Y

Blockchain fundamentals · Beginner

Keys, addresses and signed messages

3 min read

Why it matters

On a blockchain, your identity is a key pair. Whoever holds the private key controls the account and its funds, and there is no password reset. Understanding keys, addresses and signatures is the basis of wallets, transactions and many contract features such as permits and meta-transactions.

The concept

  • A private key is a secret random number. On Ethereum it is 32 bytes.

  • The public key is derived from it with elliptic-curve cryptography (secp256k1). It cannot be reversed to the private key.

  • The address is the last 20 bytes of the Keccak-256 hash of the public key, shown in hex with a mixed-case checksum.

  • A signature proves that the holder of the private key approved exactly this data. Every transaction is a signed message; nodes recover the sender's address from the signature.

  • Wallets manage keys. Seed phrases (BIP-39) encode keys for backup. Hardware wallets keep keys off internet-connected machines.

Worked example: signing with cast

Install Foundry, then use the first of Anvil's public test keys. This key is published in Foundry's documentation for local testing; anyone can use it, so it must never hold real funds.

shellsession
$ export KEY=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80
$ cast wallet address --private-key $KEY
0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266
$ cast wallet sign --private-key $KEY "pay ravi 5"
0x2a06b93ec0261893c844460641bf3153b5f28c55744c2e2005880fa8e9fef44d058b965a187344fea85e20f940fc3b31f80e00aa41cf5d3eb7553ea5cc243f761b
$ cast wallet verify --address 0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266 "pay ravi 5" 0x2a06...761b
Validation succeeded. Address 0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266 signed this message.
$ cast wallet verify --address 0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266 "pay ravi 50" 0x2a06...761b
Error: Validation failed. Address 0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266 did not sign this message.

(The signature is shortened in the verify commands for readability; pass the full value.) The address is derived from the key, the signature verifies for the exact message that was signed, and changing "5" to "50" makes verification fail. This is what stops anyone from altering a signed transaction. The signature is 65 bytes: two 32-byte values and a recovery byte that lets verifiers recover the signer's address.

Common mistakes

  • Pasting a real private key or seed phrase anywhere (a website, a chat, a repository). Anyone who sees it owns the funds.

  • Signing messages you do not understand. Wallet signature requests can authorise token approvals or transfers.

  • Reusing signatures. Contracts that verify signatures must include a nonce, an expiry and the chain ID, or a signature can be replayed.

Interview angle

"How is an Ethereum address derived?" "What does signing a transaction prove?" "What is a replay attack and how do you prevent it?" (nonces, chain ID, domain separation as in EIP-712). "How would you store keys for a backend service that sends transactions?" (an HSM or KMS, never plain files).

Practice task

  1. Create a fresh key with cast wallet new, sign a message and verify it.

  2. Read EIP-712 and explain how typed structured data makes signature requests safer for users.

Further reading