Key pair

Pairing matters because the two halves do opposite jobs: one creates a signature, the other lets strangers check it. The link runs one way only, so publishing the public half never endangers the secret half. Counting pairs is how you size a setup, since a 2-of-3 multisig vault is three key pairs kept in three places, any two of which can spend.

How it works

One private key yields exactly one public key, and the mapping never changes. Feed the same 32-byte secret into the same curve arithmetic on any device, in any wallet, ten years apart, and the identical public key comes out. That determinism is why a wallet can be restored from a backup at all, and why nobody needs to store public keys: they are recomputed on demand.

The pair splits the work of every spend. Your device uses the private half to produce a signature that commits to the exact transaction being signed, and thousands of nodes use the public half to confirm the signature matches both the key and that transaction. Change one output by a single satoshi and the signature stops verifying. Signature sizes differ by scheme: a Schnorr signature under BIP-340 is a flat 64 bytes, while the older DER-encoded ECDSA signatures run to 71 or 72 bytes, part of why Taproot spends are cheaper.

Hierarchical deterministic wallets turn one secret into an unlimited stock of pairs. BIP-32 derivation offers 2,147,483,648 ordinary child indexes at every level of the tree, plus the same number again of hardened ones, all reproducible from a single seed. Your wallet issues a fresh pair per payment out of that supply, which is what makes address rotation practical rather than a bookkeeping nightmare.

Where you see it

The pair becomes visible whenever a wallet has to prove something rather than simply spend. Message signing is the plainest case: you pick an address, the wallet signs a text challenge with the private half, and anyone can verify it against the public half. Exchanges use exactly this to confirm you own a withdrawal address, and it moves no coins at all.

Multisig is where counting pairs starts to matter. A 2-of-3 vault is built from three independent pairs, usually generated on three separate devices, and the redeem script names all three public halves while any two private halves are enough to spend. Losing one device costs you nothing; losing two costs you everything. That arithmetic, not the brand of hardware, is what determines how a vault fails.

Collaborative signing shows the same structure. A partially signed bitcoin transaction, defined in BIP-174, travels between devices collecting one signature per pair until the quorum is met. Each signer touches only its own private half and sees everyone else's public half, which is precisely the separation the pair is designed for.

Key pair vs extended key

A key pair is a leaf and an extended key is a branch. An extended key, written as xprv or xpub, is a key bundled with a 32-byte chain code, and that extra material is what lets it derive children. A bare key pair derives nothing: it controls whatever coins were locked to it and stops there. The distinction has a sharp practical edge. Leaking one public key exposes one address, while leaking an xpub exposes every address the branch below it will ever produce.