# Bitcoin and encryption

To the best of my understanding Bitcoin uses encryption to create the digital signature, basically, by encrypting the hashed message (transaction?).

Would like to get your expert opinion to my claim the encryption is used by the Bitcoin protocol/algorithm.

Bitcoin uses cryptography to create digital signatures and cryptographic hash functions for various purposes such as transaction ids, block ids, and to commit to specific transactions in blocks. The Bitcoin protocol itself does not use encryption anywhere, but many wallets use encryption to secure private key material. There is also a Bitcoin Improvement Proposal (BIP) that aims to introduce encrypted peer-to-peer communication between Bitcoin nodes.

To follow-up on the question in the comments:

"You have a bit-stream and you use a means called 'private key' to generate a bit-stream based on the original and then you use a 'public key' to uncover the original bit-stream - you use encryption."

The signatures in Bitcoin are created by means of the Elliptic Curve Digital Signature Algorithm (ECDSA). ECDSA uses two functions:

• `sign(privkey, message)` which returns a signature
• `verify(pubkey, message, signature)` which returns `true` or `false`

ECDSA does not qualify as an encryption algorithm, because the signature does not transport the message and there is no way to "recover the original bit-stream" from the signature. The verification of the signature validates that the correct key committed to the given message. This happens by means of evaluating an equation testing a mathematical relationship the triplet of `pubkey,message,signature` must fulfill for a valid signature.

H/T Pieter Wuille, David Schwartz, and John Newbery for the helpful comments.

• While ECDSA is closely related to ECIES, and they both use elliptic curve cryptography, the purpose of a signature algorithm is that of authenticating the origin of a message to any verifier whereas an encryption scheme's purpose is to obfuscate a message from anyone but the recipient who holds the corresponding secret. Given the different purposes, the algorithms differ in trade-offs and attack surface. ECDSA is not an encryption algorithm. – Murch Nov 15 '19 at 20:25
• While the math is similar, it's not an encryption algorithm, because you're "encrypting" to public information. It's like saying steering a boat and locking a vault is the same thing because you turn a wheel. It's superficially similar, except in all the ways that matter. – Murch Nov 15 '19 at 22:20
• There is no encryption involved, and ECDSA is not an encryption algorithm. This is trivial to see because there is no way to "decrypt" and get the message hash back out of the signature, even if you'd have the private key. There is a sign(privkey,message) algorithm that produces a signature, and a verify(pubkey,message,signature) algorithm that returns true or false. Verification in no way "decrypts" the signature; it's just an equation that holds for valid signatures, and not otherwise. – Pieter Wuille Nov 15 '19 at 22:39
• Hi Moti. You seem unpersuaded by Pieter and Murch. Perhaps you'll find it more convincing from the person who invented Bitcoin: "Bitcoin does not use any encryption." (Satoshi Nakamoto, Bitcoin v0.1: github.com/bitcoin/bitcoin/blob/…) – jnewbery Nov 17 '19 at 21:46
• @Moti Verification does not involve either decryption, or re-encrypting and comparing. It's simply this equation: a signature is a point R and a number s such that sR = HASH(message)G + (R.x)P (where G is a constant, and P = dG is the public key, with d the private key). Given s and R, and P (or even d), there is no way to compute even HASH(message). Note that you cannot divide by a point - that's the computational hardness assumption ECDSA is based on. – Pieter Wuille Nov 18 '19 at 19:04