I've read that one reason to use a new address for each transaction is because it hides the pubkey behind a hash, so that even if ECDSA is broken and someone is able to derive my privkey from my pubkey it would still be impossible to spend the output of the transaction, since they would need to be able not only to reverse the hash but reverse it into a valid pubkey. Assuming that's impossible, and assuming people use a new address for each transaction, what would be the full security implications for bitcoin if ECDSA were broken? How much protection does hashing the pubkey give from broken-ECDSA attacks?


First, if ECDSA were broken, a lot of other things would be broken, like ssh, https and a bunch of other things, including banking websites.

Second, if nobody reused addresses, then yes, bitcoin would be protected by SHA256 and RIPEMD160. There is currently no known way to get a preimage of a hash used by either of those functions so your bitcoin would be safe. Again, this assumes nobody reuses addresses.

As far as how much protection this gives, it's hard to say because it depends on the exploit used to break ECDSA.

  • I guess I'm just asking, are there other things ECDSA is used for on the network where it's not protected by a hash? – Elliot Gorokhovsky Jun 6 '16 at 14:04
  • Also, I think you're wrong... the person who sent me the transaction knows my pubkey, so if ECDSA were broken they could send the bitcoins back to themselves after I've rendered them a service or given them a product. – Elliot Gorokhovsky Jun 6 '16 at 14:07
  • No there aren't other things using ECDSA except for the signing. And no, the person that's sending you the transaction does NOT know the pubkey unless you tell them off-band. They only know the hash160 of the pubkey, which is encoded in your bitcoin address. – Jimmy Song Jun 6 '16 at 16:02
  • Oh that's right! Then what's the point of the signing? Why cant I just announce to the network, "I can prove this transaction was sent to me since can reverse the hash. Now send the coins to address X please." – Elliot Gorokhovsky Jun 6 '16 at 16:08
  • To prove that you have the preimage of a hash, you would have to reveal the the preimage itself. Once someone has a preimage, they can then create their own transaction to supplant their own. Miners, for example, could then change transactions to give themselves the bitcoins. You need public key cryptography to stop this sort of manipulation. – Jimmy Song Jun 6 '16 at 19:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.