Elliptic Curve

Bitcoin's public-key cryptography is built on a specific elliptic curve called secp256k1. Satoshi picked it for the original Bitcoin design and it's been the backbone of every Bitcoin signature ever since.

The relevant property: elliptic curves let you do "one-way math." You can multiply a known curve point G by a secret number k to get another point P (cheap). Going the other way - given P, finding k - is computationally infeasible for any realistic adversary. This asymmetry is the elliptic curve discrete logarithm problem, and Bitcoin's entire ownership model rests on it staying hard.

In practice:

• Your private key is just a number k between 1 and roughly 2^256.
• Your public key is the point P = k·G on the secp256k1 curve.
• Signing a transaction proves you know k without revealing it, by exploiting the same one-way math.

Different elliptic curves exist (ed25519, NIST P-256, others). Bitcoin sticks with secp256k1 for compatibility and because no serious vulnerability has been found in it after sixteen years of being one of the most-attacked cryptographic targets on Earth.

The most plausible threat is a sufficiently powerful quantum computer running Shor's algorithm, which could in principle break elliptic curve discrete log. This is a real concern but not imminent. Address types that don't reveal public keys until spent (P2WPKH, Taproot) already buy some defense-in-depth against that future, though Taproot is a partial exception (the bech32m address IS the tweaked pubkey, with no hash layer in front). See Post-Quantum Bitcoin for the migration framework, and the Key Space rabbit hole for why 2^256 is so much bigger than your intuition wants it to be.