Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
54

A compressed key is just a way of storing a public key in fewer bytes (33 instead of 65). There are no compatibility or security issues because they are precisely the same keys, just stored in a different way. The original Bitcoin software didn't use compressed keys only because their use was poorly documented in OpenSSL. They have no disadvantages other ...


39

First of all two matching scripts are used in two different transactions, one that transfers funds to an address (Transaction A) and one that spends those funds (Transaction B). The scriptPubKey is created by the user that creates Transaction A. It basically adds a claiming condition to the output that is being created. A user may only claim and thus spend ...


27

As is normal when doing Elliptic Curve encryption, a private key is simply a random number. In the case of secp256k1, the elliptic curve used by Bitcoin, it has to be a number between 1 and 115792089237316195423570985008687907852837564279074904382605163141518161494336 (or in hexadecimal, between 0x1 and 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B ...


22

Thomas' answer is correct, but I think an easy version may be appreciated as well. I suppose you know the concept of public key cryptography? If you don't, here is a very short explanation (or read the wikipedia page): Public key cryptography (as used in Bitcoin), allows you to hand people a public key and use the corresponding private key to prove the ...


21

There's a lot of confusion here, mostly bits and pieces of the whole scheme that is Hierarchical Deterministic derivation, and finally two questions that seem to indicate missing some point about it. The answer to the first question is No. The second question is more interesting : Let's start from extended keys, specifically BIP32 keys. Like private keys ...


19

He has a PGP public key which he can use to sign things.


19

Yes, this is possible. However, I want to upfront state that this is not advisable for multiple reasons: Bitcoin keys are intended to be single use for privacy reasons, and leveraging them for encryption unnecessarily encourages treating them as a long-lived identity. There may be ugly and dangerous interactions when keys are used for multiple protocols ...


18

Yes, you could send bitcoins directly to the public key: in fact, both Pay-to-PubKey (P2PK) and Pay-to-PubKey-Hash (P2PKH) were introduced in the first Bitcoin release. IIRC, P2PK is still used for Coinbase transactions sometimes, today. P2PK transactions are slightly bigger for outputs but significantly smaller for inputs. One advantage of P2PKH is that ...


16

Format (private keys): uncompressed: 0x80 + [32-byte secret] + [4 bytes of Hash() of previous 33 bytes], base58 encoded compressed: 0x80 + [32-byte secret] + 0x01 + [4 bytes of Hash() previous 34 bytes], base58 encoded case 1: secret (hex): 1111111111111111111111111111111111111111111111111111111111111111 uncompressed: secret (base58): ...


16

It is impossible to compute the public key of an address, as the address is computed from the hash of the public key. You can retrieve the public key from address with the reference client using the validateaddress RPC call (or in the debug window of Bitcoin-Qt), but that simply fetches it from the wallet, and only works if the address is your. What do you ...


14

As @Murch correctly pointed out it is indeed possible to send bitcoin to either a public key or to the hash of a public key. The original motivation for using hashes of public keys was to shorten the size of the address. Public keys in their uncompressed form are 64 bytes long whereas RIPE-MD outputs 20 bytes (+5 bytes of checksum and version). ...


13

There are three main types of wallets: non-deterministic (random) wallets sequential deterministic wallets hierarchical deterministic wallets With a non-deterministic (random) wallet, all the private/public keypairs are generated randomly. The wallet may generate 100 random private keys as soon as it is initialized, for example. With a sequential ...


13

When I read pyramids' answer, I was very skeptical. It didn't really seem right to me that addresses generated from a hash (in this case from a public key) would have anything but a random distribution. To test out the distribution of addresses, I downloaded the dataset linked to in this forum thread and counted up how many times addresses appeared. There ...


12

From a cryptographic point of view, there is just one type of private keys and one type of public keys. A private key is an integer in the range 1 to 115792089210356248762697446949407573529996955224135760342422259061068512044368, a public key is a point on the elliptic curve secp256k1. No magic here. The problem is that Bitcoin uses addresses, and addresses ...


12

Yes, all three assumptions are correct. You can with some effort keep your private keys offline for their entire life. A description of how to sign transactions offline is found here: How to sign a transaction using only an offline computer? Adding a bit of detail on Assumption 3 along the lines of Tim S.'s comment: A computer that is offline would ...


