Bitcoin Stack Exchange is a question and answer site for Bitcoin crypto-currency enthusiasts. It only takes a minute to sign up.
Sign up to join this community
I want to use message signing in another application to prove a particular wallet owner did in fact make the transaction. This as I understand it is what message signing/verification is for.
I just want to confirm that making the address, the message, and the hash fully public (open for the world to see) does not compromise the wallet security. Also if I did this thousands of times on the same address, but each with a unique message and hash, the private keys would remain secure.
Thank you.
It shouldn't compromise the private key. Notice that publishing a message along with a signature is a common thing, and is necessary to verify the signature. Publishing also de Bitcoin address is similar to give the public key, since the former can be derived from the latter (actually, once you redeem your first transaction by signing it, you will provide the public key in the blockchain).
However, since you what to reuse the same key for signing multiple messages, there is something you should have in mind. There exist a well-known ECDSA vulnerability that affects the signing process, and by which if two different messages are signed using the same private random value k, anyone who knows the two original messages and the signature can derive the private key used to sign the messages. This is not likely to happen, since k should be chosen at random and from a good source of randomness, however some buggie implementations of the signature had lead to private key disclosure.
In order to ensure that this won't happen, you should use a deterministic ECDSA signature, in which k is chosen deterministically over the message to sign. Several wallets, like the Bitcoin Core, implement such a mechanism by default.
