1

I was implementing a small application that computes the bitcoin address starting from a private key (256-bit number). I am surprised about the lack of a single trustworthy reference to this, unlike the case of the BIPs.

The book of Antonopoulos and the bitcoin wiki indicate that the public key (pubK) must go through sha256 and ripemd160 hashes before base58check encoding that results in the final bitcoin address; there are also details about the version byte. But the pubK could be serialized in at least two forms, either the full 65-bytes 0x04<xcoord><ycoord> or the compressed 33-bytes 0x02/0x03 <xcoord> representation. Both lead to different bitcoin addresses. The wiki explains step by step how to obtain an address from the compressed pubK, but the image in the page shows a diagram that uses the full pubK representation instead. The http://gobittest.appspot.com/ website, referenced in the bitcoin wiki for testing the WIF format, computes the addresses using the full pubK.

Alright, I know that the private key WIF serialization format has a byte to indicate whether the pubK addresses are computed using the the compressed or full representation (see https://en.bitcoin.it/wiki/Wallet_import_format).

Also add a 0x01 byte at the end if the private key will correspond to a compressed public key.

However,

  1. it is not mentioned anywhere what is the value of that byte when the full pubK is used.
  2. ultimately a private key is just a 256-bit number, there should be a unique way to derive an address from there.

Are there actually two addresses for each private key in the bitcoin-core implementation? Isn't there like a standard way of getting the address?

2
  • The representation of the bytes for the full 65 or compressed 33 bytes does change the public key but that cannot change the owners ability to sign for said public key. When you sign for the p2pkh transaction you provide this public key and therefore if you used the 65 byte one you would have to provide that and if you used the 33 byte version you would provide that. Saving 1/2 the byte size is probably the logical choice.
    – Poseidon
    Feb 19, 2023 at 2:52
  • I do not know however if there is a restriction on which one you can use because of how the opcodes behave, I would imagine not but it would be interesting to know if so.
    – Poseidon
    Feb 19, 2023 at 2:55

1 Answer 1

4
  1. it is not mentioned anywhere what is the value of that byte when the full pubK is used.

There is none. The WIF format for uncompressed private keys is just base58check encoding of version byte + 32-byte private key. For compressed private keys (as in: the corresponding public key is to be in compressed format) the WIF format is base58check encoding of version byte + 32-byte private key + 0x01.

  1. ultimately a private key is just a 256-bit number, there should be a unique way to derive an address from there.

Cryptographically speaking, yes, a private key is just a 256-bit number. But from Bitcoin's perspective, because the encoding of the public key matters, private-keys-whose-pubkey-is-compressed vs. private-keys-whose-pubkey-is-uncompressed are distinct keys.

Are there actually two addresses for each private key in the bitcoin-core implementation?

Specifically for P2PKH addresses, if you think of private keys as just the 256-bit discrete logarithm, yes. If you also include P2WPKH, P2SH-P2WPKH, P2TR addresses there are even more.

But as said, it's easier to think of it being two separate private keys, and then each has exactly 1 corresponding public key, and those on their turn have exactly one corresponding P2PKH address.

Isn't there like a standard way of getting the address?

It's hard to call anything standard as all of this predates the introduction of the BIP standardization process in which protocol changes and wallet standards are specified (compressed public keys were introduced in 2011).

But if we're talking about best practices, by all means, just use compressed public keys. There is no point wasting an additional 32 bytes on chain just because historically Bitcoin's creator likely just didn't know about compressed keys.

Or even better, use P2WPKH or P2TR for single-key addresses. They're even cheaper to spend.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.