Why don't smart contracts have private keys?

Summary

In this video, Keir Finlow-Bates explains why smart contracts on the Ethereum blockchain can't digitally sign transactions. He compares externally owned accounts and smart contract addresses, highlighting key differences in how they're derived and authorized. While externally owned accounts use private keys for signing, smart contracts are authorized to execute based on their code alone, residing natively on the blockchain. The video also touches on the complexity of Ethereum addresses and the potential for multiple private keys to correspond to a single address. Keir encourages viewers to explore the mechanics of blockchain further for deeper understanding.

Takeaways

• 😀 Smart contracts and externally owned accounts (EOAs) on Ethereum look similar but differ in their function and creation methods.
• 😀 Both Ethereum contract addresses and EOAs start with '0x' followed by 40 characters in hexadecimal format, making them appear identical on the surface.
• 😀 Ethereum addresses are derived from a 256-bit random private key using the ECDSA signing algorithm, followed by a Keccak hash to generate the address.
• 😀 For externally owned accounts, digital signatures verify transactions by using the public key derived from the private key to match the Ethereum address.
• 😀 Smart contract addresses, on the other hand, are deterministically created when a contract is deployed, using the deployer's address and a nonce.
• 😀 Smart contracts don't have private keys because they operate within the Ethereum blockchain itself, relying on code for authorization rather than digital signatures.
• 😀 The absence of a private key in smart contracts ensures they can operate transparently without the risk of exposing sensitive data on the blockchain.
• 😀 Since smart contracts are embedded in the blockchain, they are authorized to perform actions based on the rules in their code, not through traditional private key-based signing.
• 😀 Ethereum addresses can theoretically have multiple private keys mapping to the same address, due to the way the Keccak hash works, but it’s practically infeasible to find multiple valid private keys for a single address.
• 😀 Despite the existence of many possible private keys for an Ethereum address, the vast number of possible addresses makes it computationally impractical to find one of these keys.
• 😀 The Ethereum addressing system and digital signing mechanisms are fundamental to understanding how blockchain technology functions, especially in terms of security and transaction validation.

Q & A

What is the main reason smart contracts cannot digitally sign things on Ethereum?

Smart contracts cannot digitally sign things because they don't have a private key. While externally owned accounts (EOAs) have private keys that enable them to sign transactions, smart contracts are authorized by their code on the blockchain and don't require digital signatures.

How do Ethereum addresses for externally owned accounts (EOAs) and smart contracts appear to be similar?

Both Ethereum addresses for EOAs and smart contracts start with '0x' and consist of 40 hexadecimal characters. They look identical at first glance, making it difficult to distinguish between the two without further investigation.

What is the process for generating an Ethereum address for an externally owned account?

An Ethereum address for an EOA is generated by creating a 256-bit random private key, which is then used to produce a public key. The public key is hashed using the Keccak-256 function, and the last 160 bits of the hash are used to form the 40-character Ethereum address.

How are Ethereum addresses for smart contracts generated?

The address for a smart contract is generated deterministically by combining the deployer's address with a nonce (a unique number for each contract deployment), then hashing this combination and taking the last 40 characters of the resulting hash.

Why can't smart contracts have a private key?

Smart contracts don't have a private key because their addresses are generated in a deterministic manner. If they did have a private key, it would be exposed on the blockchain, compromising the security and privacy of the contract.

How does an Ethereum address's private key relate to its public address?

The private key corresponds to the public key through the ECDSA (Elliptic Curve Digital Signature Algorithm) signing process. The public key is hashed using the Keccak-256 function, and the resulting 160 bits form the Ethereum address.

What is the difference between the way an externally owned account and a smart contract are authorized to perform actions on the blockchain?

Externally owned accounts are authorized based on the private key and digital signatures, while smart contracts are authorized through the code embedded in their contract, which is executed automatically when certain conditions are met on the blockchain.

Why does the Ethereum blockchain model avoid giving smart contracts their own private key?

The Ethereum blockchain avoids giving smart contracts their own private keys because the blockchain is transparent. If a smart contract had a private key, it would be visible to everyone on the blockchain, which would undermine the security and integrity of the contract.

How many possible Ethereum addresses can exist, and how does this relate to the private keys that generate them?

There are 2^160 possible Ethereum addresses. However, for every Ethereum address, there are approximately 2^96 different private keys that can generate that address, due to the way the Keccak-256 hashing process works.

What does the analogy of a 'visa' and 'citizenship' explain about externally owned accounts and smart contracts on Ethereum?

The analogy explains that an externally owned account is like having a visa to access and interact with the Ethereum blockchain, while a smart contract is like a native citizen of the blockchain, automatically authorized to perform actions based on the rules coded into it.