A public key is the openly shared member of a private–public key pair. Its purpose is to let others perform a public-key operation without learning the private key: derive a shared secret with their own private key, verify a signature, or participate in related protocols. The separation solves the problem of agreeing on a secret before two parties can communicate. section 1.3 section 1.3.1
In elliptic-curve key exchange, public parameters include a secure curve and public base point G. Each party selects a secret integer, such as k_A, then computes its public key as the scalar multiple A = k_A G. Sending A reveals a curve point, not k_A; recovering the private scalar from G and A is the elliptic curve discrete logarithm problem. The curve order must be sized for the intended security level. section 4.1.1
Equation 4.1
\[\label{dhq1} S=k_A B=k_B A=k_A k_B G = k_B k_A G\]The shared-secret equation makes both sides of exchange explicit: Alice multiplies Bob’s public point by her private scalar, while Bob performs the symmetric operation. Both obtain S = k_A k_B G and can take its x component, or selected bits, as a symmetric-key input. section 4.1.1
A public key supports several practical flows:
- Key exchange: exchange public keys over an open network, combine the received point with a local private key, and derive the same secret for a fast symmetric system such as AES. section 1.3.1
- Digital signatures: publish a document and signature; a verifier uses the document, signature, and signer’s public key. Changing one bit causes verification to fail. section 1.3.2
- Multi-signatures: create public keys from participant data and use public curve parameters and base points while computing individual and aggregate signatures. section 18.3
Generating an elliptic-curve public key
A compact key-generation routine first converts a pass phrase or input bytes into a private integer modulo the curve order, then computes PK by elliptic-curve multiplication of the base point and that integer. The base-system structure supplies the curve, its order, cofactor, and base point. This permits recomputing keys when needed rather than storing them, but system security still depends on keeping the private key secret. section 4.1.3
Pairing-signature systems use the same core pattern over a field-extension elliptic curve: input data becomes a private integer, then scalar multiplication of G2 yields a public point. The signature system additionally carries curve, field, order, cofactor, and base-point data needed by the pairing construction. Test input may be random, but real private-key creation must be difficult for an adversary to determine. section 18.3.1
Figure 1.3 Creating a secret key by exchanging public keys
The exchange flow distinguishes what travels publicly—both public keys and the encrypted message—from the private scalars retained by each participant. section 1.3.1
