<p>It's possible, but:</p>

<ol>
<li>It's much slower</li>
<li>Pubkey recovery for this kind of application is arguably patented</li>
</ol>

<p>For a "signature only" scriptpubkey, we already have <code>p2pk</code>.  Hopefully in the future, segwit programs will have bare pubkeys in the scriptpubkey, allowing for similar (and more advanced) constructions.</p>

CC BY-SA 4.0
2018-12-05T05:08:51.520Z
+1 This might provide an explanation of how: https://crypto.stackexchange.com/questions/18105/how-does-recovering-the-public-key-from-an-ecdsa-signature-work
JBaczuk
CC BY-SA 4.0
2018-12-05T05:06:52.780Z
2018-12-05T05:06:52.780Z
arubi
<p><strong>Correction</strong>: There is a way to extract the public key from the signature + message</p>

<p>In order to verify a signature using <a href="https://en.wikipedia.org/wiki/Elliptic_Curve_DSA" rel="nofollow noreferrer">ECDSA</a>, you must provide both the signature and the public key, or you have no key to verify against. It is not possible to extract the public key from the signature.</p>

<p>The reason for this requires an understanding of how the ECDSA algorithm works, so I'd suggest the link above for a mathematical explanation.</p>

CC BY-SA 4.0
2018-12-05T05:01:35.290Z
>> It is not possible to extract the public key from the signature  .


It is possible to extract a pubkey from a signature + message pair
arubi
CC BY-SA 4.0
2018-12-05T05:04:14.930Z
I am unaware of that can you provide more info? Why doesn't Bitcoin do this?
JBaczuk
CC BY-SA 4.0
2018-12-05T05:04:57.077Z
My understanding is an ECDSA signature actually contains the public key, there is just no opcode in Bitcoin Script for extracting it. For instance, it is possible in Ethereum using ecrecover to fetch a public key that signs a message. It is then on you to verify that the public key that signed the message matches who you expected
Earlz
CC BY-SA 4.0
2018-12-05T05:09:38.090Z
A signature doesn't contain the pubkey, but for any signature and message pair it is possible to recover at least two pubkeys which will "verify" the message.

If the message contains the hash of the pubkey, then it's possible to "backtrack" validation for the message this way.
arubi
CC BY-SA 4.0
2018-12-05T05:09:44.543Z
Yes, this is possible; it is called ECDSA pubkey recovery. @Earlz It isn't the case that the signature 'contains' the public key. Rather, given a message and a signature, it is possible to compute the public key(s) for which that msg/sig pair would be valid. That computation is slower than verifying the signature outright though.
Pieter Wuille
CC BY-SA 4.0
2018-12-05T05:11:47.523Z
Signature verification is one of the main computational bottlenecks with newly syncing nodes so it would slow that process down. Cool learned something new today :)
JBaczuk
CC BY-SA 4.0
2018-12-05T05:25:52.763Z
It's only slightly slower (around 5%), but the reason it isn't really considered for improvements to Bitcoin is because it is inherently incompatible with batch validation or signature aggregation (which give much bigger savings).
Pieter Wuille
CC BY-SA 4.0
2018-12-05T05:31:45.450Z
Interesting! Sounds like your answer @Earlz
JBaczuk
CC BY-SA 4.0
2018-12-05T05:01:10.297Z
2018-12-05T05:08:20.770Z
2018-12-05T05:08:20.770Z
JBaczuk
<p>When signing a pubkeyhash UTXO, it is required to provide both a signature and a public key. The public key is duplicated and one copy is provided to <code>op_checksigverify</code> to ensure the signature is valid, and the other copy is hashed to ensure it matches the pubkeyhash. </p>

<p>In theory, is it possible to build an opcode like <code>op_checksigverify_pushkey</code> that takes only the signature of the transaction and extracts the public key from the signature? With this it would be possible to only specify the signature and no need to provide the public key. The public key of course could be arbitrary, but would fail when hashed and compared against the vout pubkeyhash. </p>

<script><cryptography>
In theory could a pubkeyhash script be solved without the public key in the scriptSig?
Earlz
# In theory could a pubkeyhash script be solved without the public key in the scriptSig?

(Asked by: username_0 on 2018-12-05)

When signing a pubkeyhash UTXO, it is required to provide both a signature and a public key. The public key is duplicated and one copy is provided to `op_checksigverify` to ensure the signature is valid, and the other copy is hashed to ensure it matches the pubkeyhash.

In theory, is it possible to build an opcode like `op_checksigverify_pushkey` that takes only the signature of the transaction and extracts the public key from the signature? With this it would be possible to only specify the signature and no need to provide the public key. The public key of course could be arbitrary, but would fail when hashed and compared against the vout pubkeyhash.

**Tags:** script, cryptography


---

## 2 answers

### Answer by username_1 on 2018-12-05. Score: 2

It's possible, but:

1. It's much slower
2. Pubkey recovery for this kind of application is arguably patented

For a "signature only" scriptpubkey, we already have `p2pk`. Hopefully in the future, segwit programs will have bare pubkeys in the scriptpubkey, allowing for similar (and more advanced) constructions.

> **Comments:**
> **username_2**: +1 This might provide an explanation of how: https://crypto.stackexchange.com/questions/18105/how-does-recovering-the-public-key-from-an-ecdsa-signature-work  

---

### Answer by username_2 on 2018-12-05. Score: 0

**Correction**: There is a way to extract the public key from the signature + message

In order to verify a signature using [ECDSA](https://en.wikipedia.org/wiki/Elliptic_Curve_DSA), you must provide both the signature and the public key, or you have no key to verify against. It is not possible to extract the public key from the signature.

The reason for this requires an understanding of how the ECDSA algorithm works, so I'd suggest the link above for a mathematical explanation.

> **Comments:**
> **username_1**: >> It is not possible to extract the public key from the signature  .   It is possible to extract a pubkey from a signature + message pair  
> **username_2**: I am unaware of that can you provide more info? Why doesn't Bitcoin do this?  
> **username_0**: My understanding is an ECDSA signature actually contains the public key, there is just no opcode in Bitcoin Script for extracting it. For instance, it is possible in Ethereum using ecrecover to fetch a public key that signs a message. It is then on you to verify that the public key that signed the message matches who you expected  
> **username_1**: A signature doesn't contain the pubkey, but for any signature and message pair it is possible to recover at least two pubkeys which will "verify" the message.  If the message contains the hash of the pubkey, then it's possible to "backtrack" validation for the message this way.  
> **username_3**: Yes, this is possible; it is called ECDSA pubkey recovery. @username_0 It isn't the case that the signature 'contains' the public key. Rather, given a message and a signature, it is possible to compute the public key(s) for which that msg/sig pair would be valid. That computation is slower than verifying the signature outright though.  
> **username_2**: Signature verification is one of the main computational bottlenecks with newly syncing nodes so it would slow that process down. Cool learned something new today :)  
> **username_3**: It's only slightly slower (around 5%), but the reason it isn't really considered for improvements to Bitcoin is because it is inherently incompatible with batch validation or signature aggregation (which give much bigger savings).  
> **username_2**: Interesting! Sounds like your answer @username_0  

---

