<p>The potential security issue is that an an EC <em>public</em> key might one day be reversible into a <em>private</em> key using (for example) Shor's algorithm[1]. This does not apply to a <em>hash</em> of a public key (aka address).</p>

<p>Since the public key of a Bitcoin address is revealed in the first transaction spending from that address, it is therefore considered a bad practice to reuse that address (also for privacy reasons) </p>

<p>[1] See <a href="https://security.stackexchange.com/a/34942/16036">https://security.stackexchange.com/a/34942/16036</a></p>

CC BY-SA 4.0
2018-09-21T08:39:12.270Z
2018-09-21T08:39:12.270Z
Jonathan Cross
<p>If your PRNGs are good, you don't lose any security by using the same address any number of times. Some websites claim that addresses should not be reused because that will make your bitcoins vulnerable to quantum computers and/or some newly discovered weaknesses in ECDSA. However, both of these scenarios are unrealistic at the moment, and I think that if they <em>do</em> become realistic, this will be such a big problem for the world's cryptography that you won't be the first victim (unless you are Satoshi Nakamoto).</p>

CC BY-SA 3.0
2014-10-01T16:51:21.957Z
Yes, it seems it was probably some kind of quantum computing discussion. I think this image from Ken Sheriff's blog is very clear; the 512 bit public key is neither reversible for 512 public key ==> 256 bit private key nor the SHA256/RIPEM 160 ==> public key hash, with the latter being what I was questioning. https://lh4.googleusercontent.com/-p8yVJXqY7fg/UuLaPjMDtyI/AAAAAAAAWYQ/QoenRIBO1O4/s2048/bitcoinkeys.png
Wizard Of Ozzie
CC BY-SA 3.0
2014-10-01T14:03:40.217Z
2014-10-01T14:03:40.217Z
abacabadabacaba
<p>I've been playing around with Richard Kiss's Pycoin app which is clarifying how P2PK works. I see that the hash160 of the value: <code>(0x04) (x-coordinate) (y-coordinate)</code> (for an uncompressed Testnet private key in this instance) gives a hash160 value used to prove ownership of the private key.</p>

<p>How is this detrimental for reuse of private keys <em>if</em> there is no issue with PRNGs providing low entropy? I understand how the Android bug was exploited (to a degree, it reused "random values"), but I fail to understand why only sharing the hash160 in a single transaction can be maliciously exploited. To clarify, I'm not talking about privacy concerns of tracking addresses through the Blockchain.</p>

<p>EDIT: The vulnerabilities in question (as specified in the answer are related to quantum computing and/or EDCSA weaknesses, neither of which exist)</p>

CC BY-SA 3.0
2014-10-01T14:08:36.210Z
I'm confused as to what you are asking about.  Can you explain what "malicious exploit" you think might be possible, and how it would work?
Nate Eldredge
CC BY-SA 3.0
2014-10-01T16:04:49.053Z
I'll try to find the link. It was a /r/Bitcoin discussion where the argument was that the Hash160 was obfuscating users' public addresses and the fact that the hash160 is only shared once the txn is broadcast. But for the sake of this question, is there any vulnerability in reusing keys besides compromising economic anonymity?
Wizard Of Ozzie
<security><address><weaknesses><ripemd160>
How can address' hash160 be used to determine information for malicious purposes? (Ie reusing of the same address)
Wizard Of Ozzie
# How can address' hash160 be used to determine information for malicious purposes? (Ie reusing of the same address)

(Asked by: username_0 on 2014-10-01)

I've been playing around with Richard Kiss's Pycoin app which is clarifying how P2PK works. I see that the hash160 of the value: `(0x04) (x-coordinate) (y-coordinate)` (for an uncompressed Testnet private key in this instance) gives a hash160 value used to prove ownership of the private key.

How is this detrimental for reuse of private keys *if* there is no issue with PRNGs providing low entropy? I understand how the Android bug was exploited (to a degree, it reused "random values"), but I fail to understand why only sharing the hash160 in a single transaction can be maliciously exploited. To clarify, I'm not talking about privacy concerns of tracking addresses through the Blockchain.

EDIT: The vulnerabilities in question (as specified in the answer are related to quantum computing and/or EDCSA weaknesses, neither of which exist)

**Tags:** security, address, weaknesses, ripemd160

> **Comments:**
> **username_1**: I'm confused as to what you are asking about.  Can you explain what "malicious exploit" you think might be possible, and how it would work?  
> **username_0**: I'll try to find the link. It was a /r/Bitcoin discussion where the argument was that the Hash160 was obfuscating users' public addresses and the fact that the hash160 is only shared once the txn is broadcast. But for the sake of this question, is there any vulnerability in reusing keys besides compromising economic anonymity?  

---

## 2 answers

### Answer by username_2 on 2018-09-21. Score: 0 | Accepted answer

The potential security issue is that an an EC *public* key might one day be reversible into a *private* key using (for example) Shor's algorithm[1]. This does not apply to a *hash* of a public key (aka address).

Since the public key of a Bitcoin address is revealed in the first transaction spending from that address, it is therefore considered a bad practice to reuse that address (also for privacy reasons)

[1] See <https://security.stackexchange.com/a/34942/16036>


---

### Answer by username_3 on 2014-10-01. Score: 2

If your PRNGs are good, you don't lose any security by using the same address any number of times. Some websites claim that addresses should not be reused because that will make your bitcoins vulnerable to quantum computers and/or some newly discovered weaknesses in ECDSA. However, both of these scenarios are unrealistic at the moment, and I think that if they *do* become realistic, this will be such a big problem for the world's cryptography that you won't be the first victim (unless you are Satoshi Nakamoto).

> **Comments:**
> **username_0**: Yes, it seems it was probably some kind of quantum computing discussion. I think this image from Ken Sheriff's blog is very clear; the 512 bit public key is neither reversible for 512 public key ==> 256 bit private key nor the SHA256/RIPEM 160 ==> public key hash, with the latter being what I was questioning. https://lh4.googleusercontent.com/-p8yVJXqY7fg/UuLaPjMDtyI/AAAAAAAAWYQ/QoenRIBO1O4/s2048/bitcoinkeys.png  

---

