Exploiting the use of signature?

Question

I've just learned signatures and why they're used in blockchain.

As I understand there is a key pair that consist of one public key and one private key:

• Private keys are used to sign a message(transactions), so you can prove that the one who made that transaction is really you.

• Public keys indicate your accounts and also are used to verify the signature that has been issued.

So lets say there are two functions:

sign(message, privateKey) = signature
verify(message, publicKey, signature) = True/False

What I don't understand in this context is, if everyone can access the signature, public key and the message(transcations), can't someone who don't have the private key use the same signature, message and publicKey to make same request as many times as he wants.

Let me give an example so the question can be understood better.

Transaction Block

My question is, can't I use this same signature to send $15 as many times as I want from 04d4... to 0451...? If yes, then yeah I can't create a different transaction since I don't know the private key however I can still exploit this flaw and empty someone else's account.

By the way, I'm not planning to do such a thing, I'm just a cyber security student who is interested in security of blockchain technologies. :)

Answer 1

Public keys indicate your accounts

The Bitcoin network doesn't have accounts. The Bitcoin network keeps track of unspent coins. Every transaction consumes unspent coins as inputs, spending them, and creates new, different, unspent output coins. This can all be tracked in the list of transactions known as the Bitcoin blockchain - every full node maintains their own copy.

The Bitcoin-core software used to have a way of internally grouping by accounts but that feature was removed (and replaced by labels). These account identifiers were never part of the Bitcoin network.

Some businesses offer accounts but these accounts are outside the Bitcoin network and rely on the kind of trusted third parties that Bitcoin was designed to eliminate any need for.

---

if everyone can access the signature, public key and the message(transcations), can't someone who don't have the private key use the same signature, message and publicKey to make same request as many times as he wants.

Yes, but in the Bitcoin network, a transaction can only be added to the blockchain once. The same signed data implies spending the same unspent transaction outputs (UTXOs) and they can't be spent twice (every Bitcoin node checks this).

can't I use this same signature to send $15 as many times as I want from 04d4... to 0451...?

No, you cant spend a coin (UTXO) twice. All other Bitcoin nodes keep track of which TXOs are unspent.

---

The data in your question is a kind of simplified/synthesized version of what is really in a transaction in the Bitcoin network. You may find the following links help get a better understanding of how things work

• In what format does a block store the transaction data?

Note that the transaction data has: No addresses. No accounts. No dollar amounts. No link between specific inputs (coins spent) and specific outputs (recipients). No encryption.