Could the standard pay to address script be simpler? e.g. no compare of the HASH160?

Question

What if I had a scriptPubKey of

<pubKey>OP_CHECKSIG

And an scriptSig of

<sig>

Question

1. Would that work in the standard client?

2. Why do we need to check the hash?

The only possible reason I could come up with is that it makes a DDOS much more difficult since people aren't flooding the network with invalid signatures that eats up the CPU, and a hash is relatively inexpensive.

If the explanation I have is correct, is it documented anywhere?

The wiki says that that the pay to pub key hash is to prevent a break in the ECDSA algorithm, but I wonder what the real answer might be.

Answer 1

Exposing your public key does weaken the security a bit. That is why it is recommended that you do not reuse addresses since your public key is exposed when you sign the first transaction spending money from that address. Using Pay-To-PubKey instead of Pay-To-Pubkey-Hash exposes your public key immediately.

Answer 2

This is the standard pay-to-pubkey script, which was the original "standard script" for a while, and is still used if you'd solo mine from within bitcoind.

Originally, Bitcoin transactions were intended to use pay-to-IP, where the "address" was an IP address, and the public key to pay to was computed on the fly when requested by the sender. These transactions used pay-to-pubkey scripts.

Pay-to-IP became deprecated and eventually removed quickly, mostly because of security reasons (man-in-the-middle), and the "workaround" (intended for when the recipient was offline) pay-to-pubkeyhash took over, with several unfortunate side effects (address reuse, no comments on transactions, ...). Hopefully the Payment Protocol (BIP 70-72) can bring these back.

There are other reasons for preferring pay-to-pubkeyhash instead of pay-to-pubkey, such as a very minor security advantage (before the pubkey is revealed, the attacker first needs a preimage attack on the hash, before starting to attack the EC key), and smaller effect on the UTXO set (the database every full node maintains in addition to the block chain).

Answer 3

This is not useful because anyone can redeem it with a valid ECDSA signature signed under ANY key.