3

I just got into learning Bitcoin programming through Jimmy Song's Programming Bitcoin. Jimmy says that some of p2pkh's advantages over p2pk include:

  1. a smaller ScriptPubKey

  2. keeping one's public key private

I completely agree with the first advantage but I'm having a little trouble with the second advantage.

Jimmy explains that, if ECDSA was every broken, one could steal bitcoin from another entity because they could find their public key in the ScriptPubKey (if they were using p2pk) and create a valid signature.

My question is: If all we are doing is moving the public key from the ScriptPubKey to the ScriptSig, what security does that grant us if the ScriptSig is also accessible? If I was to spend a UTXO that was made to my public key hash, my public key would be public. Couldn't a malicious user who had broken ECDSA keep looking for a UTXO ScriptPubKey with my hash in it, copy my public key from the previous transaction, generate a signature, and steal my bitcoin? It seems to me that my public key is private as long as I don't spend anything.

Of course, I know I'm missing something :) Any help is appreciated.

Improve this question
1
  • You are right, the public key is only revealed after you spend from the address, before that only the hash of the public key is visible. This is one of the reasons why you should not reuse the same address, just generate a new address every time you want to receive coins and send your change to a new address every time.
    – Mike D
    Commented Jan 18, 2021 at 22:49

1 Answer 1

Reset to default
4

Bitcoin addresses, and the public key by extension, should ideally only ever be used once. So your time of exposure of the public key in P2PKH is the time between when the spend is made and when it confirms. For P2PK the public key is always known to everybody. There's a considerable difference between the two.

Improve this answer
5
  • Gotcha, so the recipient of any transaction has to convey their public key to the payer before every transaction? Seems like a hassle if there are a lot of small transactions between them...
    – yoyobigmanyo
    Commented Jan 18, 2021 at 23:36
  • Their address, yes, not the public key.
    – Claris
    Commented Jan 18, 2021 at 23:42
  • 2
    I think this advantage of keeping the pubkey secret is very marginal at best, and more commonly an illusion. Pretty much anything interesting beyond simple payments (multisig, Lightning, ...) involves sharing your public keys with not entirely trusted parties. Bitcoin's security relies on ECDSA being unbreakable even when public keys are revealed; as far as I'm concerned the "pubkeys are only briefly exposed is an advantage" is cargo cult.
    – Pieter Wuille
    Commented Jan 19, 2021 at 1:37
  • 1
    I don’t disagree. It’s a nice incidental property of addresses not being reused at best, rather than something to be desired specifically.
    – Claris
    Commented Jan 19, 2021 at 1:38
  • Right; of course keeping the public key hidden for longer is never a loss, and there are potentially some cases where it may provide some small benefit. The extent to which it's talked about in some places makes it sound like a much bigger deal than it is, though.
    – Pieter Wuille
    Commented Jan 19, 2021 at 4:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.