After this lesson you can: explain how a public key is derived and why it cannot be reversed.
Bitcoin uses elliptic curve cryptography on a specific curve, secp256k1, defined by the equation y² = x³ + 7 over a huge finite field. Points on this curve can be "added" by a geometric rule, and a point can be multiplied by a number by adding it to itself repeatedly, using fast doubling tricks.
The one-way function
There is a fixed starting point on the curve called the generator, G. Your public key is simply:
P = k × G
where k is your private key. Multiplying is fast (a few hundred doublings and additions). Going the other way, finding k from P and G, is the discrete logarithm problem, for which no efficient classical algorithm is known. That asymmetry is the whole of Bitcoin's key security.
Encoding
A point has an x and a y coordinate, 32 bytes each. Since the curve equation gives y from x up to sign, the compressed format stores only x plus a prefix byte, 02 or 03, indicating which y: 33 bytes total. Uncompressed keys (prefix 04, 65 bytes) exist from early Bitcoin. Taproot uses "x-only" keys of 32 bytes.
What a public key can do
Anyone with your public key can verify your signatures and derive your addresses. It cannot sign, and it cannot reveal k. In the original Bitcoin design coins were paid directly to public keys (P2PK); modern outputs pay to a hash of the key, which is the next lesson.
A compressed public key is 33 bytes. How many bytes is the uncompressed form?