Interactive guide

A No-Nonsense Guide to Elliptic Curve Cryptography

Understand elliptic curves, digital signatures, and how they apply to Solana.

6 chapters5 experiments11 quick checks

Chapter I · modular arithmetic

Modular arithmetic and finite fields

Let's start with arithmetic inside a fixed range.

Time: 10 minutes
Objective: compute modulo p
Solana: Ed25519
Foundation: finite fields
01 / Modular arithmeticValues wrap at the modulus

Modular arithmetic wraps values

Imagine that you are standing in front of seven lockers arranged in a circle and labelled 0 through 6. If you move forward from locker 6, you return to locker 0. When a result reaches 7, we subtract 7 until it fits.

5 + 4 = 9 → 2 Start at 5, walk four lockers: 6, 0, 1, 2.
Modulo n arithmetic keeps the remainder after division by n.

We say that 9 and 2 are congruent modulo 7:

9 ≡ 2 (mod 7)The symbol ≡ means both integers represent the same field element.
02 / Interactive exampleCalculate a remainder

Calculate with modular arithmetic

Use the controls and watch each answer return to one allowed value. Try a negative number too.

Try 3 × 5 mod 7, then -1 + 0 mod 7. The second example shows how subtraction wraps modulo 7.

03 / Finite fieldsWhy the modulus is prime

Why ECC uses prime fields

We also need multiplication and division. With a prime modulus, every nonzero value has a multiplicative inverse.

3 × 5 ≡ 1 (mod 7)So 5 is the multiplicative inverse of 3 modulo 7. Division by 3 means multiplication by 5.

The values 0 through 6 form the finite field F7. Add, subtract, multiply, or divide by a nonzero value and the result stays in the field.

That promise fails for many composite moduli. Modulo 8, no value multiplied by 2 produces 1. The value 2 has no multiplicative inverse, so division by 2 breaks.

Quick check 1

In modulo 7 arithmetic, what is 5 + 4?

Quick check 2

Which value is congruent to 16 modulo 7?

05 / ReviewQuestions and solutions

Check your understanding

Try to answer each question before you open the solutions.

  1. What does modulo 7 do to an integer?
  2. Why is 9 congruent to 2 modulo 7?
  3. What extra capability does a finite field give us beyond clock arithmetic?
  4. Where do finite fields appear in Solana?
Show numbered solutions

  1. Modulo 7 maps any integer to one of 0 through 6 by keeping the remainder. For example, 23 becomes 2 because 23 = 3·7 + 2.

  2. Both leave remainder 2 when divided by 7. Their difference is also a multiple of 7, so 9 ≡ 2 (mod 7).

  3. A finite field supports multiplication and division by every nonzero element. Division uses a modular inverse, so 3 ÷ 2 modulo 7 means 3 · 4 because 2 · 4 ≡ 1.

  4. Ed25519 uses the field with modulus 2255 − 19 for curve coordinates. This modulus is separate from the subgroup order that bounds private scalars.

Primary reading

Chapter II · elliptic-curve points

Elliptic-curve points and addition

We can build an elliptic-curve public key by repeatedly adding points on a finite-field curve.

Time: 12 minutes
Objective: compute 2G
Solana: public keys
Requires: finite fields
01 / Curve pointsValid coordinates in a finite field

Finite-field curves contain discrete points

If you draw an elliptic curve over real numbers, you see a smooth line. Over a finite field, you get a finite set of coordinate pairs that satisfy the same equation.

y² ≡ x³ + 2x + 2 (mod 17)Our complete toy curve. Both coordinates must be values from 0 through 16.

The coordinates are field elements, not ordinary whole numbers. We display them as integers from 0 through 16 because those are convenient representatives of the elements modulo 17.

Let's test G = (5, 1). It is on the curve because both sides of the equation reduce to 1 modulo 17.

Left side: 1² ≡ 1 (mod 17)

Right side: 5³ + 2·5 + 2 = 137

Reduce: 137 ≡ 1 (mod 17)

A coordinate pair either satisfies the curve equation or it does not. This is the basis of Solana's on-curve and off-curve distinction.

02 / Point additionThe curve's group operation

How elliptic-curve point addition works

When we write P + Q, we do not mean (x₁ + x₂, y₁ + y₂). We apply the curve's point-addition rule instead.