11

Both of the keys are a part of the Elliptic Curve Digital Signature Algorithm. A private key is just a random number, while the public key is a 2D point coordinate on an Elliptic Curve derived from it. The private key is used to sign messages (in case of Bitcoin - the transactions), and the public key is used to check whether the signature is correct. The ...


11

the output address is derived solely from the output script starting from step 4 in the wiki like so: first add leading zeros: 0012ab8dc588ca9d5787dde7eb29569da63c3a238c then hash with sha256 (if you look in the wiki this is actually part of the OP_HASH160 operation) to give: e158c4be10913422dadcf1c36843020ebb3ffe9d0cb13fb9e8c0a564a53c7832 then hashed ...


10

The public and private keys in a Bitcoin address are a normal ECDSA key pair. I haven't poked through this particular bit of Bitcoin's own code but the offshoot products I've had a chance to work with typically use the Bouncy Castle crypto library. Bouncy Castle also has an excellent introduction/tutorial on how to use their library. Their examples are in ...


10

There's two types of wallet. A conventional wallet is just a collection of random keys, Bitcoin-QT and Multibit fit into this category. A Hierarchical Deterministic like Electrum or Armory generate all the keys in the wallet from a single key, so that one backup is permanently associated with a wallet no mater how many new addresses and change addresses are ...


9

Bitcoin private keys are most commonly displayed in wallet import format (WIF), also known as base58check (a number expressed in base 58 with a checksum at the end and a version byte at the beginning). To create a WIF private key, you need to: Generate an ECDSA secret exponent (the private key) using the SECP256k1 curve. Convert the secret exponent/private ...


9

To be honest, it IS possible, but you need a signature made by that address. From that point, you can get the public key. See this piece of code: https://github.com/bitcoinjs/bitcoinjs-message/blob/master/index.js#L57


9

You can't get a database of all such public keys, but you can get some of them. An address, as you know, is a hash of a public key. When somebody sends coins to an address, you can think of the associated public key as having a positive balance, but nobody else necessarily knows what the public key actually is. (You can't compute the public key directly ...


9

You cannot compute the public key of an address (that is not yours), because the address is computed from the hash of the public key. You can find the public key of your own address with the Bitcoin-QT debug window or with a validateaddress RPC call.


9

No, there is not one private key. There is one Master private key. The master private key is then used to generate more private keys in a deterministic fashion, i.e. using the same master private key, you will generate the same private keys. Those private keys are what are actually used in your wallet. Their public keys are generated and the addressees ...


8

Then both of the people could spend the same coins if they were sent to their Address, rather than public key. If they instead received the money to the public keys, they couldn't spend eachother's coins. All in all, the most important thing that would happen is that they would show RIPEMD-160 collision, which would most likely be the first one ever. A ...


8

He can prove that he has the private key matching the address used in the genesis block.


8

It is impossible. Given an ECDSA (compressed 65Bytes or not 33Bytes) public-key K, a Bitcoin address is generated using the cryptographic hash functions SHA-256 and RIPEMD-160. The public-key is hashed twice: HASH160 = RIPEMD-160(SHA-256(K)). The Bitcoin address is computed directly from this HASH160 value as base58(0x00 || HASH160 || bSHA-256(SHA-256(0x00 ...


8

Addresses are really just shorthands for particular scripts. The standard address type (starting with a '1' on mainnet) does in fact correspond to the exact type of script you gave above. If you base58 decode such an address, you end up with a byte string of the form 0x00 + [20-byte hash] + [4-byte checksum]. The corresponding script is OP_DUP OP_HASH160 [...


8

The ECDSA signature algorithm used by Bitcoin doesn't have symmetry between its private and public keys. If you read about how the algorithm works, they aren't even the same type of mathematical object: a private key is an integer, while a public key is a point on an elliptic curve. They do not, in your words, "perform the same task." So you can't do that....


7

False, as you've described it here, because private and public keys work a little differently than that. The underlying math is tricky, but I'll try and give a common sense explanation in everyday language instead. Imagine that there was a special metal called Cryptonium, harder than anything else on earth and completely indestructible. No one else knows ...


Only top voted, non community-wiki answers of a minimum length are eligible