This chapter assembles the small toolkit of cryptographic ideas on which every later technical chapter depends. A blockchain has no police force, no central bank, and no head office; it cannot rely on a trusted authority to vouch for who said what or to guarantee that records were not altered after the fact. In place of that authority it substitutes mathematics. Four mathematical tools do almost all of the heavy lifting: the cryptographic hash function, which gives data a tamper-evident fingerprint; public-key cryptography, which lets strangers exchange secrets and prove identity without ever sharing a password; the digital signature, which proves who authorised something without revealing any secret; and the Merkle tree, which summarises an enormous pile of data in a single short value. None of these was invented for Web3. They are decades old, peer-reviewed, and used billions of times a day to secure ordinary web traffic, banking, and messaging. Web3's contribution was to bolt them together into a system that needs no trusted referee. To understand that system, one must first understand the parts — and the good news is that each can be grasped through a homely analogy without a line of mathematics.
In plain terms: a blockchain replaces "trust the institution" with "check the maths." This chapter explains the four pieces of maths, in plain language, so that the rest of the book can use them freely.
Subscribe and this chapter opens here.
Your invite link
In plain terms
a blockchain replaces "trust the institution" with "check the maths." This chapter explains the four pieces of maths, in plain language, so that the rest of the book can use them freely.
feed anything into SHA-256 and you get back a 64-character code. The same input always yields the same code; the code is short and easy to compare; and — crucially — if even one comma in the input changes, the code changes completely. It behaves like a fingerprint that data carries around with it.
hashing is like putting fruit into a blender. Turning strawberries and bananas into a smoothie is quick and easy; reconstructing the original whole fruit from the smoothie is impossible. The blending only runs one way. A hash is the smoothie of your data: easy to make, impossible to un-blend.
a hash is like a human fingerprint in that it is short, effectively unique, and easy to compare without examining the whole person. But the analogy must be qualified. A real fingerprint changes smoothly — identical twins have similar prints — whereas a hash deliberately does the opposite: the tiniest change in the data produces a totally unrelated fingerprint (the avalanche effect). And unlike a person, whom you can recognise from their print, you can never reconstruct the data from its hash.
publishing a document's hash is like sealing a letter with a unique wax stamp. Anyone can see the seal; if someone opens and alters the letter, the seal no longer matches, and the tampering is obvious to all.
imagine you mass-produce open padlocks, all able to be snapped shut, and you mail them out freely or leave them in a public bin. You alone keep the one key that opens them. Now anyone in the world can put a message in a box, snap one of your padlocks shut on it, and send it to you; only you can open it. The open padlock is your public key (anyone may use it to lock); the key in your pocket is your private key (only you can unlock). You never had to share the secret — you only shared the locks.
RSA hides the private key behind a maths problem that is quick to set up but practically impossible to undo. It is easy to mix two specific primes together; it is monstrously hard to un-mix the result. Your secret is safe not because it is hidden in a vault, but because reversing the public maths is beyond any feasible computer.
elliptic-curve cryptography is public-key cryptography on a diet. It does everything RSA does — keep secrets, make signatures — but with keys small enough to tuck into a phone or a barcode. It is the particular flavour that the major blockchains run on.
in earlier centuries a noble would press a signet ring into hot wax to seal a letter. Anyone receiving the letter could recognise the distinctive seal and know it came from the ring's owner — yet they could not themselves produce that seal, because they did not have the ring. A digital signature is a mathematical signet ring. Only you own the ring (your private key), so only you can make the mark; but everyone can recognise it (using your public key). And unlike wax, the digital seal is also stamped with a fingerprint of the letter's exact contents, so it cannot be peeled off one document and stuck onto another.
a digital signature lets you prove "I am the owner and I approve this exact message" to people who do not trust you and never see your secret. That single capability — verifiable authorisation without a trusted middleman — is what makes a refereeless ledger possible at all.
picture a knockout sports tournament. Every transaction is a player in the first round. Each match "plays off" a pair by hashing them together; the winner advances to the next round, where it is paired and hashed again. Round after round the field halves, until a single champion remains — the Merkle root — that stands for the whole tournament. Change anything about any player in round one, and the results ripple all the way up so that a different champion emerges.
to prove your favourite player took part in the tournament, you do not need the full results of every match. You need only the results along that player's own path through the bracket — a short list. Anyone holding the name of the champion can follow your short list upward and confirm it leads to that same champion. A Merkle tree lets you prove "this item is in the dataset" by showing a tiny slice of it.
Merkle trees are how a blockchain keeps its promise of integrity at scale and lets a phone, not just a data centre, take part. They compress "is this true?" from a question about millions of records into a question about a few dozen hashes.
the locks in this chapter are excellent locks. But a perfect lock does not help if you hand a thief the key, install the lock on a cardboard door, or sign a contract you did not read. Cryptography is necessary for Web3's security; it is nowhere near sufficient. Keep that distinction in view for the rest of the book.
What the chapter covers
- The cryptographic hash function: a fingerprint for data
- Public-key cryptography: the padlock you can hand to strangers
- Digital signatures: proving authorship without giving up the secret
- Merkle trees: summarising a mountain of data in one value
- A note on what cryptography does and does not guarantee
- Synthesis
Terms explained in this chapter
The full chapter is in the book.
Buy the full bookGet Chapter 8 free
Subscribe and Chapter 8, on cryptography, opens for you on this site. Invite friends and the rest of Part III opens too.
One email to confirm, then Web3 in plain terms, a free seven-day email course, and an occasional note about the book. Unsubscribe any time.