The valid points and a special identity point 𝒪 form a group:

ClosureAdd valid points and the result is another valid point or 𝒪.
IdentityP + 𝒪 = P. The special point changes nothing.
Inverse(x,y) + (x,−y) = 𝒪, with the negation computed modulo p.
Associativity(P + Q) + R = P + (Q + R).
Closure means that adding valid points produces another valid point or 𝒪.
03 / Point doublingCalculate 2G

Calculate 2G step by step

To compute G + G, first calculate a slope λ. Every operation wraps modulo 17, including division. Dividing by 2 means multiplying by the modular inverse of 2, which is 9.

λ = (3x² + a) / 2y

λ = (3·5² + 2) / (2·1) = 77 / 2

λ ≡ 9 · 9 ≡ 13 (mod 17)

x₃ = λ² − 2x ≡ 13² − 10 ≡ 6

y₃ = λ(x − x₃) − y ≡ 13(5 − 6) − 1 ≡ 3

2G = G + G = (6, 3)The result also satisfies the curve equation. Closure worked.

Quick check 1

On our toy curve, which point equals 2G?

04 / Scalar multiplicationRepeated point addition

Scalar multiplication as repeated addition

Move the scalar k and watch the highlighted point change. That point is kG, which means we added G to itself k times. It does not mean multiplying the coordinates of G by k.

    At 19G, you reach 𝒪, the identity point. Another step would return to G. Our toy subgroup therefore has order 19.

    Computing Q=kG from k is fast. Recovering k from G and Q is the elliptic-curve discrete logarithm problem.
    05 / KeypairsPrivate scalar to public point

    Private scalars and public points

    You can model an elliptic-curve private key as a secret scalar k. Its public key is the point Q = kG. Ed25519 adds hashing, clamping, encoding, and subgroup rules, but Q=kG is the core relationship.

    secret scalar k → scalar multiplication → public point QFast forward. Believed hard to reverse on a classical computer when parameters and implementation are sound.

    Solana transaction signers use Ed25519 keys. PDAs are off-curve and have no matching secret scalar. Programs authorize PDAs through runtime-checked derivation.

    Quick check 2

    Which operation captures the private-to-public direction?

    06 / ReviewQuestions and solutions

    Check your understanding

    Try to answer each question before you open the solutions.

    1. Why does an elliptic curve over a finite field look like dots?
    2. Why is point addition not coordinate-wise addition?
    3. What does kG mean?
    4. Why can a public key be shared while its private scalar must stay secret?
    5. Why does off-curve imply that a Solana PDA has no Ed25519 private key?
    Show numbered solutions

    1. The field has finitely many x-values and y-values. Testing each pair against the curve equation leaves a finite set of points rather than a continuous line.

    2. Point addition draws a line through two points, finds the third curve intersection, and reflects it. The algebra reproduces this construction over a finite field. Coordinate-wise addition does not generally stay on the curve.

    3. kG means adding G to itself k times with the curve's addition law. The scalar k is a number; G and kG are points. This is not ordinary coordinate multiplication.

    4. Computing Q=kG from k is efficient. Recovering k from G and Q is infeasible with current classical methods and production parameters. Anyone who learns k can sign as its owner.

    5. A PDA does not decode as an Ed25519 curve point. No scalar k can produce it as Q=kG, so it has no matching private key. The runtime checks PDA seeds instead.

    Primary reading

    Chapter III · point doubling

    Deriving the point-doubling formulas

    We can derive the point-doubling formulas directly from a line intersecting the curve.

    Time: 18 minutes
    Objective: derive x₃ and y₃
    Method: geometry and algebra
    Requires: point addition
    01 / Point additionLines determine the third point

    Why point addition uses a line

    We need point addition to stay on the curve, but coordinate-wise addition does not. A line and a cubic curve meet at three points when multiplicity is counted. If we know two intersections, the line determines the third.

    For a short Weierstrass curve, define three collinear curve points to sum to the identity 𝒪:

    P + Q + R = 𝒪

    The curve is symmetric across the horizontal axis, so reflecting R=(x,y) gives its inverse −R=(x,−y). Therefore:

    P + Q = −RJoin P and Q, find the third intersection R, then reflect R.
    02 / Point doublingThe tangent replaces the secant

    Point doubling uses the tangent line

    For distinct points P and Q, exactly one ordinary line passes through both. Its slope is:

    λ = (y₂ − y₁) / (x₂ − x₁)

    For P+P, both points occupy the same location. Infinitely many lines pass through one point, so an arbitrary line would produce an arbitrary third intersection and would not define P+P consistently. The tangent supplies the direction. You can think of it as the line through P and Q as Q moves toward P.

