PART I: FOUNDATIONS — HOW BITCOIN WORKS

1.1 Public-Key Cryptography Overview

Bitcoin's security model is built entirely on asymmetric (public-key) cryptography. Every Bitcoin user controls a private key (a secret 256-bit integer) from which a public key is derived, and from that public key, a Bitcoin address is hashed. The system works because:

· Derivation is easy: private key → public key (one-way scalar multiplication on an elliptic curve)
· Inversion is computationally infeasible: public key → private key (the Elliptic Curve Discrete Logarithm Problem, ECDLP)

1.2 secp256k1 — The Elliptic Curve

Bitcoin uses the secp256k1 curve, defined by the Standards for Efficient Cryptography Group (SECG):

Curve equation: y² = x³ + 7 (over the field Fₚ)

Prime modulus p:

p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
  = 2²⁵⁶ − 2³² − 2⁹ − 2⁸ − 2⁷ − 2⁶ − 2⁴ − 1

Order n:

n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141

Generator point G:

Gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
Gy = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8

Cofactor h = 1

Key Properties

· p ≈ 2²⁵⁶ — the field is a 256-bit prime field
· n ≈ 2²⁵⁶ — the curve order is also ~2²⁵⁶, meaning private keys are uniformly distributed in [1, n−1]
· Koblitz curve (a = 0, b = 7) — chosen for efficiency; has special endomorphism properties that speed up computation by ~2x
· p ≡ 3 (mod 4) — enables efficient square root computation via Euler's criterion: √y = y^((p+1)/4) mod p

1.3 ECDSA — Elliptic Curve Digital Signature Algorithm

When you spend Bitcoin, you produce an ECDSA signature proving you know the private key without revealing it.

Key Generation

Private key:  d = random integer in [1, n−1]
Public key:   Q = d × G  (elliptic curve scalar multiplication)

Signing (spending Bitcoin)

1. Generate random nonce k ∈ [1, n−1]
2. Compute R = k × G, let r = R.x mod n
3. Compute s = k⁻¹ × (hash(message) + d × r) mod n
4. Signature = (r, s)

Verification

5. Compute u₁ = hash(message) × s⁻¹ mod n
6. Compute u₂ = r × s⁻¹ mod n
7. Compute R' = u₁ × G + u₂ × Q
8. Valid if R'.x ≡ r (mod n)

Critical Security Note

The nonce k MUST be:

· Unique per signature — reusing k with the same private key lets anyone compute:

d = (s₁ − s₂)⁻¹ × (k₁ − k₂)... 

but with same k, r is the same and the private key falls out trivially.
· Random — if k is predictable or biased, lattice attacks can recover the key from multiple signatures (the HackerOne PS3 incident, the Android Java RNG disaster, and numerous blockchain hacks).

Why Public Key Exposure Changes Everything

A Bitcoin address is a hash of the public key (RIPEMD-160 of SHA-256). When you spend from an address, the public key is revealed in the transaction input. Before that moment, an attacker only sees the hash — they cannot even apply ECDLP algorithms.

This is the fundamental security layering of Bitcoin:

Status What attacker sees Attack complexity
Unspent P2PKH address Only the hash Must brute-force the private key space: O(2²⁵⁶)
After first spend Public key is revealed Can apply Pollard's Kangaroo: O(2¹²⁸)
P2PK (Pay-to-Public-Key) Public key visible from the start Always vulnerable to ECDLP solvers

1.4 Bitcoin Address Types

P2PK (Pay to Public Key)

Script: <pubkey> OP_CHECKSIG

· Public key directly visible on-chain — never hashed
· Used in early Bitcoin (2009-2010), including Satoshi's coins
· Always vulnerable to quantum/ECDLP attacks since the key is exposed

P2PKH (Pay to Public Key Hash) — Legacy addresses (1...)

Script: OP_DUP OP_HASH160 <pubkey_hash> OP_EQUALVERIFY OP_CHECKSIG
Address = Base58Check(RIPEMD160(SHA256(pubkey)))

· Starts with '1' (e.g., 1BgGZ9tcN4rm9KBzDn7KprQz87SZ26SAMH)
· Public key hidden until first spend

P2SH (Pay to Script Hash) — 3... addresses

· Address starts with '3'
· Can wrap SegWit (P2SH-P2WPKH)

P2WPKH (Native SegWit) — bc1q... addresses

· Bech32 encoded
· Lower fees, signature malleability fixed
· Still hashes the public key until first spend

P2TR (Taproot) — bc1p... addresses

· Schnorr signatures, not ECDSA
· Key aggregation, MAST, better privacy

1.5 Transaction Structure

A Bitcoin transaction has:

· Inputs: references to previous outputs + unlocking script (signature + public key)
· Outputs: value + locking script (recipient address conditions)

The Funding Transaction

The funding transaction for the puzzle (TXID: 08389f34c98c606322740c0be6a7125d9860bb8d5cb182c02f98461e5fa6cd15) created 256 outputs, each locked to a different address with progressively increasing amounts.