0

When signing a pubkeyhash UTXO, it is required to provide both a signature and a public key. The public key is duplicated and one copy is provided to op_checksigverify to ensure the signature is valid, and the other copy is hashed to ensure it matches the pubkeyhash.

In theory, is it possible to build an opcode like op_checksigverify_pushkey that takes only the signature of the transaction and extracts the public key from the signature? With this it would be possible to only specify the signature and no need to provide the public key. The public key of course could be arbitrary, but would fail when hashed and compared against the vout pubkeyhash.

Improve this question

2 Answers 2

Reset to default
2

It's possible, but:

  1. It's much slower
  2. Pubkey recovery for this kind of application is arguably patented

For a "signature only" scriptpubkey, we already have p2pk. Hopefully in the future, segwit programs will have bare pubkeys in the scriptpubkey, allowing for similar (and more advanced) constructions.

Improve this answer
1
0

Correction: There is a way to extract the public key from the signature + message

In order to verify a signature using ECDSA, you must provide both the signature and the public key, or you have no key to verify against. It is not possible to extract the public key from the signature.

The reason for this requires an understanding of how the ECDSA algorithm works, so I'd suggest the link above for a mathematical explanation.

Improve this answer
8
  • >> It is not possible to extract the public key from the signature . It is possible to extract a pubkey from a signature + message pair
    – arubi
    Commented Dec 5, 2018 at 5:01
  • I am unaware of that can you provide more info? Why doesn't Bitcoin do this?
    – JBaczuk
    Commented Dec 5, 2018 at 5:04
  • My understanding is an ECDSA signature actually contains the public key, there is just no opcode in Bitcoin Script for extracting it. For instance, it is possible in Ethereum using ecrecover to fetch a public key that signs a message. It is then on you to verify that the public key that signed the message matches who you expected
    – Earlz
    Commented Dec 5, 2018 at 5:04
  • 1
    Yes, this is possible; it is called ECDSA pubkey recovery. @Earlz It isn't the case that the signature 'contains' the public key. Rather, given a message and a signature, it is possible to compute the public key(s) for which that msg/sig pair would be valid. That computation is slower than verifying the signature outright though.
    – Pieter Wuille
    Commented Dec 5, 2018 at 5:09
  • 1
    It's only slightly slower (around 5%), but the reason it isn't really considered for improvements to Bitcoin is because it is inherently incompatible with batch validation or signature aggregation (which give much bigger savings).
    – Pieter Wuille
    Commented Dec 5, 2018 at 5:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.