4

For example, let’s say I pick a random secret and hash it. Now, in the hypothetical hash-based scheme, my hash effectively replaces my public-key hash, and my random secret effectively replaces my private key. As far as I can tell, the only additional benefit of ECDSA is authentication of some identity. Is identity authentication really something Bitcoin needs to care about?

9

You must reveal the secret in order to spend the output, else there is no way other users could verify that your hash is indeed the correct one. Once you reveal that secret, anybody could attempt to create a competing transaction which spends to a different output - miners in particular would be able to confirm this transaction into a block and ignore your own.

The purpose of using ECDSA is so that a transaction which spends some output is signed by the private key corresponding to a public key, but without ever needing to reveal the private key. Nobody can attempt to create a competing transaction to spend this because they require the private key to do so. You cannot create a digital signature with only knowledge of the public key, but you can verify that the signature is correct using only the transaction and the public key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.