0

Since P2PKH and P2SH addresses use Base58Check_encoding, the 4 byte checksum appended in binary contains some redundancy. Strictly mathematically speaking, those 4 bytes correspond to ca. floor(log(2^32)/log(58)+1) = 6 base58 "digits" (but 6 base58-digits encode 36 bits, i.e. probably only 5 instead of 6 can be omitted). But is this sound? In a 2^n base this would be trivial, but base 58 basically influences all bytes... Is there a recovery algorithm?

1 Answer 1

2

The checksum of Base58Check encoding is simply a truncated hash of the rest of the bytes. This means there is no recovery algorithm other than just brute-forcing until the hash matches.

That is one of the big advantages of the Bech32 address format proposed in BIP-173. It uses an algebraic BCH code which can actually correct errors rather than just detect them, and has better error detection/correction properties than Base58Check.

In both cases, however, it is strongly discouraged for code to perform any address recovery itself. You should report to the user that errors exist, and let the user fix them. Otherwise, you risk loss of funds.

6
  • 1
    Hmm the checksum is completely redundant so if you get an address with the last 4 bytes missing you could just recalculate the checksum no? You don’t have to brute force anything
    – Mike D
    Feb 2, 2022 at 1:09
  • 1
    If the checksum is the only thing missing, yes. But then you have no guarantee that the rest of the address is valid. If the checksum is missing that is quite concerning. So you should certainly not just add a checksum and use it.
    – meshcollider
    Feb 2, 2022 at 2:18
  • Note that an address without its checksum is the same as just sharing the public key hash directly.
    – meshcollider
    Feb 2, 2022 at 2:20
  • No worries, my question is basically "how vain can a vanity address get", I hope I didn't XY-problem this too much 😅 But as @Mike stated, my question is mainly about omitting the checksum. In a power-of-two base this would be trivial since the checksum would then be exactly the last few bytes, but in base58 there's a mixture with higher order bytes which seems to render this a bit more complicated (though this might just be my lack of sleep...) Feb 2, 2022 at 8:12
  • @TobiasKienzler you can omit up to log58(2^32) = 5.46 digits in base 58 and not lose any information as you said so basically up to 5 digits
    – Mike D
    Feb 2, 2022 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.