On 23 October 2026, at 08:46 UTC, the Bitcoin blockchain had reached block 972,744, according to the mempool.space explorer. Anyone with a browser can read every one of those blocks. Open the first transaction, in block 0, and you find a newspaper headline written in plain text and the 65-byte public key the first coins were paid to. Nothing in it is encrypted. Yet nobody can move coins locked to a key like that one without a secret number that has never been written on the chain.
So what is cryptography? It is what produces that gap, between a ledger anyone can read and coins only one person can spend. More precisely, it is the set of mathematical methods that protect information and prove who did what: that a message has not been changed, that it comes from the person it claims to come from and, when needed, that only the intended reader can understand it. Cryptocurrencies are named after it, but they use a narrow slice of it. Hash functions give any piece of data a short fingerprint of fixed size. Digital signatures prove that the holder of a key approved a payment.
This lesson follows our introduction to what a blockchain is. By the end you should be able to tell hashing, encryption and signing apart, say which of them Bitcoin and Ethereum rely on and which they do not, and read the quantum-computing headlines with the right dates in mind. The key pair itself, how a private key gives a public key and then an address, has a lesson of its own later in this path.
What is cryptography used for: proving, more often than hiding
The word comes from the Greek kryptos (hidden) and graphein (to write), and for most of its history it meant just that: writing a message so that an enemy who intercepts it cannot read it. Modern cryptography keeps that job and adds others. Security standards and textbooks usually list four goals, and each one has its own tool.
Four goals, three of which a blockchain needs
- Confidentiality means that only the intended reader can understand a message. Encryption provides it.
- Integrity means that any change to the data, even a single bit, can be detected. Hash functions provide it.
- Authentication means that the receiver can check who sent a message. Digital signatures and message authentication codes provide it.
- Non-repudiation means that the sender cannot later deny having sent it. The NIST glossary frames it as protection against someone who falsely denies having performed an action. Digital signatures provide it too.
A public blockchain needs the last three and gives up the first on purpose. Every node must be able to check every transaction, so amounts and addresses have to stay readable. What must be impossible is to alter a past record without being noticed, to spend coins without the owner’s approval, and for an owner to deny a payment they signed.
Cryptography, encryption, cryptocurrency: three words that are not synonyms
Of the three, encryption is the only tool of cryptography that hides content. Cryptography is the whole field, and it also includes hashing and signatures, which hide nothing at all. A cryptocurrency is a money system built with some of those tools; the “crypto” in its name points to the signatures that protect it, not to secret transactions. Cryptology, a word you meet in older texts, covers both cryptography (making codes) and cryptanalysis (breaking them).
The confusion has a practical cost. Someone who believes Bitcoin is “encrypted” may assume their payments are private. They are not, as a later section of this lesson shows with the white paper’s own words.
From Caesar’s letters to elliptic curves: the dates that matter
The oldest well-documented cipher is a simple shift. The Roman historian Suetonius wrote that Julius Caesar, in confidential letters, would “substitute the fourth letter of the alphabet, namely D, for A, and so with the others” (Life of Julius Caesar, section 56). Whoever guesses the trick reads the letter. The secret is the method itself, and with a 26-letter alphabet there are only 25 shifts to try.
For centuries ciphers stayed variations on that idea, with ever more complex substitutions. The German Enigma machine mechanised them with rotating wheels: Arthur Scherbius patented it in 1918, the first machines branded Enigma appeared in 1923, and the German armed forces used versions of it until 1945. Marian Rejewski, of the Polish Cipher Bureau, built a replica of the military machine in 1932-33. During the war the British codebreakers of Bletchley Park read Enigma traffic with hand methods and electro-mechanical Bombes, as the Crypto Museum recounts.
Computers changed the scale. The Data Encryption Standard (DES), a US federal standard whose last revision, FIPS 46-3, NIST published on 25 October 1999, used a 56-bit key. That proved too short. In January 1999 the Electronic Frontier Foundation’s Deep Crack machine, working with nearly 100,000 PCs of the distributed.net network, found a DES key in 22 hours and 15 minutes, beating its own record of 56 hours set in July 1998, the EFF announced on 19 January 1999. NIST withdrew FIPS 46-3 on 19 May 2005.
Its successor is AES, the Advanced Encryption Standard, published as FIPS 197 on 26 November 2001. It is the Rijndael cipher, chosen in a public competition, and it works on blocks of 128 bits with keys of 128, 192 or 256 bits. NIST updated the text on 9 May 2023 without changing the algorithm.
