Point function

BIP32 gives the operation a name, point(p), because hierarchical key derivation refers to it on almost every line. Multiply the curve's fixed generator by a 256 bit secret and the result is a coordinate pair you can publish safely; recovering the secret from that pair means solving a discrete logarithm across a 78 digit space. Your wallet runs the function once per address and never has to run it backwards.

How it works

The point function is elliptic curve multiplication with one of its two inputs fixed forever.

Bitcoin uses the curve secp256k1, defined by the equation y squared equals x cubed plus 7 over a large prime field, and standardized in the SEC 2 document rather than by NIST. The curve ships with a generator point G that every implementation hard codes, and with a group order n whose value falls just under 2 to the 256th. A private key is any integer from 1 up to n minus 1. The function adds G to itself that many times using a doubling and addition ladder, which finishes in well under a millisecond rather than in the age of the universe.

Going the other way is the whole security assumption. Given the resulting point, no published method recovers the multiplier faster than roughly the square root of the group size, putting the work at around 2 to the 128th operations. None of that changes if an address is reused, published, or held for decades.

One property makes hierarchical wallets possible. Point multiplication distributes over addition, so the point of a plus b equals the point of a added to the point of b. Add a tweak to a private key and the matching public key shifts by the point of that tweak, an amount anyone can compute without holding the key. Unhardened BIP32 derivation rests on that identity, and so does the Taproot output key, which is an internal key shifted by a commitment to a script tree.

Where you see it

The point function runs every time a wallet shows you a fresh receiving address.

It is also why an extended public key is useful on its own. Hand an xpub to an online store or to a watch-only phone and that machine can generate a new address per payment by tweaking a public key, with no private key present anywhere on it. Hardware wallets exploit the same asymmetry from the other side: the secret never leaves the chip and only the resulting point comes back over the cable.

The property has a sharp edge. Because the relationship is additive and public, an extended public key combined with one leaked unhardened child private key lets anybody recover the parent private key and with it the entire branch. That is why account level derivation is hardened, and why a leaked xpub is a privacy disaster rather than an immediate theft.

Point function vs compressed public key

The point function produces a mathematical object; a compressed public key is one way of writing that object down. A point is a pair of coordinates, each 32 bytes. The compressed form discards the y coordinate and keeps a one byte prefix recording whether it was even or odd, giving 33 bytes. The uncompressed form spells both coordinates out across 65 bytes. Taproot's x-only form keeps 32 bytes and no prefix at all. Every one of them describes the same point, and yet each encoding hashes to a different address, which is why importing an old key with the wrong compression flag shows a balance of zero while the coins sit untouched at the other address.