<blockquote>
<p>If the public key can really be derived from the private key, isn’t the opposite true?</p>
</blockquote>
<p>Nope, thats the wonder of <a href="https://en.wikipedia.org/wiki/Public-key_cryptography" rel="noreferrer">asymmetric key cryptography</a>! You can easily derive the public key from the private key, but going the opposite direction is equivalent to brute-force guessing you way through an impossibly large set of numbers (ie, impossible). So the public key and private key are mathematically related, but this relationship is &quot;one-way&quot;, so to speak. This is why you can share your public key with other people, but you should <em>never, ever</em> share the private key!</p>
<p>Once someone has a private key, they can use it to derive the public key and bitcoin address easily. But having a public key gives them no knowledge of the private key, since the math doesn't work the same both ways.</p>
<p>In bitcoin, the public key is derived using the <a href="https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm" rel="noreferrer">Elliptic Curve Digital Signature Algorithm (ECDSA)</a>.</p>
<blockquote>
<p>Then you give one key the name public key, and give the other key the name private key</p>
<p>...</p>
<p>I mean, we can choose whichever is the private key when we generate them.</p>
</blockquote>
<p>I think this is where your misunderstanding comes from, the distinction of 'public' or 'private' is not arbitrarily chosen. One is derived from the other, their relationship is mathematically defined.</p>

CC BY-SA 4.0
2018-05-10T08:06:30.133Z
2018-05-10T08:06:30.133Z
2020-06-16T11:10:03.350Z
chytrik
<blockquote>
  <p>In my understanding, when you create a public-private key pair, first, you create a pair of complementary keys by using cryptographic software. Then you give one key the name public key, and give the other key the name private key.</p>
</blockquote>

<p>This is the case with RSA but not with ECDSA. In RSA both keys are integer pairs and are interchangeable, i.e you can encrypt with one and decrypt with the other. In ECDSA the private key is an integer and the public key is a point on a curve (2 coordinates) derived from the private key. In ECDSA you can only sign with the private key and verify with the public key not the other way around. </p>

CC BY-SA 4.0
2018-05-21T01:17:31.973Z
Then my question about the RSA is how it is almost impossible to guess the private key from the public key when it’s randomly chosen. Would you elaborate?
sflow
CC BY-SA 4.0
2018-05-21T08:50:32.180Z
@sflow it goes like this: pick two prime numbers p, q. pick another number e that is coprime with (p-1)(q-1). Calculate d. Then you have two keys (d, p*q) and (e, p*q). You label one of them private and the other public. Then you throw away p and q. If you have p, q and e you can recreate both keys. But from the one key you cant get to the other (unless you can find the prime factors of p*q)
Mike D
CC BY-SA 4.0
2019-08-08T13:13:23.887Z
Be aware that in most RSA implementations e is NOT picked to be difficult to guess, furthermore most private key formats store more than (d,pq). So while you could theoretically build a RSA cryptosystem where public and private keys are interchangable it's not the done thing.
Peter Green
CC BY-SA 4.0
2018-05-14T09:21:08.023Z
2018-05-14T09:21:08.023Z
Mike D
<p>In my understanding, when you create a public-private key pair, first, you create a pair of complementary keys by using cryptographic software. Then you give one key the name public key, and give the other key the name private key.  You keep the private key for yourself and give your public key to everyone else.</p>

<p>Then I was reading Mastering Bitcoin, I found this sentence:</p>

<blockquote>
  <p>Paper wallets are bitcoin private keys printed on paper. Often the
  paper wallet also includes the corresponding bitcoin address for
  convenience, but this is not necessary because it can be derived from
  the private key.</p>
</blockquote>

<p>I don’t understand how it is possible to derive the corresponding bitcoin address(the hash of a public key) from the private key. </p>

<p>If the public key can really be derived from the private key, isn’t the opposite true? I mean, we can choose whichever is the private key when we generate them. </p>

<private-key><public-key>
How do you know your public key from a private key?
sflow
# How do you know your public key from a private key?

(Asked by: username_0 on 2018-05-10)

In my understanding, when you create a public-private key pair, first, you create a pair of complementary keys by using cryptographic software. Then you give one key the name public key, and give the other key the name private key. You keep the private key for yourself and give your public key to everyone else.

Then I was reading Mastering Bitcoin, I found this sentence:

> Paper wallets are bitcoin private keys printed on paper. Often the
> paper wallet also includes the corresponding bitcoin address for
> convenience, but this is not necessary because it can be derived from
> the private key.

I don’t understand how it is possible to derive the corresponding bitcoin address(the hash of a public key) from the private key.

If the public key can really be derived from the private key, isn’t the opposite true? I mean, we can choose whichever is the private key when we generate them.

**Tags:** private-key, public-key


---

## 2 answers

### Answer by username_1 on 2018-05-10. Score: 5

> If the public key can really be derived from the private key, isn’t the opposite true?

Nope, thats the wonder of [asymmetric key cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography)! You can easily derive the public key from the private key, but going the opposite direction is equivalent to brute-force guessing you way through an impossibly large set of numbers (ie, impossible). So the public key and private key are mathematically related, but this relationship is "one-way", so to speak. This is why you can share your public key with other people, but you should *never, ever* share the private key!

Once someone has a private key, they can use it to derive the public key and bitcoin address easily. But having a public key gives them no knowledge of the private key, since the math doesn't work the same both ways.

In bitcoin, the public key is derived using the [Elliptic Curve Digital Signature Algorithm (ECDSA)](https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm).

> Then you give one key the name public key, and give the other key the name private key
>
> ...
>
> I mean, we can choose whichever is the private key when we generate them.

I think this is where your misunderstanding comes from, the distinction of 'public' or 'private' is not arbitrarily chosen. One is derived from the other, their relationship is mathematically defined.


---

### Answer by username_2 on 2018-05-14. Score: 1

> In my understanding, when you create a public-private key pair, first, you create a pair of complementary keys by using cryptographic software. Then you give one key the name public key, and give the other key the name private key.

This is the case with RSA but not with ECDSA. In RSA both keys are integer pairs and are interchangeable, i.e you can encrypt with one and decrypt with the other. In ECDSA the private key is an integer and the public key is a point on a curve (2 coordinates) derived from the private key. In ECDSA you can only sign with the private key and verify with the public key not the other way around.

> **Comments:**
> **username_0**: Then my question about the RSA is how it is almost impossible to guess the private key from the public key when it’s randomly chosen. Would you elaborate?  
> **username_2**: @username_0 it goes like this: pick two prime numbers p, q. pick another number e that is coprime with (p-1)(q-1). Calculate d. Then you have two keys (d, p*q) and (e, p*q). You label one of them private and the other public. Then you throw away p and q. If you have p, q and e you can recreate both keys. But from the one key you cant get to the other (unless you can find the prime factors of p*q)  
> **username_3**: Be aware that in most RSA implementations e is NOT picked to be difficult to guess, furthermore most private key formats store more than (d,pq). So while you could theoretically build a RSA cryptosystem where public and private keys are interchangable it's not the done thing.  

---

