Why doesn't Bitcoin use public key recovering from the signature in order to reduce the Blockchain size? This would save 32 bytes per transaction input.

  • Does it guarantee you'll extract precisely the same public key used to generate the signature? If not, then the hash check will fail. – David Schwartz Dec 4 '15 at 20:49
  • No it won't. see crypto.stackexchange.com/questions/18105/… There will be two possible public keys. In addition you don't know if you have to use the compressed or the uncompressed representation of the the pubkey. So 4 possibilities. However this could be easily solved by setting a 2 bit flag to the signature. Something I haven't specified but is very important is that the Bitcoin client is already using such a technique for message signatures – Jan Moritz Dec 4 '15 at 21:07
  • Actually, other answers on that same page explain that it's not guaranteed that either of those two possible public keys are the right one. – David Schwartz Dec 4 '15 at 21:13
  • Read the comments. If there is a failure (low probability and I believe it can not happen with secp256k1) the signer can still retry using another k seed. By the way the given example is not secp256k1 as he used other a, b values ... – Jan Moritz Dec 4 '15 at 21:47
  • I've calculated the probability that n≤(kG)x<p, it is about 1/1.39+42 :-D – Jan Moritz Dec 4 '15 at 22:03

The author of wxBitcoin was most likely unaware of the ability to do this, there's other inefficiencies like the original use of uncompressed points and BER encoding for signatures which also would have been good to eliminate.

  • But why not to implement it now? Compressed addresses were also introduced later – Jan Moritz Dec 2 '15 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.