What are the "public" viewkeys and spendkeys?

Question

If you create a paper wallet at www.moneroaddress.org or create a wallet with simplewallet, you are provided with private view and spend keys. If you create a paper wallet at https://xmr.llcoins.net/ you also are shown public view and spend keys in addition to the private ones. What are these and what do they do?

Answer 1

Note: the letters between parantheses correspond to the letters used for the math in the CryptoNote whitepaper¹.

The public view key (A) and public spend key (B) are the counterparts of the private view key (a) and private spend key (b). The public keys are needed to generate a public address. This is done as follows. First, the private view key and private spend key are sent to the ed25519 scalarmult_base function (G) to create their counterparts, the public view key (A = aG) and public spend key (B = bG). To create the actual public address, the following steps are performed²:

1. The pair of public keys are prepended with one network byte (the number 18, 0x12, for Monero). It looks like this: (network byte) + (32-byte public spend key) + (32-byte public view key).

2. These 65 bytes are hashed with Keccak-256.

3. The first four bytes of the hash from 2. are appended to 1., creating a 69-byte Public Address.

4. As a last step, this 69-byte string is converted to Base58. However, it's not done all at once like a Bitcoin address, but rather in 8-byte blocks. This gives us eight full-sized blocks and one 5-byte block. Eight bytes converts to 11 or less Base58 characters; if a particular block converts to <11 characters, the conversion pads it with "1"s (1 is 0 in Base58). Likewise, the final 5-byte block can convert to 7 or less Base58 digits; the conversion will ensure the result is 7 digits. Due to the conditional padding, the 69-byte string will always convert to 95 Base58 characters (8 * 11 + 7).

5. This 95-character result is the (obscenely long) CryptoNote public address!

6. If you're creating an integrated address, simply append the 64-bit payment ID to step 1 and continue; everything else is the same except for the lengths (77 bytes total, 106 Base58 digits) and the prepended byte (19, 0x13).

Given that MoneroAddress automatically calculates (and provides you with) the public address, you don't have to save the public view key and public spend key.

Luigi1111 wrote a somewhat easy to understand introduction to the cryptography of CryptoNote (and thus Monero), which can be found here.

Sources:

1. https://cryptonote.org/whitepaper.pdf

2. https://xmr.llcoins.net/addresstests.html

Answer 2

The public keys are the matching part of the private keys. Public key cryptography is a system where encryption is done using a public key, while decryption is done by a private key, and signing is done with a private key, while verification is done with a public key. Public keys are trivially obtainable from a private key, but not the other way round. Contrast this with symmetric cryptography, where a single key is used, which typically generates an arbitrary (within certain limits, for security) stream of bytes of blocks, which encrypt matching lengths of plaintext.

In Monero, you have two keypairs: the view keypair, and the spend keypair. The address generator gives you the private keys for information. The public keys are encoded in your standard address, which is also given to you. As their names implies, you're supposed to publicize your public keys (in your standard address), and keep your private keys private.