    The tangent touches the curve twice at P, so P is a double root and one intersection remains.
    Point P
    Slope λ
    Third point R
    Reflected 2P

    The diagram uses the real curve y²=x³−2x+2 so the tangent is visible. Cryptographic finite-field curves use the same algebra without a continuous picture.

    03 / Tangent slopeDerive λ

    Derive the tangent slope

    Let's start with the general short Weierstrass equation over real numbers:

    y² = x³ + ax + b

    Differentiate both sides with respect to x:

    d(y²)/dx = d(x³ + ax + b)/dx

    2y · dy/dx = 3x² + a

    dy/dx = (3x² + a) / 2y

    The derivative dy/dx is the tangent slope. At P=(x₁,y₁):

    λ = (3x₁² + a) / (2y₁)

    Distinct points use a secant slope. Doubling uses the tangent slope.

    Quick check 1

    Why does point addition calculate a slope?

    04 / Output x-coordinateUse the cubic roots

    Derive the output x-coordinate

    Write the line as y=λx+ν and substitute it into the curve:

    (λx + ν)² = x³ + ax + b

    x³ − λ²x² + (a − 2λν)x + (b − ν²) = 0

    Its roots are the three intersection x-coordinates. Vieta's rule says the roots of x³+cx²+… add to −c. Here:

    x₁ + x₂ + xR = λ²
    xR = λ² − x₁ − x₂

    For doubling, the tangent touches at P twice. That means x₁=x₂, counted as a double root:

    xR = λ² − 2x₁

    Reflection changes only the y-coordinate, so the final sum keeps this x-coordinate:

    x₃ = λ² − 2x₁
    05 / Output y-coordinateEvaluate and reflect

    Derive the output y-coordinate

    Point-slope form gives the y-coordinate of the third intersection R:

    yR = y₁ + λ(xR − x₁)

    But the group sum is −R, not R. Reflect across the horizontal axis:

    y₃ = −yR

    y₃ = −[y₁ + λ(x₃ − x₁)]

    y₃ = λ(x₁ − x₃) − y₁

    The x-formula finds the third intersection. The y-formula reflects it.

    Reflection is part of the group-law definition. It gives each point the inverse (x,−y) and makes the identity and inverse rules work in their standard form.

    06 / Finite-field calculationApply the formulas modulo 17

    Apply point doubling modulo 17

    A finite-field curve has no visual tangent, but the algebra still works over fields of characteristic other than 2 or 3.

    Now return to our toy curve and G=(5,1):

    y² ≡ x³ + 2x + 2 (mod 17)

    λ = (3·5² + 2) / (2·1) = 77 / 2

    77 ≡ 9 and 2⁻¹ ≡ 9, so λ ≡ 9·9 ≡ 13

    x₃ ≡ 13² − 2·5 ≡ 159 ≡ 6

    y₃ ≡ 13(5 − 6) − 1 ≡ −14 ≡ 3

    2G = (6,3)

    The formula is unchanged. Division becomes multiplication by a modular inverse, and every result wraps modulo 17.

    If 2y₁=0, the tangent is vertical and division has no inverse. In that special case, doubling returns the identity point 𝒪.

    07 / ReviewQuestions and solutions

    Check your understanding

    Try to reconstruct each step before you open the solutions.

    1. Why does a line through two curve points produce a third intersection?
    2. Why does doubling use the tangent rather than an arbitrary line through P?
    3. How does differentiating the curve produce λ?
    4. How does the sum of three cubic roots produce x₃?
    5. Why do we reflect R to obtain the final y₃?
    Show numbered solutions

    1. Substituting y=λx+ν into the curve gives a cubic in x. A cubic has three roots with multiplicity. Two known intersections determine the third.

    2. As Q approaches P, their secant becomes the tangent at P. The tangent counts P as a repeated intersection and leaves one further intersection. An arbitrary line would select an arbitrary third point, so it could not define one consistent value for P+P.

    3. Differentiation gives 2y·dy/dx=3x²+a, then λ=(3x²+a)/(2y). In a finite field, division means multiplying by the inverse of 2y.

    4. The cubic's roots add to λ², so x₃=λ²−x₁−x₂. For doubling, x₁=x₂, giving x₃=λ²−2x₁.

    5. The inverse rule sends (x,y) to (x,−y). Reflecting the third intersection produces the sum and gives y₃=λ(x₁−x₃)−y₁. Without this reflection, the identity and inverse rules would not take their standard form.

