From Bolt-11:

A reader
if a valid `n` field is provided:
MUST use the `n` field to validate the signature instead 
  of performing signature recovery.

Is this merely a performance optimization? Is there a situation where the declared public key field differs from the public key that would have been recovered from the signature?

1 Answer 1


Recovery of a public key from an ECDSA signature is not unique. This is because the r value in a signature is only the x-coordinate of a point, so there are actually two points R and -R that have the same x-coordinate, and both will give a different public key. Actually, for completeness, you can even end up with four possible public keys - but this happens with negligible probability.

In bolt-11, a recovery ID which takes values 0, 1, 2, or 3 is used to specify which of these four public keys should be used. But indeed, it is more efficient to simply use the given public key n. I don't think there are other practical benefits other than efficiency and perhaps robustness in case something goes wrong during recovery. n should always be one of the keys recovered, otherwise signature validation will fail.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.