The Cryptographic Toolkit

Why Cryptography?

In Module 1, you saw 30 years of failed digital money. Every attempt relied on a set of mathematical tools most people never think about. In this module we open the toolbox and examine each tool one by one — so that when we build a cryptocurrency in Module 3, you'll understand exactly why each piece is there.

Hash Functions

A hash function takes any input — a word, a book, an entire database — and produces a fixed-length output called a digest (or simply a hash). SHA-256, the algorithm Bitcoin uses, always outputs exactly 256 bits (64 hex characters), no matter the input size.

Five Essential Properties

See the Avalanche Effect

Notice how changing just one letter (lowercase "b" → uppercase "B") completely transforms the hash:

$ echo -n "blockchain" | sha256sum
ef7797e13d3a75526946a3bcf00daec9fc9c9c4d51ddc7cc5df888f74dd434d1

$ echo -n "Blockchain" | sha256sum   # capital B
625da44e4eaf58d61cf048d168aa6f5e492dea166d8bb54f06c3b1f4a001be23

One letter changed, every character in the hash is different. That's the avalanche effect in action.

Node.js: Your First Hash

const { createHash } = require('crypto');

function sha256(data) {
  return createHash('sha256')
    .update(data)
    .digest('hex');
}

console.log(sha256('blockchain'));
// ef7797e13d3a75526946a3bcf00daec9fc9c9c4d51ddc7cc5df888f74dd434d1

console.log(sha256('Blockchain'));
// 625da44e4eaf58d61cf048d168aa6f5e492dea166d8bb54f06c3b1f4a001be23

Asymmetric Key Cryptography

Symmetric cryptography uses one key for both locking and unlocking — like a door key. The problem: how do you share that key securely with a stranger on the internet? Asymmetric cryptography solves this by using two keys: one public, one private.

Node.js: Generate a Key Pair

const { generateKeyPairSync } = require('crypto');

const { publicKey, privateKey } = generateKeyPairSync('ec', {
  namedCurve: 'secp256k1',
  publicKeyEncoding:  { type: 'spki',  format: 'pem' },
  privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
});

console.log('Public key:\n', publicKey);
console.log('Private key:\n', privateKey);

Digital Signatures

A digital signature is the bridge between your private key and the outside world. It lets you prove "I authorised this transaction" without revealing your private key. Anyone with your public key can verify the signature — but nobody can forge one without the private key.

The Sign → Verify Cycle

Node.js: Sign and Verify a Message

const { createSign, createVerify, generateKeyPairSync } =
  require('crypto');

// 1. Generate key pair
const { publicKey, privateKey } = generateKeyPairSync('ec', {
  namedCurve: 'secp256k1',
});

// 2. Sign
const message = 'Alice sends 1 BTC to Bob';
const signer = createSign('SHA256');
signer.update(message);
const signature = signer.sign(privateKey, 'hex');

// 3. Verify
const verifier = createVerify('SHA256');
verifier.update(message);
console.log(verifier.verify(publicKey, signature, 'hex'));
// true ✓

Merkle Trees

A Bitcoin block can contain thousands of transactions. Verifying all of them one by one is slow. Ralph Merkle (1979) invented a data structure that lets you verify any single transaction using only a handful of hashes — even in a block with 10,000 transactions.

Node.js: Build a Merkle Root

const { createHash } = require('crypto');

function sha256(data) {
  return createHash('sha256').update(data).digest('hex');
}

function merkleRoot(txs) {
  let hashes = txs.map(tx => sha256(tx));
  while (hashes.length > 1) {
    if (hashes.length % 2) hashes.push(hashes[hashes.length - 1]);
    const next = [];
    for (let i = 0; i < hashes.length; i += 2)
      next.push(sha256(hashes[i] + hashes[i + 1]));
    hashes = next;
  }
  return hashes[0];
}

const txs = ['Alice→Bob 1BTC', 'Bob→Carol 0.5BTC',
            'Carol→Dave 0.3BTC', 'Dave→Eve 0.1BTC'];
console.log('Merkle root:', merkleRoot(txs));

Putting It All Together

Each tool is powerful on its own. But Bitcoin's strength comes from combining all four into a single, interconnected system. Let's trace how they work together inside a single Bitcoin block.

Inside a Bitcoin Block

Exercise: Crypto Toolkit in Node.js

Time to get your hands dirty. These exercises bring together everything from this module: you'll hash data, generate keys, sign transactions, and build a Merkle tree — all in a few lines of Node.js.