How do you derive the public key from you random 256-bits integer?

Question

Once I've flipped a fair coin 256 times and have the random 256 bits integer that I'm going to use as my private key, how is the public key derived?

I've read:

Given a private key, how do you get a public address

And:

https://en.bitcoin.it/wiki/Address

But I don't find the answer to my question. I understand ECDSA curves are used but I don't understand which part is the public key and what's the relation between the (unique?) public key and the addresses which you give out.

If you convert the private key to a public key by performing a multiplication with the curve's base point, then it begs the question: what is the curve's base point?

Is the curve's base point part of the private key?

Which would mean that what is called the "private key" isn't really just a "private key" but more of a keypair from which you can, at any time, derive the public key?

Answer 1

The curve's base point is a well-known constant. Since Bitcoin uses SECp256k1, the base point is:

04 (uncompressed point)

79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9
59F2815B 16F81798 (first coordinate)

483ADA77 26A3C465 5DA4FBFC 0E1108A8 FD17B448
A6855419 9C47D08F FB10D4B8 (second coordinate)

(See page 15 of my link.)

The private key is an integer from which you can derive the public key and produce signatures that can be verified with the public key.

Answer 2

All bitcoin addresses share a common base point known as a generator, G = (0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798, 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8) on the elliptic curve defined as y^2 = x^3 + 0 * x + a, over the field defined by P = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f.

I'm afraid that's all pretty technical, but if you know modulo math it isn't extremely complex, and the values can be found if you search for sepc256k1 in Standards for Efficient Cryptography recommended elliptic curve domain parameters.

The elliptic curve over the field has the property that when you add a point to itself. Bitcoin uses this fact to calculate the public key by adding the generator point to itself a large number of times. Your private key is simply the number of times to add the point to itself.

If your private key happened to be 1, your public key would be identical to G. That is obviously no good because that is a very well known point, but simply changing your private key to 2 will yield the public key (0xc6047f9441ed7d6d3045406e95c07cd85c778e4b8cef3ca7abac09b95c709ee5, 0x1ae168fea63dc339a3c58419466ceaeef7f632653266d0e1236431a950cfe52a) which is extremely different from the generator. Normally a huge private key is used, making it computationally unfeasible to try to backtrack from the public key to the private key.

The public key is "simply" private_key * G, on the elliptic curve over the field. I write "simply" because it's a bit involved, but the math itself isn't very complicated. It's only addition, subtraction, multiplication and division with remainders. The really difficult part is that the numbers involved are so incredibly large that it's more or less impossible for the human brain to comprehend what they mean, and some of the definitions of calculations over elliptic curves differ from what you're used to, which can be confusing.