1

Will signing message (without doing any $ transaction) reveal the private key to the blockchain just the same/similar way the private key is revealed to the blockchain when you do a $ transaction?

The point is, doing a transaction weakens the security of the address a tiny bit because the private key is revealed to the blockchain. That's one reason why change/new address is used with every transaction.

But what about just signing message? Will that weakens the security of the address a tiny bit too?

1

Public / Private key encryption requires that the private key is never revealed - the owner must keep it secret.

Message and transaction signing is done with the private key and verified with the associated public key. So the private key is never revealed to the blockchain. Note that public key here refers to the the full ECC public key, and not a Bitcoin address - which is a hashed and transformed representation of the public key. The public key can only be derived from a Bitcoin address if the SHA256 and ripeMD-160 hashing algorithms are ever broken. This question explores the challenge.

To answer your question: Yes, each new signature produced by a private key may bring an attacker, who already knows the associated public key, closer to discovering the private key.

Comments to this answer have informed an updated position:

Although there is no provable security for ECDSA, it is commonly assumed that, even with knowledge of multiple signatures produced by a particular key, an attacker will not have improved odds at deriving the associated private key or forging its signature.

It is an almost impossible task to discover a Bitcoin private key from its public key. An answer to this question illustrates the challenge mathematically.

Some people advise an attitude of "better safe than sorry" - that public keys should not be revealed, where possible. Yet, caution should not discourage practical utility - as pointed out in the comments below.

Best practice, as you say, is to frequently change keys and to preferably use a new address for every receive transaction. If you want someone to be able to verify a signature they will, of course, need your public key.

As far as I'm aware, the only Bitcoin transaction type that reveals public keys is Pay-To-Public-Key-Hash (P2PKH) which contains the full public key in its script.

  • Thank you for your answer. I guess I will pass up on that Stellar Lumens giveaway that requires signing message. Better be safe than sorry. – Dorky Jun 24 '17 at 5:08
  • 1
    I think "better safe than sorry" here is misleading. Attacks based on knowing the public key are purely theoretical and I know of no reason to think they will become practical in the foreseeable future. Yes, you might as well avoid revealing the public key if there is no reason to do so. But if, as in your case, there is something to be gained by doing it, then that probably outweighs the negligible risks. – Nate Eldredge Jun 24 '17 at 15:08
  • 1
    While ECDSA does not technically have a security proof, it is commonly assumed that an attacker is allowed to see an arbitrarily large number of signatures with a certain key, on messages he chooses, and would still be unable to derive the private key or otherwise forge a signature. I believe this answer is incorrect for that reason. – Pieter Wuille Jun 24 '17 at 18:37
  • answer updated with respect to comments by Nate Eldredge and @PieterWuille . – venzen Jun 25 '17 at 5:50
  • Indeed an attack is almost impossible to hack for the private key after an address is used in a transaction, theoretically speaking. Just as theoretically speaking it's impossible to have collision but the Large Bitcoin Collider project has so far collided more than 50 addresses. So much for being theoretical that doesn't work in practice. So why are people recommending to use a new address with every new transaction if the hack is impossible? To suggest using new address with every new transaction while saying its impossible to hack the private key sounds very much self-contradicting. – Dorky Jun 25 '17 at 6:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.