0

I have read this question that asks if all UTXOs in an address are sent to a change address or only the UTXO involved in the transaction.

As part of a spending transaction, the public address is revealed. And that is part of the reason people suggest not to reuse an address.

My questions are:

  1. Are all UTXOs (even those not part of the transaction) sent to a change address or only the one involved in the transaction? (This was not really answered in the linked question.)
  2. If only the one involved in the transaction is sent to a change address, is it not a security risk? The remaining UTXOs left in the bitcoin address now have their public key made public.
Improve this question

1 Answer 1

Reset to default
0

It is always up to the wallet client to decide which UTXOs are to be spent. The protocol certainly doesn't require all UTXOs of an address to be spent at the same time. A particular wallet client could be coded to do that, but I don't know of any that are.

Here you can see a testnet example. Transaction 90d042b... spent only 2 of the 9 UTXOs available in address moooopfhBjQDSJQuCj4aVr6s4b5pFbQin4. This transaction was created with just the ordinary sendtoaddress command in Bitcoin Core, no special options.

This isn't a significant security risk. In a secure digital signature protocol, it should be infeasible to generate a valid signature without access to the private key, even if the public key is known. That's what "public" means! As far as we know, ECDSA is secure, so revealing the public key doesn't harm security.

Some people believe in planning for the possibility that an attack might someday be found on ECDSA. If so, then there would be some advantage in not having revealed your public key. After a new signing algorithm is incorporated into Bitcoin, you could create a transaction sending your coins to an address which uses the new algorithm. This would reveal your public key and attackers could get started, but assuming the attack is fairly computationally intensive, you hope your transaction would be confirmed before an attacker could successfully create a forged signature on a transaction that would send your coins to him.

The tradeoff of this approach is that, as you note, as soon as you want to spend any coins from an address, you have to spend all the UTXOs. This increases the size of the transaction and thus costs you more in fees. That's why most clients don't do it; the security improvement is theoretical at best, but the costs are real.

Improve this answer
5
  • Thanks, it is clear now. One small question: In the link you provided to a testnet transaction, how can you see the 9 UTXOs available to the address? I could find the 2 you mentioned in the transaction but not the 9 available.
    – Gradient
    Nov 19, 2016 at 17:41
  • @Gradient: Keep scrolling down.
    – Nate Eldredge
    Nov 19, 2016 at 17:46
  • I don't see what you mean. I only see the transactions on the page you linked.
    – Gradient
    Nov 19, 2016 at 18:05
  • @Gradient: There are a total of 10 transactions shown on that page, in reverse chronological order. The most recent one is 90d0. At the time of that transaction, the other 9 were already available and unspent: 932c, 1f19, fdba, f643, 7142, 53f9, 9579, b5a9, ba6d. 90d0 only spent 932c and b5a9 (expand 90d0 and click the arrows to get the transaction IDs). The other 7 UTXOs were not spent by 90d0 and are still unspent as of this writing.
    – Nate Eldredge
    Nov 19, 2016 at 18:29
  • Thanks. Those transactions which have the address as the receiver are the UTXOs I was looking for. I was confused and thought it would be somewhere else.
    – Gradient
    Nov 19, 2016 at 20:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.