    Primary reading

    • MIT 18.783, lecture 2 derives the group law for Weierstrass curves and explains why three points on a line sum to the identity.
    • SEC 1, section 2.2.1 specifies the finite-field point-addition and doubling operations used by short Weierstrass curves.

    Chapter IV · key derivation

    Scalar multiplication and keypairs

    If you know the secret scalar, computing the public point is fast. Reversing the operation is hard.

    Time: 12 minutes
    Objective: derive a toy public key
    Solana: signer keypairs
    Hard problem: discrete log
    01 / Public-key derivationPrivate scalar to public point

    Derive a public key from a private scalar

    We choose a generator point G that everyone knows and a scalar k that only the owner knows. Repeated point addition produces the public point:

    Q = kGPrivate input: k. Public parameters: the curve and G. Public output: Q.

    This is scalar multiplication: repeated use of the curve's point-addition rule.

    Keep secretscalar k
    scalar multiplication
    Safe to sharepoint Q

    Ed25519 hashes secret bytes and derives a clamped scalar before computing the public point. Q=kG captures the group operation, not the full key format.

    02 / Double-and-addEfficient scalar multiplication

    Compute scalar multiplication with double-and-add

    Suppose you want to compute 13G. We avoid thirteen separate additions by writing 13 in binary:

    13 = 8 + 4 + 1 = 1101₂

    Build 2G, 4G, and 8G by doubling, then combine the powers selected by the binary digits:

    13G = 8G + 4G + GThis family of methods is called double-and-add. Work grows with the number of bits in k, not with the value of k.

    Quick check 1

    Which decomposition computes 13G?

    03 / Small-group exampleDerive and recover a toy key

    Test scalar multiplication in a small group

    This toy subgroup has 18 possible nonzero scalars. Choose one and watch the workbench derive its public point.

    Toy private key
    compute kG
    Toy public key

    Reverse-search attacker

    The attacker knows G and Q. It tries every possible scalar until a candidate produces the same public point.

      The attack succeeds because there are only 18 candidates. This group is educational, not secure.
      04 / Key recoveryThe discrete logarithm problem

      The elliptic-curve discrete logarithm problem

      If you know k and G, double-and-add computes Q efficiently. If you know only G and Q, recovering k is the elliptic-curve discrete logarithm problem.

      No efficient classical algorithm is known for a secure production group. A naive search through a subgroup of order N takes up to O(N) point operations. Generic attacks such as baby-step giant-step and Pollard rho reduce that to about O(√N). For Ed25519, the generic attack scale is still about 2126 curve operations. Real attackers do not need to try every scalar one by one.

      k + G → Q is the wrong model
      k acting on G → Q is the right modelThe arrow is easy because k is known. Reversing it means solving the discrete logarithm.

      This is a computational hardness assumption, not a claim that reversal is mathematically impossible. A sufficiently capable quantum computer running Shor's algorithm would break this assumption.

      Quick check 2

      Given the curve, G, and Q=kG, what does the attacker seek?

      05 / SolanaOn-curve keys and off-curve PDAs

      Solana public keys and PDAs

      When you use a normal Solana signer, its Ed25519 public key decodes to an on-curve point. Its secret key produces signatures that the runtime verifies.

      A PDA is derived from seeds and a program ID and must be off-curve. No scalar k can produce it as kG. The runtime authorizes the PDA by checking its derivation instead.

      Signer addressOn-curve public point. Authorization comes from a valid Ed25519 signature.
      Program addressOff-curve derived bytes. Authorization comes from the deriving program and matching seeds.
      06 / ReviewQuestions and solutions

      Check your understanding

      Try to answer each question before you open the solutions.

      1. What information is public in the equation Q=kG?
      2. Why can a computer calculate a large scalar multiple without adding G one step at a time?
      3. What is the elliptic-curve discrete logarithm problem?
      4. Why did the reverse attack work against the toy group?
      5. What authorization rule replaces private-key signing for a Solana PDA?
      Show numbered solutions

      1. The curve, subgroup order, generator G, and point Q are public. Only k is secret. Production parameters make recovering it impractical.

      2. Double-and-add writes k in binary, builds doubled points, and adds only the powers selected by 1-bits. It takes roughly O(log k) point operations.

      3. The elliptic-curve discrete logarithm problem asks for k given G and Q=kG. A sequential search takes O(N) work. Baby-step giant-step and Pollard rho reduce generic attacks to about O(√N). For a group near 2²⁵², that is still about 2¹²⁶ curve operations.

