As we want to minimize the data payload in a blockchain, which also led to concepts like SegWit, and is matter of discussion in Signature aggregation etc, I wonder why do we actually need to supply public key in order to spend? It's needless 33B of data. ScriptPubKey could look like this <HASH160> OP_CHECKSIG2 and ScriptSig <Signature>. I know this requires Softfork, but as we introduced SegWit, why wasn't this the design? Is it because mapping signature -> public key is not unambiguous?

As in the comments suggested: the issue with public key recovery from EC signature is simply trade-off between fast verifiability and space requirements. The public key recovery from signature (r,s) involves conversion of scalar r = xr into a curve point R = (xr, yr), i. e. modular square root. This raises another question:

What's the idea of segwit transaction verification? Do we have multiple levels of consensus rules validation? E.g. basic validation evaluates all transaction scripts according to pre-segwit rules (which is just push of 2 stack items, which is always True), and deep validation that triggers the witness validation logic. I'm not sure whether I should look at segwit as "We moved the data away from transaction that represent just some ownership proof which is relevant at the time of confirmation but not years thereafter" or maybe rather like "Witness data is inherent part of transaction, just as it has always been, and was actually meant as tx-malleability fix and Script language generalization allowing future protocol extension."?

  • The questioner seems to be alluding to the ability to recover public keys from ECDSA signatures, such as described in bitcointalk.org/index.php?topic=6430.0 May 19, 2018 at 12:09
  • Pub key recovery generally wasn't known about when bitcoin was designed, and has some small caveats like being more CPU intensive. Most of the resource usage of Bitcoin is CPU time already.
    – Claris
    May 20, 2018 at 14:29
  • @Anonymous not really. It could be faster if so many steps weren’t single thread. Sep 15, 2020 at 23:13

1 Answer 1


This was discussed today on the #bitcoin-wizards IRC channel. The reasons offered by Andrew Poelstra (andytoshi) were:

  1. "Segwit had enough scope already." That is, it was already a large change that some people considered controversial, so minimizing further changes was considered desirable.

  2. "Pubkey recovery is incompatible with batch validation." Poelstra goes on to explain that Bitcoin doesn't currently have batch validation for ECDSA and the reasons why, but it doesn't sound to me like batch validation would be impossible to add at a later point (though perhaps it would require a soft fork); presumably devs would prefer to work on batch validation and signature aggregation using Schnorr signatures instead.

Later, Gregory Maxwell (gmaxwell) added that "Certicom has a patent on key recovery that could potentially apply" to a possible construction, which could've made using that construction controversial.

FYI: your second question asked in edits should probably be asked separately as it's a completely different issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.