When signing a pubkeyhash UTXO, it is required to provide both a signature and a public key. The public key is duplicated and one copy is provided to op_checksigverify to ensure the signature is valid, and the other copy is hashed to ensure it matches the pubkeyhash.

In theory, is it possible to build an opcode like op_checksigverify_pushkey that takes only the signature of the transaction and extracts the public key from the signature? With this it would be possible to only specify the signature and no need to provide the public key. The public key of course could be arbitrary, but would fail when hashed and compared against the vout pubkeyhash.


It's possible, but:

  1. It's much slower
  2. Pubkey recovery for this kind of application is arguably patented

For a "signature only" scriptpubkey, we already have p2pk. Hopefully in the future, segwit programs will have bare pubkeys in the scriptpubkey, allowing for similar (and more advanced) constructions.


Correction: There is a way to extract the public key from the signature + message

In order to verify a signature using ECDSA, you must provide both the signature and the public key, or you have no key to verify against. It is not possible to extract the public key from the signature.

The reason for this requires an understanding of how the ECDSA algorithm works, so I'd suggest the link above for a mathematical explanation.

  • >> It is not possible to extract the public key from the signature . It is possible to extract a pubkey from a signature + message pair – arubi Dec 5 '18 at 5:01
  • I am unaware of that can you provide more info? Why doesn't Bitcoin do this? – JBaczuk Dec 5 '18 at 5:04
  • My understanding is an ECDSA signature actually contains the public key, there is just no opcode in Bitcoin Script for extracting it. For instance, it is possible in Ethereum using ecrecover to fetch a public key that signs a message. It is then on you to verify that the public key that signed the message matches who you expected – Earlz Dec 5 '18 at 5:04
  • 1
    Yes, this is possible; it is called ECDSA pubkey recovery. @Earlz It isn't the case that the signature 'contains' the public key. Rather, given a message and a signature, it is possible to compute the public key(s) for which that msg/sig pair would be valid. That computation is slower than verifying the signature outright though. – Pieter Wuille Dec 5 '18 at 5:09
  • 1
    It's only slightly slower (around 5%), but the reason it isn't really considered for improvements to Bitcoin is because it is inherently incompatible with batch validation or signature aggregation (which give much bigger savings). – Pieter Wuille Dec 5 '18 at 5:25

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.