<p>The signatures produced in this process include more metadata than usual to assist in public key recovery. It includes recovery flags (an 8-bit integer), which encodes whether the public key was compressed, and a specific recovery ID. </p>

<p>As the Secg PDF <a href="http://www.secg.org/sec1-v2.pdf" rel="nofollow">http://www.secg.org/sec1-v2.pdf</a> points out (page 47) - given (r, s) you can recover a set of probable public keys. The recovery ID makes this an explicit derivation of the correct public key. </p>

<p>Including whether the public key is compressed is also important. Bitcoin signatures are verified by an address, not a public key!</p>

<p>Your signature looks like this: [32 bytes of r] [32 bytes of s] [recoveryFlags], and is usually base64 encoded. </p>

<p>Given one of these signatures, and a bitcoin address, the verification works as follows:</p>

<ul>
<li>generating the public key</li>
<li>encoding it correctly (compression)</li>
<li>hashing the result </li>
<li>compare the hash against the hash extracted from the supplied bitcoin address.</li>
</ul>

CC BY-SA 3.0
2015-04-13T21:28:02.947Z
2015-04-13T21:28:02.947Z
karimkorun
<p>The ECDSA public key can be recovered from the signature.</p>

<p>See <a href="https://bitcointalk.org/index.php?topic=6430.0">this bitcointalk thread</a> and the linked pdf for details.</p>

CC BY-SA 3.0
2013-05-10T06:36:52.720Z
2013-05-10T06:36:52.720Z
jarpiain
<p><code>bitcoin-qt</code> has a "signature verification" feature where you can verify a signed message.  All it needs is the bitcoin address of the signer, the message and a short signature.  From what I understand about digital signatures, you would need the public key in order to verify a signature.  A bitcoin address is just a <em>hash</em> of the public key.  The public key <em>may</em> be in the blockchain but that would only be the case if the address had already claimed at least one output.  If they haven't claimed any outputs, how can the signature be verified?</p>

CC BY-SA 3.0
2013-05-10T21:23:21.567Z
possible duplicate of [How are public & private keys in an address created?](http://bitcoin.stackexchange.com/questions/1389/how-are-public-private-keys-in-an-address-created)
Stephen Gornick
CC BY-SA 3.0
2017-03-06T00:54:11.880Z
http://crypto.stackexchange.com/a/18106/7243 provides a better answer than what's given here.
greatwolf
<bitcoin-core><message-signing>
How does the signature verification feature in bitcoin-qt work without a public key?
RentFree
# How does the signature verification feature in bitcoin-qt work without a public key?

(Asked by: username_0 on 2013-05-10)

`bitcoin-qt` has a "signature verification" feature where you can verify a signed message. All it needs is the bitcoin address of the signer, the message and a short signature. From what I understand about digital signatures, you would need the public key in order to verify a signature. A bitcoin address is just a *hash* of the public key. The public key *may* be in the blockchain but that would only be the case if the address had already claimed at least one output. If they haven't claimed any outputs, how can the signature be verified?

**Tags:** bitcoin-core, message-signing

> **Comments:**
> **username_1**: possible duplicate of [How are public & private keys in an address created?](http://bitcoin.stackexchange.com/questions/1389/how-are-public-private-keys-in-an-address-created)  
> **username_2**: http://crypto.stackexchange.com/a/18106/7243 provides a better answer than what's given here.  

---

## 2 answers

### Answer by username_4 on 2013-05-10. Score: 7 | Accepted answer

The ECDSA public key can be recovered from the signature.

See [this bitcointalk thread](https://bitcointalk.org/index.php?topic=6430.0) and the linked pdf for details.


---

### Answer by username_3 on 2015-04-13. Score: 0

The signatures produced in this process include more metadata than usual to assist in public key recovery. It includes recovery flags (an 8-bit integer), which encodes whether the public key was compressed, and a specific recovery ID.

As the Secg PDF <http://www.secg.org/sec1-v2.pdf> points out (page 47) - given (r, s) you can recover a set of probable public keys. The recovery ID makes this an explicit derivation of the correct public key.

Including whether the public key is compressed is also important. Bitcoin signatures are verified by an address, not a public key!

Your signature looks like this: [32 bytes of r] [32 bytes of s] [recoveryFlags], and is usually base64 encoded.

Given one of these signatures, and a bitcoin address, the verification works as follows:

* generating the public key
* encoding it correctly (compression)
* hashing the result
* compare the hash against the hash extracted from the supplied bitcoin address.


---