1976: the key-distribution problem gets an answer
Every one of those ciphers shares one weakness: sender and receiver must already hold the same secret key. Armies and banks moved keys by courier. In November 1976 Whitfield Diffie and Martin Hellman, at Stanford, published “New Directions in Cryptography” in the IEEE Transactions on Information Theory. Its first sentence reads: “We stand today on the brink of a revolution in cryptography.” The paper proposed systems that cut the need for secure channels to hand out keys and that supply “the equivalent of a written signature”.
Ronald Rivest, Adi Shamir and Leonard Adleman, at MIT, described the first practical system of that kind, RSA, in a paper published by Communications of the ACM in February 1978. Its security, they wrote, rests partly on how hard it is to factor a large published number. The abstract also states the property that cryptocurrencies would rely on three decades later: “Signatures cannot be forged, and a signer cannot later deny the validity of his signature.” (RSA paper)
In 1985 Victor Miller, at the CRYPTO ’85 conference, proposed building the same kind of system on elliptic curves; Neal Koblitz reached the idea independently, in a paper published in 1987. Elliptic curves give equivalent security with much shorter keys. In the comparison table of the SEC 2 standard, a 256-bit curve sits at the same security level as a 3,072-bit RSA key. Elliptic curve cryptography is the branch Bitcoin and Ethereum use.
| Date | Milestone |
|---|---|
| 1st century BC | Caesar’s shift cipher, later described by Suetonius |
| 1918 | Arthur Scherbius patents the Enigma machine |
| November 1976 | Diffie and Hellman publish “New Directions in Cryptography” |
| February 1978 | RSA paper in Communications of the ACM |
| 1985 | Victor Miller proposes elliptic curve cryptography (Neal Koblitz independently, paper of 1987) |
| 19 January 1999 | A 56-bit DES key found in 22 hours 15 minutes |
| 26 November 2001 | AES published as FIPS 197 |
| 31 October 2008 | Bitcoin white paper |
| August 2015 | SHA-3 published as FIPS 202 |
| 14 November 2021 | Taproot (Schnorr signatures) active on Bitcoin, block 709,632 |
| 13 August 2024 | NIST publishes its first three post-quantum standards |
Hash functions: a fixed-size fingerprint for any data
A hash function takes any input, a word, a contract or a four-gigabyte film, and returns a short string of fixed length called a hash or digest. SHA-256, the function Bitcoin uses, always returns 256 bits, written as 64 hexadecimal characters. It belongs to the SHA-2 family that NIST specifies in FIPS 180-4 (August 2015). The four digests below were computed with Python’s standard hashlib library on 23 October 2026; anyone can reproduce them in a few seconds.
| Input | SHA-256 digest (computed 23 October 2026) |
|---|---|
| (empty text) | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| abc | ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad |
| Coindaro | cc640dcae7abc17683f609d3e26a2f78a6b4acc85da607e03d8ea99c1b192894 |
| coindaro | e8709cf11980229adf58f9b8201b3ee48c83a7a211c419f3af8fecd6183a7580 |
Compare the last two rows. One capital letter changed, and the two fingerprints share nothing visible. That behaviour, called the avalanche effect, is deliberate. A small edit to the input yields an output that looks unrelated, so nobody can tweak a document slightly and keep its hash.
Four properties that make a hash useful
- It is deterministic: the same input always gives the same digest on any computer, so two strangers can check they hold the same file by comparing 64 characters.
- Its output has a fixed size, 256 bits for SHA-256, whether the input is one letter or an entire hard disk.
- It is one-way: from a digest there is no known shortcut back to the input, only guessing inputs and hashing each guess.
- It resists collisions: finding two different inputs with the same digest is meant to be practically impossible, even though such pairs must exist, since inputs are unlimited and outputs are not.
Those properties explain why a hash is used as proof of integrity. Publish the digest of a file today, and anyone can check next year that the file in their hands is the same one, byte for byte, without you sending the file again.
Where Bitcoin and Ethereum use hashes
Hashes are everywhere in a blockchain. Each block records the hash of the one before it, and that is what turns separate blocks into a chain; the mechanism is laid out in our lesson on how a blockchain works, so it is not repeated here.
Mining is hashing too. The Bitcoin white paper describes proof of work as “scanning for a value that when hashed, such as with SHA-256” starts with a required number of zero bits. Miners hash candidate blocks over and over, changing a small field each time, until one digest falls below the target. Finding it takes enormous work; checking it takes a single hash.
Addresses come from hashes as well. A classic Bitcoin address, the kind that starts with a 1, is built by hashing the public key with SHA-256 and then with another function, RIPEMD-160, and by adding a four-byte checksum taken from a double SHA-256. The checksum is there so that a mistyped address is caught before money leaves. On Ethereum an address is obtained by “taking the last 20 bytes of the Keccak-256 hash of the public key”, ethereum.org explains, and written as 42 characters starting with 0x. Our guide to crypto addresses shows the formats you meet in wallets.
