Is It Possible to Prove Ownership of Public Key Hash without Public Key?

Question

I am building a system where I would like the user to specify a public key hash of a wallet that they have control over in the event of tips, refunds, and/or otherwise needing to send value back to them.

From there, I would like to further provide a feature that lets the user verify that they own this hashed address.

If I understand correctly, they can prove this by signing a message that I send them, and then they could send the signature back to me along with the public key.

However, I also understand that exposing your public key is considered less than ideal.

So, I am curious if there is some solution somewhere that will allow me to verify ownership based on the hashed address alone, without the use of a public key.

I suppose that since this verification process is transient and will not be permanently stored in a public blockchain (or anywhere else), it is not as potentially harmful of a scenario (or rather, more "trustworthy" for the user). However, I am wanting to be as mindful to their privacy and security as possible and provide them with the opportunity to verify their ownership to this hashed address in the least invasive way available.

Is it enough to simply state somewhere in the user interface that this verification process will not store the public key in any way? This is all assuming a HTTPS connection, but of course the risk is that since bad actors will know that public keys are being transmitted, it opens up one more potential vector of possible attack.

Also, I am very much interested in other approaches that are preferred/known here, as well as any examples of other sites and/or services that have tackled this problem in an elegant way.

Answer 1

The simple answer is no.

A hashing algorithm is ment to be a one-way function. If it is possible to recreate the public key from the hash, this means that the hashing algorithm is broken.

However there is one aspect that you might find useful. For message signatures, bitcoin uses a custom encoding (compared to the DER encoded signature found in transactions).

Given a custom encoded message signature, the message and a public key hash, you can verify that the signature is correct. However, please note that this is because the custom encoded signature supports public key recovery. Therefore this results in the same security aspects as just supplying the public key, but with the benefit that the user does not need to specifically transfer the public key to you.

If you would like to test the custom encoded signatures, they are returned by the "signmessage" function in the bitcoin core client. They can then be verified by the "verifymessage" function, or by multiple online tools, such as this one: https://blockexplorer.com/messages/verify

Answer 2

1) Generate a random private key just to be used to prove ownership.

2) Create a message with the corresponding public key to the key generated in step one and the public key you wish to prove ownership of.

3) Sign it with both private keys.

4) Send it to a central authority.

5) Receive from the central authority a signed statement saying that the owner of the public key corresponding to the private key you generated in step 1 belongs to the account you wish to prove ownership of.

6) You can now use the key you generated in step 1 to prove ownership of the account without revealing the account's public key to anyone since the signed statement from the central authority binds the key you generated in step 1 to the account, proving common control.