Why doesn't Bitcoin use public key recovering from the signature in order to reduce the Blockchain size? This would save 32 bytes per transaction input.
-
Does it guarantee you'll extract precisely the same public key used to generate the signature? If not, then the hash check will fail.– David SchwartzDec 4, 2015 at 20:49
-
No it won't. see crypto.stackexchange.com/questions/18105/… There will be two possible public keys. In addition you don't know if you have to use the compressed or the uncompressed representation of the the pubkey. So 4 possibilities. However this could be easily solved by setting a 2 bit flag to the signature. Something I haven't specified but is very important is that the Bitcoin client is already using such a technique for message signatures– Jan MoritzDec 4, 2015 at 21:07
-
Actually, other answers on that same page explain that it's not guaranteed that either of those two possible public keys are the right one.– David SchwartzDec 4, 2015 at 21:13
-
Read the comments. If there is a failure (low probability and I believe it can not happen with secp256k1) the signer can still retry using another k seed. By the way the given example is not secp256k1 as he used other a, b values ...– Jan MoritzDec 4, 2015 at 21:47
-
I've calculated the probability that n≤(kG)x<p, it is about 1/1.39+42 :-D– Jan MoritzDec 4, 2015 at 22:03
|
Show 2 more comments
1 Answer
The author of wxBitcoin was most likely unaware of the ability to do this, there's other inefficiencies like the original use of uncompressed points and BER encoding for signatures which also would have been good to eliminate.
-
But why not to implement it now? Compressed addresses were also introduced later Dec 2, 2015 at 21:07