SHA-256 and Keccak-256 are not the same function
Ethereum picked a different hash. Keccak won the competition NIST ran to choose a new standard, SHA-3, published as FIPS 202 in August 2015. Ethereum, launched in July 2015, uses Keccak as it was submitted to that competition, while the final standard changed the padding byte added to the input before hashing (0x06 instead of 0x01). The two give different results for the same input.
For an empty input, NIST’s SHA3-256 returns a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a, while Ethereum’s Keccak-256 returns c5d2460186f7233c927e7db2dcc703c0e500b653ca82273b7bfad8045d85a470. We computed both on 23 October 2026, the second with a reference implementation that reproduces the official SHA3-256 output when given the standard’s padding. A developer who calls a library’s generic “SHA3” function to derive an Ethereum address gets a wrong address.
Encryption: one shared key or a key pair
Most people picture encryption when they hear the word cryptography: turning readable data, the plaintext, into unreadable ciphertext that only the holder of a key can turn back. It comes in two families, and the difference between them is one of the questions newcomers ask most.
Symmetric encryption uses one secret key in both directions. AES is the standard example. It is fast, handles large volumes of data and is widely used to protect stored files and network traffic. Its weakness is the one Diffie and Hellman described in 1976: both sides must first obtain the same key without anyone else seeing it.
Asymmetric encryption, also called public-key encryption, uses a pair of keys. A public key, which anyone may hold, encrypts a message; only the matching private key, kept secret, decrypts it. RSA can work this way. It solves the key-exchange problem but is far slower, so real systems combine the two. When your browser opens an HTTPS page, public-key cryptography is used to agree on a fresh symmetric key, and a symmetric cipher then carries the data.
End-to-end encryption in messaging apps applies the same idea between two phones: the company carrying the messages does not hold the keys that open them. It has nothing to do with cryptocurrencies, despite the shared prefix.
Bitcoin does not encrypt your transactions
A Bitcoin or Ethereum transaction is not encrypted on the chain, whatever the word “crypto” suggests. The receiving address, the amount and the fee are written in clear, because every node has to check them before accepting the block. Encryption appears around the blockchain, not in it: a software wallet may encrypt the file holding your keys with a password, and the link between your app and an exchange runs over HTTPS. The coins themselves are guarded by signatures.
Digital signatures: proving you may spend without showing your secret
A digital signature is a number computed from a message and a private key. Anyone holding the matching public key can check that the signature fits that exact message and that key, but cannot produce a new one. Change one character of the message and the check fails. That is the written-signature equivalent Diffie and Hellman were after, with one difference: a handwritten signature looks the same on every document, while a digital one is different for each message, so it cannot be lifted from one payment and pasted onto another.
Satoshi Nakamoto put signatures at the centre of Bitcoin. The white paper, dated 31 October 2008, says it in one line: “We define an electronic coin as a chain of digital signatures.” Each owner hands a coin on by signing a hash of the previous transaction together with the next owner’s public key. Our lesson on the Bitcoin white paper goes through the document section by section.
ECDSA on secp256k1, the curve Bitcoin and Ethereum share
The white paper never names an algorithm; the software does. “Bitcoin uses the Elliptic Curve Digital Signature Algorithm”, the Bitcoin developer guide states, on a curve called secp256k1. Ethereum made the same choice: its formal specification, the Ethereum Yellow Paper, says transactions are signed with “recoverable ECDSA signatures” on the SECP-256k1 curve (Appendix F).
secp256k1 is defined in SEC 2, a document of the Standards for Efficient Cryptography Group, which lists it as a Koblitz curve. Its equation is short, y² = x³ + 7, over a field of 256-bit numbers. NIST did not design it. Its own curves, such as P-256, were generated from published seeds; secp256k1 appears only in an appendix of NIST SP 800-186 (February 2023), which allows it “for blockchain-related applications”. The difference made the news in October 2026, when the seeds of the NIST curves were traced to an old Unix random-number generator started from 1997-98 timestamps. secp256k1 has no such seed, so nothing changed for Bitcoin and Ethereum keys, as our report on the NIST curve seeds explained. The open-source library that does this arithmetic, libsecp256k1, says its development has focused on use in the Bitcoin system.
Schnorr signatures and Taproot since November 2021
Bitcoin added a second signature scheme in 2021. BIP 340 specifies Schnorr signatures on the same curve, with 32-byte public keys and 64-byte signatures. Their algebra is linear: several people can combine their keys and produce one signature that is valid for the sum of their public keys, and a node can check many signatures in one batch faster than one by one.
