Key Generation:
Private Key (sk) ──┐
                   ├──→ Public Key (pk)
                   │
                   │  One-way function:
                   │  pk = f(sk)
                   │
                   │  Given pk, cannot find sk
                   ▼

Security Assumptions:
1. Computational hardness
2. Discrete Logarithm Problem (DLP)
3. Integer Factorization Problem
4. Elliptic Curve Discrete Logarithm (ECDLP)

RSA Key Generation:
1. Choose two large primes: p, q
2. Compute n = p × q
3. Compute φ(n) = (p-1) × (q-1)
4. Choose e (public exponent)
5. Compute d = e⁻¹ mod φ(n) (private key)

RSA Security:
- Based on Integer Factorization
- Larger keys needed for security
- Key Size: 2048-4096 bits

RSA Limitations:
- Large key sizes
- Slow encryption/decryption
- Not ideal for mobile/embedded
- Vulnerable to quantum attacks

ECC Benefits:
1. Smaller keys (256 bits)
2. Faster operations
3. Lower power consumption
4. Stronger security per bit

ECC vs RSA Comparison:
Security Level | RSA Key Size | ECC Key Size
80-bit | 1024 bits | 160 bits
128-bit | 3072 bits | 256 bits
192-bit | 7680 bits | 384 bits
256-bit | 15360 bits | 512 bits

Standard Weierstrass Form:
y² = x³ + ax + b

Where:
- a, b ∈ F_p (field elements)
- 4a³ + 27b² ≠ 0 (non-singular)
- p = prime (field characteristic)

Bitcoin Curve (secp256k1):
y² = x³ + 7
p = 2²⁵⁶ - 2³² - 2⁹ - 2⁸ - 2⁷ - 2⁶ - 2⁴ - 1

Properties:
- Prime order curve
- Koblitz curve
- Efficient implementation
- 256-bit security

Point Addition Rules:

1. P + O = O + P = P (identity element)
2. P + (-P) = O (inverse element)
3. P + Q = R (where R is reflection of third point)

Coordinate Formulas:
For P = (x₁, y₁), Q = (x₂, y₂):
If P ≠ Q:
    λ = (y₂ - y₁) / (x₂ - x₁)
    x₃ = λ² - x₁ - x₂
    y₃ = λ(x₁ - x₃) - y₁

If P = Q (doubling):
    λ = (3x₁² + a) / (2y₁)
    x₃ = λ² - 2x₁
    y₃ = λ(x₁ - x₃) - y₁

Scalar Multiplication:
k × P = P + P + ... + P (k times)

Efficient Methods:
1. Double-and-Add (binary method)
2. Montgomery Ladder
3. Windowed Methods
4. Precomputation (fixed-base)

Double-and-Add Algorithm:
1. Convert k to binary
2. Iterate bits from MSB to LSB:
   a. Double current point
   b. If bit=1: Add P

Complexity: O(log k) operations

ECDSA Parameters:
- Curve: secp256k1
- Generator: G
- Order: n
- Private Key: d (random integer)
- Public Key: Q = d × G

ECDSA Signing:
1. Generate random k (1 ≤ k ≤ n-1)
2. Compute R = k × G
3. r = R.x mod n (x-coordinate)
4. Compute s = k⁻¹ × (z + r × d) mod n
5. Signature = (r, s)

ECDSA Verification:
1. Check 1 ≤ r ≤ n-1 and 1 ≤ s ≤ n-1
2. Compute u₁ = z × s⁻¹ mod n
3. Compute u₂ = r × s⁻¹ mod n
4. Compute point = u₁ × G + u₂ × Q
5. Verify point.x == r (mod n)

Where z = hash(message) mod n

Security Properties:
1. Integrity: Message cannot be modified
2. Authenticity: Signer's identity verified
3. Non-repudiation: Signer cannot deny
4. Unforgeability: Cannot forge signatures

Attack Vectors:
1. Reuse of k (nonce)
   - Leaks private key
   - Must use unique k

2. Weak Randomness
   - Predictable k
   - Similar vulnerability

3. Fault Attacks
   - Generate faulty signature
   - Recover private key

4. Side-channel Attacks
   - Timing information
   - Power consumption
   - Electromagnetic radiation

If k is reused for two messages:
s₁ = k⁻¹ × (z₁ + r × d) mod n
s₂ = k⁻¹ × (z₂ + r × d) mod n

Subtract:
(s₁ - s₂) × k = z₁ - z₂
k = (z₁ - z₂) / (s₁ - s₂)

Then:
d = (s₁ × k - z₁) / r

Private key exposed!

