0

We know that a P2PKH script looks as follows:

scriptPubKey: OP_DUP OP_HASH160 <PubKeyHash> OP_EQUALVERIFY OP_CHECKSIG
scriptSig: <Signature> <PubKey>

Since full nodes are maintaing UTXO sets, wouldn't it save space to omit the OP_DUP and have the user provide their public key twice instead, like so? And would that create any sort of security issues?

scriptPubKey: OP_HASH160 <PubKeyHash> OP_EQUALVERIFY OP_CHECKSIG
scriptSig: <Signature> <PubKey> <PubKey>
2

Unfortunately, that would not be secure. Imagine an output with scriptPubkey OP_HASH160 <hash(P1)> OP_EQUALVERIFY OP_CHECKSIG. Now anyone can spend such an output by generating their own key P2, and spending with scriptSig <sig with P2> <P2> <P1>.

2
  • But the attacker doesn't know P1. So that would require the attacker to compute the pubkey P1 from hash(P1). Isn't that (practically) impossible since the hash function is preimage-resistant? Aug 1 at 21:44
  • 2
    The attacker does know if they are a miner. They can look at a legitimate transaction and substitute their own key. You cannot assume that anything except the private key is private. Aug 1 at 21:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.