<p>It is as you suspect: You can <a href="https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm#Public_key_recovery" rel="nofollow noreferrer">recover the public key</a> knowing only the signature and the message. The recovery id byte in the signature is not strictly necessary as there's a brute force option, but it is included for efficiency.</p>

<p>There's an implementation of public key recovery in bitcoin core's <a href="https://github.com/bitcoin-core/secp256k1/blob/master/src/modules/recovery/main_impl.h" rel="nofollow noreferrer">secp256k1</a> library.</p>

CC BY-SA 4.0
2020-05-28T05:15:31.127Z
2020-05-28T05:15:31.127Z
Mark H
<p><a href="https://github.com/lightningnetwork/lightning-rfc/blob/master/11-payment-encoding.md" rel="nofollow noreferrer">Bolt #11</a> defines a "tagged field," n, which identifies the payee by a public key, but it isn't required.  It also requires a signature which can be verified only if the public key is known.  When tagged field n is not included, something called "signature recovery" is required.  How does that work?</p>

<p>I ask because I was thinking that if I get two invoices, I should be able to determine if they indicate the same payee.  I thought tagged field 'n' would be great for this, but it might not be supplied.  So how can I compare the two invoices to see if they came from the same node?  If signature recovery is built in, I guess that means I can get the public key even if tagged field 'n' is missing.  But how would I do that?</p>

<lightning-network><public-key><signature><invoices>
What is "signature recovery"?
Dave Scotese
# What is "signature recovery"?

(Asked by: username_0 on 2020-05-28)

[Bolt #11](https://github.com/lightningnetwork/lightning-rfc/blob/master/11-payment-encoding.md) defines a "tagged field," n, which identifies the payee by a public key, but it isn't required. It also requires a signature which can be verified only if the public key is known. When tagged field n is not included, something called "signature recovery" is required. How does that work?

I ask because I was thinking that if I get two invoices, I should be able to determine if they indicate the same payee. I thought tagged field 'n' would be great for this, but it might not be supplied. So how can I compare the two invoices to see if they came from the same node? If signature recovery is built in, I guess that means I can get the public key even if tagged field 'n' is missing. But how would I do that?

**Tags:** lightning-network, public-key, signature, invoices


---

## 1 answers

### Answer by username_1 on 2020-05-28. Score: 2

It is as you suspect: You can [recover the public key](https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm#Public_key_recovery) knowing only the signature and the message. The recovery id byte in the signature is not strictly necessary as there's a brute force option, but it is included for efficiency.

There's an implementation of public key recovery in bitcoin core's [secp256k1](https://github.com/bitcoin-core/secp256k1/blob/master/src/modules/recovery/main_impl.h) library.


---

