Is it true that sending from an address exposes the public key of a bitcoin address?

Question

I just recently learned that your public key + private key is hashed together to form your bitcoin address. Is this true?

Can someone please confirm if the following is true:

• If a bitcoin address never sent funds out, you would need to guess the public + private key of the bitcoin address.
• If a bitcoin address had an outgoing transaction, the public key is now out in the open and you would only need to guess the private key.
• Single address Paper wallets that had an out going transaction has a risk of its funds being stolen since the public key is now in the open.
• Is there a site that lists all the bitcoin addresses with their public key exposed that also still has large sums of bitcoin in it?

Answer 1

This is mostly not correct.

First of all, the address is a hash of the public key only.

Also, if one has a private key, the corresponding public key can be computed directly. So the most straightforward brute-force attack looks something like this:

1. Pick a number to use as a private key (an integer between 0 and 2^256, roughly)

2. Compute the corresponding public key

3. Compute the RIPEMD-160 hash of the public key

4. See if it matches the target address (or any other address containing coins)

5. Repeat

Knowing the public key in advance isn't relevant for this attack. In fact, since the private key is 256 bits and the hash is only 160 bits, it is overwhelmingly likely that if the attack succeeds, it will be by finding a private key which produces a public key that is different from the original public key but has the same hash. (Of course, it is overwhelmingly unlikely that this will actually succeed before the end of the universe.)

The whole point of public key cryptography is that it remains secure even when the public key is made public, and ECDSA is believed to be a secure algorithm in this respect. There are no known attacks in which knowing the public key makes it feasible to recover the private key or otherwise produce valid signatures. So it's not accurate to say that addresses with an exposed public key are "at risk" of having the coins stolen. This is not a real risk, as far as is known.

There are theoretical attacks based on quantum computing that might make it much easier to determine a private key from the corresponding public key. See What effects would a scalable Quantum Computer have on Bitcoin? If those attacks (and the requisite quantum computing technology) should eventually become possible in practice, then there would be a real increased risk to addresses with an exposed public key. That is not the case today and as far as I know, it is not likely anytime soon.

I don't know of any compiled list of funded addresses with exposed public keys.

See also Is that safe to expose public key to the mainnet