Schnorr Signing:
1. Generate random k (1 ≤ k ≤ n-1)
2. Compute R = k × G
3. Compute e = Hash(R || message)
4. Compute s = k - e × d
5. Signature = (R, s)

Schnorr Verification:
1. Compute e = Hash(R || message)
2. Compute s × G + e × Q
3. Verify equals R

Advantages over ECDSA:
1. Simpler (no inverse needed)
2. Faster verification
3. Linear (aggregation possible)
4. More secure (provable)
5. Smaller signatures (optional)

Aggregated Signature:
For signatures (R₁, s₁), (R₂, s₂):
- R = R₁ + R₂
- s = s₁ + s₂

Verification:
- s × G = R + e × Q
- Where Q = Q₁ + Q₂

Benefits:
- Smaller block size
- Faster verification
- Privacy (key aggregation)
- Taproot (Bitcoin upgrade)

BLS Signatures:
1. Use pairing-based cryptography
2. Signatures are group elements
3. Aggregation of signatures

BLS Signing:
1. σ = H(m) × sk (scalar multiplication)
2. Signature = σ

BLS Verification:
1. e(σ, G) = e(H(m), pk)
2. Where e is pairing

BLS Advantages:
1. Short signatures (33 bytes)
2. Aggregation: n signatures → 1 signature
3. Faster verification
4. Deterministic (no randomness)

Quantum Computing Impact:
- Shor's Algorithm: Breaks RSA and ECC
- Grover's Algorithm: Weakens symmetric crypto
- Timeline: 10-20 years (speculative)

Post-Quantum Alternatives:
1. Lattice-based (Kyber, Dilithium)
2. Code-based (McEliece)
3. Multivariate (Rainbow)
4. Hash-based (SPHINCS+)
5. Isogeny-based (SIKE - deprecated)

NIST PQC Standards:
- Kyber: Key Encapsulation
- Dilithium: Digital Signatures
- Falcon: Digital Signatures
- SPHINCS+: Hash-based Signatures

secp256k1 Parameters:

Prime Field: p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
= 2²⁵⁶ - 2³² - 2⁹ - 2⁸ - 2⁷ - 2⁶ - 2⁴ - 1

Curve Equation: y² = x³ + 7
a = 0x0000000000000000000000000000000000000000000000000000000000000000
b = 0x0000000000000000000000000000000000000000000000000000000000000007

Generator G:
x = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
y = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8

Order n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
n = 2²⁵⁶ - 0x14551231950B75FC4402DA1732FC9BEBF

Cofactor h = 1

Deterministic k Generation:
1. Hash private key and message
2. Use HMAC to generate k
3. Ensure k is valid

Benefits:
- No random number generator needed
- Prevents k-reuse attacks
- Reproducible signatures

Algorithm:
k = HMAC(priv_key, message_hash)
If k invalid, increment counter

DER Encoding (Bitcoin):
Sequence:
  Integer: r
  Integer: s

Compact Format:
- 64 bytes total
- r: 32 bytes
- s: 32 bytes
- Recovery ID: 1 byte

Raw Format (Ethereum):
- v: 1 byte (recovery ID + 27/28)
- r: 32 bytes
- s: 32 bytes

Double-and-Add vs Montgomery:

Double-and-Add:
- Variable-time (bit-dependent)
- Side-channel vulnerable

Montgomery Ladder:
- Constant-time (bit-independent)
- Side-channel resistant
- Faster operations

Algorithm:
For each bit in k:
  if bit=1:
    R₁ = R₀ + R₁
    R₀ = 2 × R₀
  else:
    R₀ = R₀ + R₁
    R₁ = 2 × R₁

Fixed-Base Multiplication:
1. Precompute multiples of G
2. Use window method
3. Faster scalar multiplication

Sliding Window:
1. Process multiple bits at once
2. Reduce number of additions
3. 2-4× speedup

Comb Methods:
1. Precompute combinations
2. Use multiple tables
3. 5-10× speedup

Common Side-Channels:
1. Timing: Different operation times
2. Power: Different power consumption
3. EM: Electromagnetic emissions
4. Cache: Memory access patterns

Mitigations:
1. Constant-time operations
2. Masking
3. Blinding
4. Decoupling operations
5. Hardware security modules