23 votes
Accepted

What are the advantages of Schnorr vs ECDSA?

Your question seems to assume that the only goal is minimizing on-chain transaction size. Reducing size and related costs is certainly something that can be improved upon, but it's far from the only ...
Pieter Wuille's user avatar
10 votes
Accepted

How is Public Key extracted from (message, digital signature, address)

An algorithm called Public Key Recovery exists for ECDSA, which lets you construct the public keys for which a given pair of message and signature would be valid. To explain the algorithm, remember ...
Pieter Wuille's user avatar
9 votes
Accepted

How to tell which part of the previous tx I need to make the hash to sign for an old given tx?

Disclaimer: I am going to assume that you are not completely clueless and that you know what an array is, how to count from 0, and how to match brackets, quotes, and colons so that you can read JSON ...
Andrew Chow's user avatar
  • 68.6k
6 votes
Accepted

Is It Possible to Prove Ownership of Public Key Hash without Public Key?

The simple answer is no. A hashing algorithm is ment to be a one-way function. If it is possible to recreate the public key from the hash, this means that the hashing algorithm is broken. However ...
user44404's user avatar
  • 546
6 votes
Accepted

how do you sign and verify a message that you own a bitcoin address using javascript?

bitcoinjs-lib and bitcore-lib are both javascript libraries that allow for key signing. For example with bitcore-lib: var Message = require('bitcore-message'); var privateKey = new bitcore....
m1xolyd1an's user avatar
  • 5,596
5 votes
Accepted

How to determine first byte (recovery ID) for signatures (message signing)?

FWIW this is what I have found regarding this question. Basically there are two ways of finding what libraries call "recid" or recovery ID. Most of them use the first method but there is ...
Coding Enthusiast's user avatar
5 votes

Difference between Sign Message and Sign Transaction

Is the difference that for "Sign Message", first a digest is created, which is then signed, while for "Sign Transaction" (in the meaning written above), the input is already a digest, so it shouldn't ...
Andrew Chow's user avatar
  • 68.6k
5 votes
Accepted

Why does blockwide signature aggregation prevent adaptor signatures?

There is a simple information theoretic argument: when two parties produce an adaptor signature, one party will learn a secret tweak from the eventually published on-chain signature, by comparing it ...
Pieter Wuille's user avatar
5 votes
Accepted

With Legacy bitcoin addresses deprecated, will Bitcoin Core no longer be able to sign messages from an address?

Bitcoin Core can only sign messages from legacy bitcoin addresses, in my experience. Yes, that's correct. Message signing is currently only supported for P2PKH addresses. With legacy addresses being ...
Pieter Wuille's user avatar
4 votes
Accepted

online tool to play around with ECDSA public keys, message signature verification?

Here are a few I'd recommend: https://bitcore.io/playground/#/address (private key - public key) https://brainwalletx.github.io/#generator (signing and verifying but bitcoin specific) Or play with ...
Justin O'Brien's user avatar
4 votes
Accepted

message signing: is it safe to publish the address, message and hash

It shouldn't compromise the private key. Notice that publishing a message along with a signature is a common thing, and is necessary to verify the signature. Publishing also de Bitcoin address is ...
sr_gi's user avatar
  • 3,192
4 votes
Accepted

How can I sign a message with a litecoin private key and also generate a litecoin address from a string?

bitcoinjs already has support for litecoin, a quick look at /src/network.js and the README reveals this. https://github.com/bitcoinjs/bitcoinjs-lib/blob/d853806/test/integration/basic.js#L30 See how ...
Penquin's user avatar
  • 671
4 votes

Where is the public key corresponding to my address stored?

Yes, a transaction includes the public key. So, only when you spend the coins from an address a public key actually becomes public (unless you have shared it with anyone otherwise). So, as long as ...
Jannes's user avatar
  • 6,324
4 votes
Accepted

Why are miners allowed to change a tx id?

BIP 62 proposed to make transaction malleability impossible. No it didn't. It would have outlawed a limited number of known and addressable forms of malleability. In particular, it did not prevent ...
Pieter Wuille's user avatar
4 votes
Accepted

How does a hardware wallet interact with the bitcoin network?

No. The hardware wallet company sometimes runs a node, but you could just as easily use a client like Electrum instead, and use Electrum nodes instead with your hardware wallet. All the node is used ...
ieatpizza's user avatar
  • 2,068
4 votes

Why is full blockwide signature aggregation of schnorr signatures non-interactive?