      4. The toy subgroup has only 18 nonzero scalar candidates, so a sequential search finds the key quickly.

      5. During invoke_signed, the runtime combines the seeds, bump, and calling program ID to re-derive the PDA. A match grants signer privilege for the CPI. No Ed25519 signature is involved.

      Primary reading

      Chapter V · digital signatures

      Creating and verifying signatures

      You can use a signature to prove that a private key authorized one exact message without revealing the key.

      Time: 12 minutes
      Objective: explain signing and verification
      Solana: transaction signatures
      Model: simplified signature equation
      01 / Public-key relationshipUse Q = kG

      The public-key relationship used by signatures

      You already know the key relationship:

      Q = kGKeep k private. Publish Q and G.

      Anyone can see Q, but production parameters make recovering k infeasible. Signatures use this same relationship.

      Signer knowsprivate scalar k
      creates evidence
      Verifier knowspublic point Q
      A signature proves that someone who knows the secret behind Q approved one exact message. It does not reveal the secret and it does not encrypt the message.
      02 / Signature creationCommitment, challenge, and response

      Create a signature for one message

      Let's build a simplified Schnorr-shaped signature to see the core EdDSA relationship:

      The signer creates a one-message secret r and its public point R = rG.

      A hash binds R, Q, and the message m into a challenge h.

      The signer combines both secrets into s = r + hk.

      The published signature is (R, s). Neither k nor r is published.

      Lowercase r is the one-message secret nonce scalar. Uppercase R=rG is its public curve point. Although h and s are public, they bind the hidden scalars without exposing them. Reusing the same r for two messages creates two equations that can reveal k.

      To verify the signature, we recompute h and check:

      sG ?= R + hQ

      The equation works because:

      sG = (r + hk)G

      sG = rG + h(kG)

      sG = R + hQ

      The verifier replaces the secret-derived terms rG and kG with their public points R and Q. Matching sides show that the signature has the right hidden relationship.

      Quick check 1

      What gives the signer its unique ability?

      03 / Signature verificationDetect a changed message

      Verify that the message has not changed

      Sign the default message, then change send 5 SOL to send 6 SOL. You will see the hash change and the verification equation fail. The stored signature does not change; the same signature simply stops verifying against the modified message.

      Signer keeps

      The private scalar stays inside the signer.

      k is hidden

      Everyone knows

      The public point identifies the signer.

      Signer publishes

      The signature contains R and s, not k.

      sGmust equalR + hQ

      No signature to verify yet.

      Show the toy arithmetic

      This uses an insecure 19-element group and a toy hash to expose the relationship.

      One-message secret
      Message challenge
      Signer response

      Quick check 2

      What should changing the signed message do?

      04 / SolanaSign serialized transaction bytes

      Solana transaction signatures

      When your wallet signs a Solana transaction, it signs the serialized message with Ed25519. If you change an instruction, account, amount, or recent blockhash, the bytes change and the signature becomes invalid.

      A valid signature authorizes those exact bytes. It does not prove that a wallet's human-readable description matched the signer's intent.

      A PDA has no Ed25519 private key. During invoke_signed, the runtime checks the program ID and seeds and grants signer privilege for that CPI.

      Transaction signerPrivate key signs exact message bytes. Public key verifies them.
      Program addressNo private key exists. Runtime seed derivation grants CPI authority.

      Ed25519 has exact hashing, scalar derivation, encoding, and cofactor rules. Use audited libraries. The equation here explains the relationship; it is not production implementation code.

      05 / ReviewQuestions and solutions

      Check your understanding

      Try to answer each question before you open the solutions.

      1. Why can Q=kG be public while k remains private?
      2. What does a signature prove, and what does it not hide?
      3. How can the verifier check sG=R+hQ without knowing k?
      4. Why does changing the message invalidate the signature?
      5. How does Solana PDA authorization differ from an Ed25519 signature?
      Show numbered solutions

      1. Double-and-add computes Q=kG efficiently. Recovering k from G and Q requires solving the discrete logarithm problem, which is infeasible at production scale.

      2. A valid signature proves that the private-key holder authorized the exact message. It detects changes but does not encrypt the message or prove that a human-readable interpretation matched the signer's intent.

      3. Lowercase r is the hidden nonce scalar, while uppercase R=rG is its public point. The signer publishes R and s=r+hk. Multiplying by G gives sG=rG+h(kG)=R+hQ, so the verifier can compute both sides from public values. Reusing r for two challenges creates two equations that can reveal k.

