by keeping public keys anonymous.
The whitepaper is referring to how, by default, it is not know which human or organisation controls a public key. ---The public key itself can be recovered from the signature on a Bitcoin transaction--- The public key is included as part of the scriptSig on a transaction input, and then hashed and validated against the public key used to create the address.
Since a signature can only be produced by the corresponding private key, you can validate that it is the correct key for the given address.
Thus, although you can see the amounts being moved around, you don't know who is spending them, or where they are going (without doing off chain analysis).
By keeping public keys anonymous how miners can verify that sender has enough money
Now that we've established that the key itself is available, miners validate that the amounts are correct by referencing the chain of inputs. Each input in a transaction refers to a specific output created in the past. When validating, the node will look up all of the previous transactions referenced, add up all of their output values, and then check the current transaction's outputs. If the outputs created by the transaction are less than or equal to the input sum, it is valid.
In practice, outputs are less than the input currently, since 0 fee transactions are no longer allowed (they can still be mined, but you will find it quite difficult to broadcast them). The difference between the inputs and the outputs is claimed by the miner as the transaction fee.
The complete signature and address verification process involves:
- Validating the signature over the transaction data
- Hashing the public key from the scriptSig using
HASH_160, and comparing it to the hash embedded in the address
This verifies that:
- The transaction itself is signed
- The public key matches the public key inside the address (by checking that the hashes are equal)