Bitcoin Stack Exchange is a question and answer site for Bitcoin users, developers, and enthusiasts. It only takes a minute to sign up.
Sign up to join this community
In the standard pay-to-pubKeyHash scriptSig, which form of the public key should be used. My understanding is that both the compressed (33 bytes) and the expanded (64 bytes) are both valid.
Is there any of these two that is considered "standard"? Will the reference implementation propagate transactions containing either form, or will it withhold one?
IMO, I should use the compressed version since it will result in smaller transactions.
Both are valid and accepted as canonical. They are NOT interchangeable however - the same public key in compressed form is hashed to a different address than that in uncompressed form. You can only use compressed form if the unspent output address is compressed.
One isn't canonical over the other but if you are creating new keys there is no reason to use anything but compressed keys. So you could say uncompressed keys are deprecated for new key creation. If you are writing wallet software or other tools it would be good practice to always create compressed keys by default. Uncompressed keys have no advantages and they make each input in a transaction 32 bytes larger.
Now for transactions involving existing keys you must use the form which hashes to the PubKeyHash provided in the PkScript (output script).
This private key:
72F3F4D20089ACFF5406AE394D575466FA97790CB27BDCEC08B288C44C924622
has a public key in both of the following forms
04C02D446392E6FF2A5A80256C41F00251F22E5657A9C9889596DD44501F335F73B8CE4F74EF058871FDA861A3C642600743F5D5CA83660656AF296B66A49BD68A
02C02D446392E6FF2A5A80256C41F00251F22E5657A9C9889596DD44501F335F73
they however hash to different PubKeyHashes
3294837233cf5e8b458fad15b7581e0dd5027ace (for uncompressed key)
fe9a562ce1129ecf42ec1e65cf4872049280082d (for compressed key)
So if you are trying to spend an P2PkH output which is locked to the PubKeyHash 3294837233cf5e8b458fad15b7581e0dd5027ace the ScriptSig in the input must be created using the uncompressed key. The scripting langugage will not check both forms. It just directly hashes the pubkey provided and verifies that it matches the pubkeyhash in the output. Remember an address is the pubkeyhash encoded in base58 so the output form is going to depend on which address you provide the sender.