First a definition: A multisignature scheme is a scheme where multiple parties jointly produce a signature on a single message, which can be verified against the set of all participating public keys. ...
Pieter Wuille's user avatar
4 votes

why do we need to hash before we use a private key to digitally sign a transaction? isn't just using a private key enough?

I addition to Claris' answer, if your question is about ECDSA, the hashing step is actually an essential part of the signature scheme and not just a step we choose to do before invoking it. Without ...
Pieter Wuille's user avatar
3 votes
Accepted

Using BitcoinJS - How do you verify a message using a segwit bech32 (bc1…) / P2SH (3…) addresses?

A Trezor signed message with a 3 address can be verified here: https://jhoenicke.github.io/brainwallet.github.io/#verify Or your can verify it with another Trezor wallet.
xtraelv's user avatar
  • 46
3 votes

Is It Possible to Prove Ownership of Public Key Hash without Public Key?

1) Generate a random private key just to be used to prove ownership. 2) Create a message with the corresponding public key to the key generated in step one and the public key you wish to prove ...
David Schwartz's user avatar
3 votes
Accepted

Why the signature of the same message changes in some wallets, but not all?

You're seeing the effect of RFC6979. When generating a signature, some randomness is needed (called the nonce), as there are multiple valid signatures for the same message/key pair. The algorithm ...
Pieter Wuille's user avatar
3 votes

online tool to play around with ECDSA public keys, message signature verification?

closest I can come up with are these: http://coinig.com/ http://gobittest.appspot.com/Address https://www.bitaddress.org/bitaddress.org-v3.2.0-SHA256-...
pebwindkraft's user avatar
  • 5,086
3 votes
Accepted

How are Bitcoin Signed Messages generated?

The message that is signed is prepended with "\x18Bitcoin Signed Message:\n" + compactSizeEncoding( len(message) ) \x18 is Python syntax for unicode character 0x18. This new text string is then ...
Thorkil Værge's user avatar
3 votes
Accepted

signmessage and verifymessage CLI commands not accepting Address from getnewaddress?

signmessage and verifymessage only work with legacy type addresses. They do not work with segwit addresses. There is ongoing work to introduce a new message signing standard that will work regardless ...
Andrew Chow's user avatar
  • 68.6k
3 votes
Accepted

SIGHASH_SINGLE with no corresponding output

The explanation at the bottom of this site says that if there is no corresponding output, then the message that gets signed is always 0100000000000000000000000000000000000000000000000000000000000000. ...
Pieter Wuille's user avatar
2 votes

Best simple linux cmd tool for offline transaction creation and signing?

There are many command line tools for creating and signing raw transactions offline, most of them written in Python: pycoin, python-bitcoinlib, pybitcointools and others. If you use Electrum wallet, ...
venzen's user avatar
  • 609
2 votes

online tool to play around with ECDSA public keys, message signature verification?

Here is an ECC calculator for the Secp256k1 curve that I'm programming in Java. https://github.com/MrMaxweII/Secp256k1-Calculator
MixMAx123's user avatar
2 votes
Accepted

What is wrong with my ScriptSig? I get 64: scriptsig-not-pushonly

Your signature is not correct. First of all, its length can't be 74 bytes long. According to the Bitcoin wiki: Signatures are either 73, 72, or 71 bytes long, with probabilities approximately 25%, ...
sr_gi's user avatar
  • 3,192
2 votes
Accepted

How do I get my private key?

That depends on what type of P2SH address it is. Only some P2SH script types actually have a one-to-one relationship with a private key. The most common case is probably embedded segwit. If its a P2SH-...
meshcollider's user avatar
  • 11.8k
2 votes
Accepted

Explicit message length in Bitcoin Signed message

It's a quirk of the original implementation of the message signing logic which was introduced in Bitcoin Core in 2011. When the message is signed, it must be serialized before it is hashed. The ...
Andrew Chow's user avatar
  • 68.6k
2 votes

How can I sign message for a blockchain watch only bitcoin address

When you import an address as a 'watch only' address, it means exactly that: you can only 'watch' the address and see whatever funds are sitting in it. You cannot send transactions, or sign messages, ...
chytrik's user avatar
  • 18k

Only top scored, non community-wiki answers of a minimum length are eligible