<blockquote>
<p>I was watching Andreas Antonopoulos talk about security on youtube. I heard him say something about using the same public address multiple times could increase risk of your private key being cracked since the private key signs the output id.</p>
</blockquote>
<p>I personally believe this is mostly a often-repeated belief that is taken out of context. In reality the only reason to not reuse keys is privacy.</p>
<p>While yes, it is true that technically speaking, one cannot start trying to crack the private key of a public key, as long as one only has a hash of that public key. That indeed means that for a P2PKH/P2SH/P2WPKH address, as long as it has never been spent from, there is a technical barrier that hurts potential attackers.</p>
<p>But this doesn't mean there is a <em>vulnerability</em> for keys which are known. The security assumption behind ECDSA <strong>is</strong> that one cannot compute private keys even if their public keys are revealed, and even if the attacker has access to a limitless amount of signatures created with that public key. Bitcoin's security <em>is utterly reliant</em> on the fact that keys cannot be cracked, and signatures cannot be forged, even in such settings. Furthermore, public keys <em>are</em> revealed, constantly. It is a false sense of security that not revealing public keys adds anything. I've written in more detail about that <a href="https://bitcoin.stackexchange.com/questions/95123/what-are-the-potential-attacks-against-ecdsa-that-would-be-possible-if-we-used-r/95133#95133">in this answer</a>.</p>
<p>The P2TR (taproot) output type introduced by BIP341 (which will likely activate on Bitcoin mainnet mid-november 2021) in fact does not use public key hashing at all anymore. Outputs store a public key directly.</p>
<blockquote>
<p>I'm wondering if this applies to HD Keys as well?</p>
<p>i.e. imagine I create an HD Private Key. And then for each transaction I derive a child from that key. Would these child keys also be vunerable?</p>
</blockquote>
<p>First of all: there is no vulnerability whatsoever, in either case. It is at best a question of secure under current assumptions vs. even more secure.</p>
<p>In the case of <em>separate</em> keys generated by the same xpub, there is an additional difficulty for the attacker: they cannot even tell which addresses were generated by the same address unless the attacker has the xpub. If they do, there is a <a href="https://eprint.iacr.org/2021/1287" rel="nofollow noreferrer">recent paper</a> that suggests the <em>provable</em> security may be somewhat reduced. Note that provable security does not translate to actual security; no attack is known that can break anything with less than 2<sup>128</sup> work, and it's unlikely such an attack can be found.</p>

CC BY-SA 4.0
2021-10-26T05:04:47.863Z
@peterwuille Thank you for the excellent in-depth answer Peter.
Trevor
CC BY-SA 4.0
2021-10-26T04:12:06.963Z
2021-10-26T04:12:06.963Z
Pieter Wuille
<p>I was watching Andreas Antonopoulos talk about security on youtube. I heard him say something about using the same public address multiple times could increase risk of your private key being cracked since the private key signs the output id.</p>
<p>I'm wondering if this applies to HD Keys as well?</p>
<p>i.e. imagine I create an HD Private Key. And then for each transaction I derive a child from that key. Would these child keys also be vunerable?</p>

CC BY-SA 4.0
2021-10-25T18:23:20.610Z
Does this answer your question? [Is it safe to reuse a Bitcoin address?](https://bitcoin.stackexchange.com/questions/20621/is-it-safe-to-reuse-a-bitcoin-address)
Pieter Wuille
CC BY-SA 4.0
2021-10-26T01:34:32.890Z
@PieterWuille Mostly. But I'm wondering if this applies to HD wallets as well? Since the Private keys are derived from an HD key, would it be possible to crack the hd key if many derived private keys sign transactions?
Trevor
<security><deterministic-wallets>
Reusing same address potential security vunerability?
Trevor
# Reusing same address potential security vunerability?

(Asked by: username_0 on 2021-10-25)

I was watching Andreas Antonopoulos talk about security on youtube. I heard him say something about using the same public address multiple times could increase risk of your private key being cracked since the private key signs the output id.

I'm wondering if this applies to HD Keys as well?

i.e. imagine I create an HD Private Key. And then for each transaction I derive a child from that key. Would these child keys also be vunerable?

**Tags:** security, deterministic-wallets

> **Comments:**
> **username_1**: Does this answer your question? [Is it safe to reuse a Bitcoin address?](https://bitcoin.stackexchange.com/questions/20621/is-it-safe-to-reuse-a-bitcoin-address)  
> **username_0**: @username_1 Mostly. But I'm wondering if this applies to HD wallets as well? Since the Private keys are derived from an HD key, would it be possible to crack the hd key if many derived private keys sign transactions?  

---

## 1 answers

### Answer by username_1 on 2021-10-26. Score: 1 | Accepted answer

> I was watching Andreas Antonopoulos talk about security on youtube. I heard him say something about using the same public address multiple times could increase risk of your private key being cracked since the private key signs the output id.

I personally believe this is mostly a often-repeated belief that is taken out of context. In reality the only reason to not reuse keys is privacy.

While yes, it is true that technically speaking, one cannot start trying to crack the private key of a public key, as long as one only has a hash of that public key. That indeed means that for a P2PKH/P2SH/P2WPKH address, as long as it has never been spent from, there is a technical barrier that hurts potential attackers.

But this doesn't mean there is a *vulnerability* for keys which are known. The security assumption behind ECDSA **is** that one cannot compute private keys even if their public keys are revealed, and even if the attacker has access to a limitless amount of signatures created with that public key. Bitcoin's security *is utterly reliant* on the fact that keys cannot be cracked, and signatures cannot be forged, even in such settings. Furthermore, public keys *are* revealed, constantly. It is a false sense of security that not revealing public keys adds anything. I've written in more detail about that [in this answer](https://bitcoin.stackexchange.com/questions/95123/what-are-the-potential-attacks-against-ecdsa-that-would-be-possible-if-we-used-r/95133#95133).

The P2TR (taproot) output type introduced by BIP341 (which will likely activate on Bitcoin mainnet mid-november 2021) in fact does not use public key hashing at all anymore. Outputs store a public key directly.

> I'm wondering if this applies to HD Keys as well?
>
> i.e. imagine I create an HD Private Key. And then for each transaction I derive a child from that key. Would these child keys also be vunerable?

First of all: there is no vulnerability whatsoever, in either case. It is at best a question of secure under current assumptions vs. even more secure.

In the case of *separate* keys generated by the same xpub, there is an additional difficulty for the attacker: they cannot even tell which addresses were generated by the same address unless the attacker has the xpub. If they do, there is a [recent paper](https://eprint.iacr.org/2021/1287) that suggests the *provable* security may be somewhat reduced. Note that provable security does not translate to actual security; no attack is known that can break anything with less than 2128 work, and it's unlikely such an attack can be found.

> **Comments:**
> **username_0**: @peterwuille Thank you for the excellent in-depth answer Peter.  

---

