definitely helps, whilst I can't claim to fully understand the answer, just knowing that I didn't have some simple flaw in my understanding of how bitcoin works is useful.
Will T-E
CC BY-SA 3.0
2017-11-09T05:25:28.517Z
2017-11-09T05:25:28.517Z
Ava Chow
<blockquote>
  <p>"A valid signature cannot be created without access to the private
  key" - why not?</p>
</blockquote>

<p>In few words: because there is no known algorithm today to do it.</p>

CC BY-SA 3.0
2017-11-09T05:34:45.283Z
2017-11-09T05:34:45.283Z
amaclin
<p>This is a feature of <a href="https://en.wikipedia.org/wiki/Digital_signature" rel="nofollow noreferrer">digital signatures</a> from public-key cryptography. It's probably out of the scope of this site to explain how cryptography works. Maybe <a href="https://crypto.stackexchange.com/">https://crypto.stackexchange.com/</a> would be a better place to ask.</p>

CC BY-SA 3.0
2017-11-09T07:52:13.293Z
2017-11-09T07:52:13.293Z
Adam Millerchip
<p>I understand from the following two posts that private keys are not displayed by the sender when getting their transaction validated by the bitcoin miners:</p>

<p><a href="https://bitcoin.stackexchange.com/questions/53649/what-happens-to-private-key-on-payment?noredirect=1&amp;lq=1">What happens to Private Key on Payment</a></p>

<p><a href="https://bitcoin.stackexchange.com/questions/36152/how-can-transactions-be-verified-without-the-private-key">How can transactions be verified without the private key?</a></p>

<p>Instead a digital signature is provided that is based on the Private Key, and, as far as I understand, that digital signature is verifiable when "compared" to the Public Key. </p>

<p>Why then can't someone generate a verifiable digital signature using only someone else's public key?</p>

<p>Or put another way, quoting an answer from the first post listed above:</p>

<p><em>"A valid signature cannot be created without access to the private key"</em> - why not?</p>

<private-key><signature><transaction-verification>
Why can't someone create a valid digital signature without knowing your private key?
Will T-E
# Why can't someone create a valid digital signature without knowing your private key?

(Asked by: username_0 on 2017-11-09)

I understand from the following two posts that private keys are not displayed by the sender when getting their transaction validated by the bitcoin miners:

[What happens to Private Key on Payment](https://bitcoin.stackexchange.com/questions/53649/what-happens-to-private-key-on-payment?noredirect=1&lq=1)

[How can transactions be verified without the private key?](https://bitcoin.stackexchange.com/questions/36152/how-can-transactions-be-verified-without-the-private-key)

Instead a digital signature is provided that is based on the Private Key, and, as far as I understand, that digital signature is verifiable when "compared" to the Public Key.

Why then can't someone generate a verifiable digital signature using only someone else's public key?

Or put another way, quoting an answer from the first post listed above:

*"A valid signature cannot be created without access to the private key"* - why not?

**Tags:** private-key, signature, transaction-verification


---

## 3 answers

### Answer by username_1 on 2017-11-09. Score: 1 | Accepted answer

Bitcoin uses something called the [Elliptic Curve Digital Signature Algorithm (ECDSA)](https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm) for signing and verifying transactions. Read the linked Wikipedia article for exact process of how ECDSA works. If you understand how the modulo operator works, it should make sense as to why you can't make a signature without the private key.

---

It's kind of hard for me to explain this as it does rely on some complex mathematics, but I will try.

To produce a valid ECDSA signature, you need the private key, which is a large integer. It is explicitly used in the signature creation algorithm, but the public key is not. Furthermore, the public key is not an integer like the private key; rather it is a point on an elliptic curve. So even if you know the public key, you can't create a signature with it because it is not the private key and you can't recover the private key from the public key.

The private key cannot be recovered from the public key because of a problem called the Elliptic Curve Discrete Logarithm Problem. From [Wikipedia](https://en.wikipedia.org/wiki/Elliptic-curve_cryptography#Rationale):

> it is assumed that finding the discrete logarithm of a random elliptic curve element with respect to a publicly known base point is infeasible: this is the "elliptic curve discrete logarithm problem" (ECDLP).

The private key is the discrete logarithm. Although this is an assumption, it has been shown in practice that ECDLP is a hard problem, i.e. it is hard to find the discrete log given a base point and public key point. So you can't get the private key that is required in ECDSA to produce the signature.

> **Comments:**
> **username_0**: thanks this definitely helps, whilst I can't claim to fully understand the answer, just knowing that I didn't have some simple flaw in my understanding of how bitcoin works is useful.  

---

### Answer by username_2 on 2017-11-09. Score: 1

> "A valid signature cannot be created without access to the private
> key" - why not?

In few words: because there is no known algorithm today to do it.


---

### Answer by username_3 on 2017-11-09. Score: 0

This is a feature of [digital signatures](https://en.wikipedia.org/wiki/Digital_signature) from public-key cryptography. It's probably out of the scope of this site to explain how cryptography works. Maybe <https://crypto.stackexchange.com/> would be a better place to ask.


---

