31

Although hashing a public key by itself does provide quantum resistance, this is really only when it is considered by itself in a vacuum. Unfortunately, public key hashes do not exist in a vacuum and there are many other things in Bitcoin that need to be considered. Firstly, if public keys were hashed, the funds are only protected before they are spent. As ...


29

There's a lot of confusion here, mostly bits and pieces of the whole scheme that is Hierarchical Deterministic derivation, and finally two questions that seem to indicate missing some point about it. The answer to the first question is No. The second question is more interesting : Let's start from extended keys, specifically BIP32 keys. Like private keys ...


26

It is impossible to compute the public key of an address, as the address is computed from the hash of the public key. You can retrieve the public key from address with the reference client using the validateaddress RPC call (or in the debug window of Bitcoin-Qt), but that simply fetches it from the wallet, and only works if the address belongs to you. Update:...


23

Thomas' answer is correct, but I think an easy version may be appreciated as well. I suppose you know the concept of public key cryptography? If you don't, here is a very short explanation (or read the wikipedia page): Public key cryptography (as used in Bitcoin), allows you to hand people a public key and use the corresponding private key to prove the ...


23

The theory It is assumed that in order to forge an ECDSA signature you need to compute the private key for a given public key first (this operation is known as the "discrete logarithm" (DL), and its hardness is the basis for ECDSA's security). In order to do so, you must actually have the public key. Once you have the public key, it is assumed that ...


19

Yes, you could send bitcoins directly to the public key: in fact, both Pay-to-PubKey (P2PK) and Pay-to-PubKey-Hash (P2PKH) were introduced in the first Bitcoin release. IIRC, P2PK is still used for Coinbase transactions sometimes, today. P2PK transactions are slightly bigger for outputs but significantly smaller for inputs. One advantage of P2PKH is that ...


19

Yes, this is possible. However, I want to upfront state that this is not advisable for multiple reasons: Bitcoin keys are intended to be single use for privacy reasons, and leveraging them for encryption unnecessarily encourages treating them as a long-lived identity. There may be ugly and dangerous interactions when keys are used for multiple protocols ...


13

There are three main types of wallets: non-deterministic (random) wallets sequential deterministic wallets hierarchical deterministic wallets With a non-deterministic (random) wallet, all the private/public keypairs are generated randomly. The wallet may generate 100 random private keys as soon as it is initialized, for example. With a sequential ...


13

When I read pyramids' answer, I was very skeptical. It didn't really seem right to me that addresses generated from a hash (in this case from a public key) would have anything but a random distribution. To test out the distribution of addresses, I downloaded the dataset linked to in this forum thread and counted up how many times addresses appeared. There ...


13

As @Murch correctly pointed out it is indeed possible to send bitcoin to either a public key or to the hash of a public key. The original motivation for using hashes of public keys was to shorten the size of the address. Public keys in their uncompressed form are 64 bytes long whereas RIPE-MD outputs 20 bytes (+5 bytes of checksum and version). ...


13

DER The Distinguished Encoding Rules (DER) format is used to encode ECDSA signatures in Bitcoin. An ECDSA signature is generated using a private key and a hash of the signed message. It consists of two 32-byte numbers (r,s). As described by Pieter here the DER signature format has the following components: 0x30 byte: header byte to indicate compound ...


12

the output address is derived solely from the output script starting from step 4 in the wiki like so: first add leading zeros: 0012ab8dc588ca9d5787dde7eb29569da63c3a238c then hash with sha256 (if you look in the wiki this is actually part of the OP_HASH160 operation) to give: e158c4be10913422dadcf1c36843020ebb3ffe9d0cb13fb9e8c0a564a53c7832 then hashed ...


12

Yes, all three assumptions are correct. You can with some effort keep your private keys offline for their entire life. A description of how to sign transactions offline is found here: How to sign a transaction using only an offline computer? Adding a bit of detail on Assumption 3 along the lines of Tim S.'s comment: A computer that is offline would ...


11

To be honest, it IS possible, but you need a signature made by that address. From that point, you can get the public key. See this piece of code: https://github.com/bitcoinjs/bitcoinjs-message/blob/master/index.js#L57


11

It is impossible. Given an ECDSA (compressed 65Bytes or not 33Bytes) public-key K, a Bitcoin address is generated using the cryptographic hash functions SHA-256 and RIPEMD-160. The public-key is hashed twice: HASH160 = RIPEMD-160(SHA-256(K)). The Bitcoin address is computed directly from this HASH160 value as base58(0x00 || HASH160 || bSHA-256(SHA-256(0x00 ...


