3

My first question is how to verify signature using only r,s and elliptic curve paramete, and an address (which is hashed of public key, so cannot retrieve public key from the address)?

Next question is that, why ethereum (also bitcoin I think) uses hashed public key as an address instead of directly use public key as an address?

Improve this question

3 Answers 3

Reset to default
2

Maybe this answer can help you - https://ethereum.stackexchange.com/a/33346/16729

Ethereum security model relies on elliptic curve cryptography (ECC) to sign and validate transactions. In ECC public and private key are used to sign and verify. It has no concept of addresses. When signing and verifying transactions you do not need addresses. The original bitcoin paper do not mention addresses at all. They appear later in an effort to make them easier to remember (compressed public key are 32 bytes vs address 20 bytes). Now you can completely hide public key from the user interaction and only have private key and addresses. But internaly ethereum keeps using them to validate transactions.

Improve this answer
5
  • But internally keeps using them to validates Tx...I still don't get it. Because the keystore folder (where is encrypted private key and public key is save as a file) only located in my node, not every node. But how to other node know my public key to validate my transaction?
    – Kronos
    Commented May 23, 2018 at 13:27
  • There is a challenge where it talks about addresses and accounts. I can´t read the thread yet because I didn´t finish the challenger and I don´t want to read spoilers. But I think it can be helpful to you. Here is the reddit: reddit.com/r/capturetheether
    – Luiz Soares
    Commented May 23, 2018 at 13:55
  • and here is the challenge: capturetheether.com/challenges/accounts/public-key
    – Luiz Soares
    Commented May 23, 2018 at 13:55
  • And I jiust found this:ethereum.stackexchange.com/questions/13778/…
    – Luiz Soares
    Commented May 23, 2018 at 14:02
  • @Kronos Ethereum uses a mathematical property to recover the public key from a signed transaction and then derives the address by applying the hash function keccak256 (search ECDSA public key recover for the mathematical details).
    – Ismael ♦
    Commented May 24, 2018 at 0:50
2
  1. In security terms:

The public key in all of the cryptography schemes is related to the private key. The only secure measurement that prevents a user to calculate your private key from your public key is the assumption that the discrete logarithm is "impossible to solve"

We all know that quantum cryptography is aproaching more every day, and the problem that this introduces is that solving discrete logarithms is "easy" if you are running a quantum PC/CPU. So having the Pk, it'll be possible to get the Sk(Private key).

In order to anticipate to that, if you only have acces to the hash of the Pk, you don't know it, so even with quantum crypto (as far as now seems that quantum won't be able to pass hash functions that easily), you are secure.

More info about Hash functions resistance to quantum crypto here.

  1. In gas spending terms.

The length of a Public Key is so much bigger than it's hash which is always a 256 bit variable. So if you count all the transactions that are done on a day, you are saving a lot of gas on transactions because the public keys will make the miners and the nodes process/store much more data because they are so much bigger than it's hashes.

I can expand more the explanation if you need it, but essencially, this is it.

EDIT AS you're asking for on the comments, here you have a topic on which is explained how to retrieve the Pk from it's hash.

Get public key of any ethereum account

Hope it helps.

Improve this answer
14
  • I am not asking how to retrieve private key from public key. I am asking how to verify signature without public key? Because miner only know its address not the public key. But the address is truncated by hash, so it is not possible to retrieve public key from an address.
    – Kronos
    Commented May 23, 2018 at 12:34
  • 2
    @Kronos You're right, you can't get a public key from an address. But you can get the public key from a transaction sent by that address. So in practice, it is only possible to get the public key of an address if that address has sent at least 1 transaction.
    – Jesbus
    Commented May 23, 2018 at 13:13
  • Do you know how to get the public key from a tx? Because I also checked trasaction value using eth.getTransaction, but I don't see any clue to retrieve a public from it.
    – Kronos
    Commented May 23, 2018 at 13:19
  • @JesseBusman is right, you retrive it from the tx details, look at them on the logs or on etherscan. One thing to add is that as your question is formulated, has no sense the comment you leaved. You asked why are the Pk's hashed, and this was the answer to that question.
    – CPereez19
    Commented May 23, 2018 at 13:56
  • @CPereez19 What does Pk and Sk in your explaination stand for? As both "public key" as well as "private key" would abbreviate to "PK" or "pk" it's not so distinct to me.
    – TorstenS
    Commented May 23, 2018 at 15:22
2

I found myself how to recover public key from tx(signature, r and s) and its address.

First, here is how signature is generated, the public is B, and private key is d, where B = dA. (multiplication on elliptic curve). It is REALLY hard (or simple, because we don't know P=NP or not), so we cannot retrieve d from B and A.

enter image description here

And the public can be recovered as follow, and the number of public key candidates is two, because we only know x-coordinate of R. So it is easy to find a public key which public key is real one from the address.

enter image description here

proof is as follows,

enter image description here

please correct me if something is wrong. It seems that there is useful function in https://github.com/cryptocoinjs/secp256k1-node, .recover(Buffer message, Buffer signature, Number recovery [, Boolean compressed = true]) to recover public key.

Improve this answer
2
  • That's ECDSA based on the secp256k1 curve. You can only retrieve the info if you know the Cyclyc group generator period. Otherways nowadays it's impossible to get it. This is the same as saying on RSA that you can only get the message if you know the Sk. because discrete logarith is so hard to solve. Also, tell you that the Pk and Sk are points of the eliptic curve. From here is where pairings and other ZkSnarks main components are born. Here you have good lectures to learn about that.
    – CPereez19
    Commented May 25, 2018 at 9:38
  • @CPereez19 Thas right, I need to know which curve is used(all parameters I need to know) to recover the public key.
    – Kronos
    Commented May 25, 2018 at 20:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.