<p>Bitcoin addresses, and the public key by extension, should ideally only ever be used once. So your time of exposure of the public key in P2PKH  is the time between when the spend is made and when it confirms. For P2PK the public key is always known to everybody. There's a considerable difference between the two.</p>

CC BY-SA 4.0
2021-01-18T23:36:23.560Z
Gotcha, so the recipient of any transaction has to convey their public key to the payer before every transaction? Seems like a hassle if there are a lot of small transactions between them...
yoyobigmanyo
CC BY-SA 4.0
2021-01-18T23:42:15.660Z
Their address, yes, not the public key.
Claris
CC BY-SA 4.0
2021-01-19T01:37:22.917Z
I think this advantage of keeping the pubkey secret is very marginal at best, and more commonly an illusion. Pretty much anything interesting beyond simple payments (multisig, Lightning, ...) involves sharing your public keys with not entirely trusted parties. Bitcoin's security relies on ECDSA being unbreakable even when public keys are revealed; as far as I'm concerned the "pubkeys are only briefly exposed is an advantage" is cargo cult.
Pieter Wuille
CC BY-SA 4.0
2021-01-19T01:38:35.753Z
I don’t disagree. It’s a nice incidental property of addresses not being reused at best, rather than something to be desired specifically.
Claris
CC BY-SA 4.0
2021-01-19T04:25:13.280Z
Right; of course keeping the public key hidden for longer is never a loss, and there are potentially some cases where it may provide some small benefit. The extent to which it's talked about in some places makes it sound like a much bigger deal than it is, though.
Pieter Wuille
CC BY-SA 4.0
2021-01-18T22:49:53.277Z
2021-01-18T22:49:53.277Z
Claris
<p>I just got into learning Bitcoin programming through Jimmy Song's <em>Programming Bitcoin</em>.
Jimmy says that some of p2pkh's advantages over p2pk include:</p>
<ol>
<li><p>a smaller ScriptPubKey</p>
</li>
<li><p>keeping one's public key private</p>
</li>
</ol>
<p>I completely agree with the first advantage but I'm having a little trouble with the second advantage.</p>
<p>Jimmy explains that, if ECDSA was every broken, one could steal bitcoin from another entity because they could find their public key in the ScriptPubKey (if they were using p2pk) and create a valid signature.</p>
<p>My question is: If all we are doing is moving the public key from the ScriptPubKey to the ScriptSig, what security does that grant us if the ScriptSig is also accessible? If I was to spend a UTXO that was made to my public key hash, my public key would be public. Couldn't a malicious user who had broken ECDSA keep looking for a UTXO ScriptPubKey with my hash in it, copy my public key from the previous transaction, generate a signature, and steal my bitcoin? It seems to me that my public key is private as long as I don't spend anything.</p>
<p>Of course, I know I'm missing something :) Any help is appreciated.</p>

CC BY-SA 4.0
2021-01-18T22:49:00.487Z
You are right, the public key is only revealed after you spend from the address, before that only the hash of the public key is visible. This is one of the reasons why you should not reuse the same address, just generate a new address every time you want to receive coins and send your change to a new address every time.
Mike D
<security><ecdsa><p2pkh><p2pk><programming-bitcoin-book>
p2pkh vs. p2pk keeping public key private
yoyobigmanyo
# p2pkh vs. p2pk keeping public key private

(Asked by: username_0 on 2021-01-18)

I just got into learning Bitcoin programming through Jimmy Song's *Programming Bitcoin*.
Jimmy says that some of p2pkh's advantages over p2pk include:

1. a smaller ScriptPubKey
2. keeping one's public key private

I completely agree with the first advantage but I'm having a little trouble with the second advantage.

Jimmy explains that, if ECDSA was every broken, one could steal bitcoin from another entity because they could find their public key in the ScriptPubKey (if they were using p2pk) and create a valid signature.

My question is: If all we are doing is moving the public key from the ScriptPubKey to the ScriptSig, what security does that grant us if the ScriptSig is also accessible? If I was to spend a UTXO that was made to my public key hash, my public key would be public. Couldn't a malicious user who had broken ECDSA keep looking for a UTXO ScriptPubKey with my hash in it, copy my public key from the previous transaction, generate a signature, and steal my bitcoin? It seems to me that my public key is private as long as I don't spend anything.

Of course, I know I'm missing something :) Any help is appreciated.

**Tags:** security, ecdsa, p2pkh, p2pk, programming-bitcoin-book

> **Comments:**
> **username_1**: You are right, the public key is only revealed after you spend from the address, before that only the hash of the public key is visible. This is one of the reasons why you should not reuse the same address, just generate a new address every time you want to receive coins and send your change to a new address every time.  

---

## 1 answers

### Answer by username_2 on 2021-01-18. Score: 4 | Accepted answer

Bitcoin addresses, and the public key by extension, should ideally only ever be used once. So your time of exposure of the public key in P2PKH is the time between when the spend is made and when it confirms. For P2PK the public key is always known to everybody. There's a considerable difference between the two.

> **Comments:**
> **username_0**: Gotcha, so the recipient of any transaction has to convey their public key to the payer before every transaction? Seems like a hassle if there are a lot of small transactions between them...  
> **username_2**: Their address, yes, not the public key.  
> **username_3**: I think this advantage of keeping the pubkey secret is very marginal at best, and more commonly an illusion. Pretty much anything interesting beyond simple payments (multisig, Lightning, ...) involves sharing your public keys with not entirely trusted parties. Bitcoin's security relies on ECDSA being unbreakable even when public keys are revealed; as far as I'm concerned the "pubkeys are only briefly exposed is an advantage" is cargo cult.  
> **username_2**: I don’t disagree. It’s a nice incidental property of addresses not being reused at best, rather than something to be desired specifically.  
> **username_3**: Right; of course keeping the public key hidden for longer is never a loss, and there are potentially some cases where it may provide some small benefit. The extent to which it's talked about in some places makes it sound like a much bigger deal than it is, though.  

---

