<p>Both are valid and accepted as canonical. They are NOT interchangeable however - the same public key in compressed form is hashed to a different address than that in uncompressed form. You can only use compressed form if the unspent output address is compressed.</p>

CC BY-SA 3.0
2014-02-24T02:24:33.197Z
2014-02-24T02:24:33.197Z
uminatsu
<p>One isn't canonical over the other but if you are creating new keys there is no reason to use anything but compressed keys.  So you could say uncompressed keys are deprecated for new key creation.   If you are writing wallet software or other tools it would be good practice to always create compressed keys by default.  Uncompressed keys have no advantages and they make each input in a transaction 32 bytes larger.</p>

<p>Now for transactions involving existing keys you must use the form which hashes to the PubKeyHash provided in the PkScript (output script).</p>

<p>This private key:</p>

<pre><code>72F3F4D20089ACFF5406AE394D575466FA97790CB27BDCEC08B288C44C924622
</code></pre>

<p>has a public key in both of the following forms</p>

<pre><code>04C02D446392E6FF2A5A80256C41F00251F22E5657A9C9889596DD44501F335F73B8CE4F74EF058871FDA861A3C642600743F5D5CA83660656AF296B66A49BD68A

02C02D446392E6FF2A5A80256C41F00251F22E5657A9C9889596DD44501F335F73
</code></pre>

<p>they however hash to different PubKeyHashes</p>

<pre><code>3294837233cf5e8b458fad15b7581e0dd5027ace (for uncompressed key)
fe9a562ce1129ecf42ec1e65cf4872049280082d (for compressed key)
</code></pre>

<p>So if you are trying to spend an P2PkH output which is locked to the PubKeyHash 3294837233cf5e8b458fad15b7581e0dd5027ace the ScriptSig in the input must be created using the uncompressed key.  The scripting langugage will not check both forms.  It just directly hashes the pubkey provided and verifies that it matches the pubkeyhash in the output.  Remember an address is the pubkeyhash encoded in base58 so the output form is going to depend on which address you provide the sender.  </p>

CC BY-SA 3.0
2015-02-22T18:02:25.670Z
2015-02-22T18:02:25.670Z
DeathAndTaxes
<p>In the standard pay-to-pubKeyHash scriptSig, which form of the public key should be used. My understanding is that both the compressed (33 bytes) and the expanded (64 bytes) are both valid. </p>

<p>Is there any of these two that is considered "standard"? Will the reference implementation propagate transactions containing either form, or will it withhold one?</p>

<p>IMO, I should use the compressed version since it will result in smaller transactions.</p>

<public-key><ecdsa>
In ScriptSig, which form of the public key is considered canonical?
LordOfThePigs
# In ScriptSig, which form of the public key is considered canonical?

(Asked by: username_0 on 2014-02-23)

In the standard pay-to-pubKeyHash scriptSig, which form of the public key should be used. My understanding is that both the compressed (33 bytes) and the expanded (64 bytes) are both valid.

Is there any of these two that is considered "standard"? Will the reference implementation propagate transactions containing either form, or will it withhold one?

IMO, I should use the compressed version since it will result in smaller transactions.

**Tags:** public-key, ecdsa


---

## 2 answers

### Answer by username_1 on 2014-02-24. Score: 1 | Accepted answer

Both are valid and accepted as canonical. They are NOT interchangeable however - the same public key in compressed form is hashed to a different address than that in uncompressed form. You can only use compressed form if the unspent output address is compressed.


---

### Answer by username_2 on 2015-02-22. Score: 1

One isn't canonical over the other but if you are creating new keys there is no reason to use anything but compressed keys. So you could say uncompressed keys are deprecated for new key creation. If you are writing wallet software or other tools it would be good practice to always create compressed keys by default. Uncompressed keys have no advantages and they make each input in a transaction 32 bytes larger.

Now for transactions involving existing keys you must use the form which hashes to the PubKeyHash provided in the PkScript (output script).

This private key:

```
72F3F4D20089ACFF5406AE394D575466FA97790CB27BDCEC08B288C44C924622

```

has a public key in both of the following forms

```
04C02D446392E6FF2A5A80256C41F00251F22E5657A9C9889596DD44501F335F73B8CE4F74EF058871FDA861A3C642600743F5D5CA83660656AF296B66A49BD68A

02C02D446392E6FF2A5A80256C41F00251F22E5657A9C9889596DD44501F335F73

```

they however hash to different PubKeyHashes

```
3294837233cf5e8b458fad15b7581e0dd5027ace (for uncompressed key)
fe9a562ce1129ecf42ec1e65cf4872049280082d (for compressed key)

```

So if you are trying to spend an P2PkH output which is locked to the PubKeyHash 3294837233cf5e8b458fad15b7581e0dd5027ace the ScriptSig in the input must be created using the uncompressed key. The scripting langugage will not check both forms. It just directly hashes the pubkey provided and verifies that it matches the pubkeyhash in the output. Remember an address is the pubkeyhash encoded in base58 so the output form is going to depend on which address you provide the sender.


---