      4. The challenge h=H(R,Q,m) binds the equation to m. A changed message produces a different challenge, so the unchanged stored signature fails against the modified message.

      5. A wallet produces an Ed25519 signature. A PDA has no private key. During a CPI, invoke_signed re-derives the PDA from its seeds, bump, and program ID and grants signer privilege when the address matches.

      Primary reading

      Chapter VI · Solana authorization

      Solana wallet and PDA authorization

      A wallet and a PDA can both receive signer privilege. Let's trace how each one proves its authority.

      Time: 10 minutes
      Objective: trace is_signer
      Compare: wallet and PDA
      Focus: runtime authorization
      01 / Signer privilegeWhat a Solana program receives

      What signer privilege means

      When your Solana program receives an account, it can check whether that account has signer privilege for the current instruction. Anchor's Signer constraint requires it.

      account.is_signer = trueThe destination looks the same. The proof that produced it may differ.

      A keypair gets this privilege from an Ed25519 signature. A PDA gets it from runtime derivation during invoke_signed.

      is_signer records authority for this instruction. It does not imply that the address has a private key.
      02 / Wallet authorizationEd25519 transaction signature

      Wallet signatures

      When a client builds a transaction, the message contains account keys, a recent blockhash, and compiled instructions. Each required signer signs those serialized bytes.

      Client builds the exact transaction message bytes.

      Wallet signs those bytes with its Ed25519 private key.

      Transaction carries the message and its signatures.

      Runtime verifies each signature against the matching public key.

      Program receives the verified account with signer privilege.

      The runtime verifies transaction signatures before program execution and supplies the resulting account privileges.

      A program may explicitly verify other signed data for a special protocol, but ordinary transaction-signer checks do not happen inside each program.

      A signature authorizes the exact bytes the wallet signed, not a vague description such as "send this payment." Change any signed message byte, such as an amount, account, instruction, or blockhash, and the existing signature no longer verifies.

      Quick check 1

      Who verifies a normal transaction signature before your program runs?

      03 / PDA authorizationRuntime-checked derivation

      PDA authorization with invoke_signed

      A PDA is off-curve, so it has no private scalar and cannot produce an Ed25519 signature. When your program needs the PDA to authorize a CPI, it uses invoke_signed instead:

      Program builds a child instruction for a CPI.

      Program supplies the PDA's seeds and bump to `invoke_signed`.

      Runtime combines those values with the calling program's ID.

      Runtime re-derives the PDA and checks that the address matches.

      Callee receives that PDA with signer privilege for the CPI.

      No signature is forged. The runtime substitutes a derivation proof for a cryptographic signature within the CPI boundary.

      Quick check 2

      What grants a PDA signer privilege during a CPI?

      04 / Account propertiesAddress, owner, and signer

      Address, owner, and signer are different properties

      QuestionWallet signerPDA signer
      Has private key?YesNo
      ProofEd25519 signatureMatching derivation
      Checked duringTransaction processing`invoke_signed` CPI
      AuthorizesExact transaction messageThat child instruction

      An account's owner names the program allowed to modify its data. Signer privilege identifies who approved the current instruction. Neither implies the other. A program-owned account is not automatically a signer, and a signer does not need to own the accounts it authorizes.

      05 / ReviewQuestions and solutions

      Check your understanding

      Try to answer each question before you open the solutions.

      1. What exact content does a wallet's Ed25519 signature authorize?
      2. Who checks that signature before program execution?
      3. Why can a PDA never provide the same kind of signature?
      4. What does `invoke_signed` prove to the runtime?
      5. Why is account ownership different from signer privilege?
      Show numbered solutions

      1. The wallet signs the exact serialized message containing the header, account addresses, recent blockhash, and instructions. Changing any of those bytes invalidates the signature.

      2. The runtime verifies ordinary transaction signatures before executing instructions. Programs receive account metadata with signer privileges already set. A program may separately verify signed data when a special protocol requires it.

      3. A PDA is off the Ed25519 curve. It is not a point of the form kG and has no matching private scalar.

      4. invoke_signed proves that the seeds, bump, and calling program ID derive the PDA used by the child instruction. A match grants signer privilege for the CPI. No cryptographic signature is created.

      5. Address identifies the account. Ownership identifies the program allowed to modify its data. Signer privilege identifies who approved the instruction. An owned account is not automatically a signer, and a signer may authorize accounts it does not own.

      Primary reading