11

You can't get a database of all such public keys, but you can get some of them. An address, as you know, is a hash of a public key. When somebody sends coins to an address, you can think of the associated public key as having a positive balance, but nobody else necessarily knows what the public key actually is. (You can't compute the public key directly ...


11

No, there is not one private key. There is one Master private key. The master private key is then used to generate more private keys in a deterministic fashion, i.e. using the same master private key, you will generate the same private keys. Those private keys are what are actually used in your wallet. Their public keys are generated and the addressees ...


10

Bitcoin private keys are most commonly displayed in wallet import format (WIF), also known as base58check (a number expressed in base 58 with a checksum at the end and a version byte at the beginning). To create a WIF private key, you need to: Generate an ECDSA secret exponent (the private key) using the SECP256k1 curve. Convert the secret exponent/private ...


10

There's two types of wallet. A conventional wallet is just a collection of random keys, Bitcoin-QT and Multibit fit into this category. A Hierarchical Deterministic like Electrum or Armory generate all the keys in the wallet from a single key, so that one backup is permanently associated with a wallet no mater how many new addresses and change addresses are ...


10

There is no such thing as a negative or a positive value when you're talking in a finite field. For example, in Z7, the field of integers modulo 7. There holds: 0 = 7 = 14 = -7 1 = 8 = 15 = -6 2 = 9 = 16 = -5 ... So you can't say that the number 2 is positive, because it's equal to -5. Despite that, the square root still has two solutions. For example, 3^...


10

Edit: Answer to the question: How to get private keys out of Bitcoin Core After you found your addresses (by using the commands I listed below, for example) you can execute the folllowing command: dumpprivatekey 1ofYourAddresses If your wallet is password protected and locked run: walletpassphrase "your password or passphrase" 600 And 'walletlock' when ...


10

With "Master public key" you probably refer to deterministic key derivation after bip32. The correct term is "Master extended private key" (acronym xpriv) and "Master extended public key" (acronym xpub). The acronyms are "xpriv" and "xpub" because the base58 check prefix results in those 4 characters for a mainnet extended pub/priv key. The difference ...


9

I had the same question as well and spent forever trying to understand it and finally cracked it. "The sender (A) only has the Bitcoin Address of the recipient (B), so how does he get the pubKeyHash from his Bitcoin Address?" The key is that sender (A) doesn't need to get the pubKeyHash from "his" Bitcoin Address because it's not relevant. (I also wondered ...


9

Addresses are really just shorthands for particular scripts. The standard address type (starting with a '1' on mainnet) does in fact correspond to the exact type of script you gave above. If you base58 decode such an address, you end up with a byte string of the form 0x00 + [20-byte hash] + [4-byte checksum]. The corresponding script is OP_DUP OP_HASH160 [...


9

You cannot compute the public key of an address (that is not yours), because the address is computed from the hash of the public key. You can find the public key of your own address with the Bitcoin-QT debug window or with a validateaddress RPC call.


9

When you create a private key, this process is (or at least should be) completely random - meaning that in theory, the probability of creating some specific private key is 1/N where N is the number of possible private keys. There's nothing stopping someone from creating an already created private key, except chance. A private key is made up of 256 ...


9

The extended public key contains just a bit more information than the public key and chaincode, but the public key and chaincode are all that matter for key derivation. The rest is just metadata about the keys for wallets and people. The version bytes distinguish between xpub, xpriv, and other types of keys. The fingerprint identifies the parent so that a ...


9

Points are decompressed by solving for y in the equation used for secp256k1's elliptic curve where x is the last 32 bytes of your public key. The equation is y^2 = x^3 + 7. You will get 2 possible y values, one even and one odd. The correct one is indicated by the prefix byte of your public key which indicates whether y is even or odd. Note that all ...


8

The ECDSA signature algorithm used by Bitcoin doesn't have symmetry between its private and public keys. If you read about how the algorithm works, they aren't even the same type of mathematical object: a private key is an integer, while a public key is a point on an elliptic curve. They do not, in your words, "perform the same task." So you can't do that....


8

If you are posting different questions I suggest, posting them up in different threads. But I'll try to answer all of them. 1) It doesn't work like that. Every address is a pair (private key, public key), the address is made after hashing the public key twice. So, each address has one private key and private keys are not shared. So if in one address you ...


Only top voted, non community-wiki answers of a minimum length are eligible