Why doesn't Bitcoin use public key recovering from the signature in order to reduce the Blockchain size? This would save 32 bytes per transaction input.

  • Does it guarantee you'll extract precisely the same public key used to generate the signature? If not, then the hash check will fail. Dec 4, 2015 at 20:49
  • No it won't. see crypto.stackexchange.com/questions/18105/… There will be two possible public keys. In addition you don't know if you have to use the compressed or the uncompressed representation of the the pubkey. So 4 possibilities. However this could be easily solved by setting a 2 bit flag to the signature. Something I haven't specified but is very important is that the Bitcoin client is already using such a technique for message signatures
    – Jan Moritz
    Dec 4, 2015 at 21:07
  • Actually, other answers on that same page explain that it's not guaranteed that either of those two possible public keys are the right one. Dec 4, 2015 at 21:13
  • Read the comments. If there is a failure (low probability and I believe it can not happen with secp256k1) the signer can still retry using another k seed. By the way the given example is not secp256k1 as he used other a, b values ...
    – Jan Moritz
    Dec 4, 2015 at 21:47
  • I've calculated the probability that n≤(kG)x<p, it is about 1/1.39+42 :-D
    – Jan Moritz
    Dec 4, 2015 at 22:03

1 Answer 1


The author of wxBitcoin was most likely unaware of the ability to do this, there's other inefficiencies like the original use of uncompressed points and BER encoding for signatures which also would have been good to eliminate.

  • But why not to implement it now? Compressed addresses were also introduced later
    – Jan Moritz
    Dec 2, 2015 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.