BIP 341, known as Taproot, builds on it. It activated at block 709,632, mined on 14 November 2021 at 05:15 UTC according to mempool.space. For users the main change is discretion. A Taproot output spent through its key path looks like any single-key payment, even when several co-owners or a set of spending conditions stand behind it, so less data goes on the chain and less is given away about the arrangement.
How a private key is generated, why a public key can be shared and how a seed phrase backs everything up belong to the next lesson in this path. For now, one rule from our guide to seed phrase security is enough: a signature proves you hold the key, so whoever obtains the key can sign in your place.
What crypto does not hide: a public ledger of pseudonyms
The white paper is candid about privacy. Section 10 explains: “The public can see that someone is sending an amount to someone else, but without information linking the transaction to anyone.” Privacy rests on keeping the owners of public keys unknown, not on hiding transactions, and the paper advises that a new key pair be used for each transaction.
That is pseudonymity, not anonymity. The same section admits a limit: transactions with several inputs reveal that those inputs belonged to the same owner. Chain-analysis companies build on clues of that kind, and once one address is tied to a name, for example through an exchange account opened with identity checks, the history of the addresses linked to it becomes readable too.
The very first transaction proves how open the ledger is. Its input, in block 0, carries in plain text “The Times 03/Jan/2009 Chancellor on brink of second bailout for banks”, visible to anyone on mempool.space. The story of that block and its headline is told in our lesson on the genesis block and the 2008 crisis.
Where cryptography can add privacy
Hiding data on a chain is possible, but it takes other tools. Zero-knowledge proofs let someone prove that a statement is true, for instance that a transaction balances, without revealing the data behind it. Zcash relies on them for its shielded payments, and zk-rollups use them on Ethereum to prove that a whole batch of transactions is valid. Our glossary entry on the zero-knowledge proof gives the basics.
What no algorithm protects you from
Cryptography protects the key; it does not protect the person holding it. A phishing page that obtains your seed phrase gets exactly the signing power you have, and the network cannot tell the difference. An attacker who threatens someone in person, a “wrench attack” in security slang, bypasses the mathematics entirely. A lost key is lost for good, because no help desk can sign for you. Our guide on how to avoid crypto scams lists the traps that work on people rather than on algorithms.
Quantum computers and crypto: where things stand as of October 2026
Quantum computers threaten one family above all: public-key schemes such as RSA and elliptic curves. A large enough machine running Shor’s algorithm could derive a private key from its public key. Hash functions are generally considered far less exposed, because the best known quantum attack on them gives a much smaller advantage. No machine able to break a 256-bit curve exists as of October 2026. What exists are resource estimates, and they have fallen quickly.
| Published | Who | Target | Estimated machine |
|---|---|---|---|
| 21 May 2025 | Craig Gidney, Google Quantum AI | RSA-2048 | fewer than 1 million noisy qubits, under a week |
| 31 March 2026 | Google Quantum AI | 256-bit elliptic curve | fewer than 500,000 physical qubits, a few minutes |
| 8 September 2026 | IonQ | secp256k1 | 19,397 trapped-ion physical qubits, about 25.7 days per attempt |
For scale, the Google chip at the centre of our 16 October 2026 report on quantum error rates has 105 qubits. In its 31 March 2026 post, Google recommended that blockchains move to post-quantum cryptography and gave 2029 as the target for its own migration.
Replacements exist on paper. On 13 August 2024 NIST, the US standards agency, published its first three post-quantum standards: FIPS 203 (ML-KEM, to establish shared keys), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), the last two for signatures. NIST’s Dustin Moody encouraged system administrators “to start integrating them into their systems immediately”. A NIST draft of 12 November 2024, IR 8547, plans the removal of quantum-vulnerable algorithms from its standards by 2035. In the UK, the National Cyber Security Centre asks organisations to finish migrating by 2035, with planning milestones in 2028 and 2031.
Bitcoin has a proposal on the table, not a decision. BIP 360, assigned on 18 December 2024 and still marked Draft, opens with: “This document proposes a new output type: Pay-to-Merkle-Root (P2MR), via a soft fork.” The new output drops Taproot’s key-path spend, the route that puts a public key on the chain. As for the date when a machine might break a 256-bit curve, the honest answer as of October 2026 is that nobody knows.
What to remember: three tools, three jobs
| Goal | Tool | Where it appears in Bitcoin and Ethereum |
|---|---|---|
| Integrity | Hash function (SHA-256, Keccak-256) | Links between blocks, mining, addresses |
| Authentication and non-repudiation | Digital signature (ECDSA, Schnorr) | Every spend of coins |
| Confidentiality | Encryption (AES, RSA) | Not on the chain; wallet files and HTTPS connections |
The next lesson in this path takes the key pair apart: how a private key is made, how it yields a public key and then an address, and why a lost one cannot be found again.
