Appendix A · The Cryptography Map: Roads This Book Does Not Take

Across eighteen chapters this book used exactly three cryptographic objects: hashes, key pairs, and signatures.

That is not because cryptography contains only three things. It is because Bitcoin needs only three.

This appendix lays out the whole map so you know where you are standing and where the neighbouring roads go. No code; about ten minutes.

A.1 Encryption: the one primitive this book skipped¶

Encryption is “you can get back” — because you kept a secret.

You need to send an order to the front line: ATTACK. The messenger might be captured. So the general and the front line agree on a number in advance — say 3. Before sending, shift every letter forward by three: A→D, T→W. ATTACK becomes DWWDFN.

The enemy intercepts DWWDFN and learns nothing. The front line knows the number is 3, shifts back, and reads ATTACK.

That is encryption: one agreed secret both locks the message and opens it.

(This is a Caesar cipher, and it is of course not secure — twenty-six possibilities, break it by hand. But the structure — use a shared secret to transform content and transform it back — is the same as any modern cipher.)

How it differs from hashing¶

Section 1.1 covered this; one addition here: encryption is inherently paired — there is a lock and there is an opening. An “encryption” nobody can reverse is useless, because your own side cannot read it either.

Why this book does not need it¶

Because Bitcoin barely uses encryption.

On-chain transactions are public: anyone can see how much moved and to whom. Bitcoin protects “only I can spend my money,” not “nobody can read this.”

So the thing it uses every day is signing, not encrypting. Both use the same key pair, running in opposite directions (the table in section 2.5).

This is one of the book’s quieter conclusions: a system worth a trillion dollars can be built without encryption at all.

A.2 Zero-knowledge proofs: proving it’s true without saying why¶

In one line: you end up convinced, and you received no secret.

Ali Baba’s cave¶

Picture a ring-shaped cave. Just inside, the path splits left and right. Deep at the back the two branches are blocked by a magic door that opens only for the right password, letting you pass from one side to the other.

Ali Baba says he knows the password but absolutely will not say it. How can he convince you without telling you?

Play a three-step game — and these three steps are the skeleton of every zero-knowledge proof:

1. Commit (lock in a choice) — Ali Baba enters and picks left or right, walking to the door. Once chosen he cannot change — and from the entrance you cannot see which he took.

2. Challenge (you make it hard) — you shout a direction: “come out on the right!” You chose at random just now, so he could not have prepared.

3. Respond (he delivers) — if he really knows the password, then whichever side he entered, he can pass the door and emerge on the side you named.

And if he doesn’t know it? He only makes it if he guessed right — a fifty-fifty chance.

Which is why the game must be repeated. One round and a fraud has even odds, so it means nothing. But each extra round he must guess right again — two rounds is 1/4, three is 1/8, ten is about one in a thousand. Twenty rounds of emerging from whichever side you name at random and you are effectively certain.

And you never heard a syllable of the password.

Why the “commit” step is essential¶

Because if Ali Baba could hear your shout first and then choose a side, he’d succeed every time without knowing anything.

He must lock in his choice before you shout. That is precisely what section 1.2’s commitment is for.

But it differs from the guessing game in one way: that commitment is opened publicly at the end; the cave’s commitment is never opened — he locked in “left or right,” and that choice is never revealed. You only ever see him come out where you asked.

Zero-knowledge = committed but never opened; no hash to publish; and certainly no encryption.

One line: how much do you end up knowing?¶

The further right you go, the less you need to know — which is the “zero” in zero-knowledge: the knowledge you receive is zero, the certainty is total.

(Bitcoin’s main chain does not use zero-knowledge proofs. But they turn up nearby: several sidechains and L2s use them for privacy and compression, and schemes like BitVM try to use Bitcoin’s existing script to verify proofs about external computation. This is an active frontier.)

A.3 Secure multi-party computation: compute together, reveal nothing¶

Andrew Yao, 1982, the Millionaires’ Problem:

Two millionaires want to know who is richer, and neither will say how much they have. Can you compute just the comparison without leaking the numbers?

That question opened an entire field: secure multi-party computation (MPC).

It needs a new brick: computable encryption¶

Homomorphic encryption. Ordinary encryption locks things away; to compute on them you must first unlock.

“Computable encryption” lets you compute while everything stays locked: lock 5 in one box and 3 in another, add the two locked boxes without opening them, and get a locked 8. Anyone who opens it sees 8, and nobody ever saw the 5 or the 3.

It is zero-knowledge’s sibling, with a different job¶

(MPC does have real Bitcoin applications: threshold signatures, where a private key is split across several parties and enough of them must cooperate to sign, while the complete key never exists on any single machine. Several institutional custody products work this way.)

A.4 The whole map¶

Cryptography is layered. Grasp these three layers and everything else has somewhere to hang.

A.5 Three cuts through the three most-confused items¶

Put hashing, public-key encryption and public-key signing side by side, and separate them with three questions:

Three things to remember:

① “Easy forwards, hard backwards” is the shared floor of hashing and key pairs. Hashing is easy to compute and hard to invert; a private key easily yields a public key and the reverse is infeasible. Same magic.

② A hash is not encryption. It has no key and no decryption step. The only way to “open” it is for you to publish the original, which is not an algorithm doing anything.

③ The fact that a hash “must be published” is sometimes a weakness and sometimes a weapon:

One property, four contexts, both signs.

This is the single most transferable habit in the book: a technical property is neither good nor bad on its own. It becomes one or the other depending on where you put it.