<p>You must reveal the secret in order to spend the output, else there is no way other users could verify that your hash is indeed the correct one. Once you reveal that secret, anybody could attempt to create a competing transaction which spends to a different output - miners in particular would be able to confirm this transaction into a block and ignore your own.</p>
<p>The purpose of using ECDSA is so that a transaction which spends some output is <em>signed</em> by the private key corresponding to a public key, but without ever needing to reveal the private key. Nobody can attempt to create a competing transaction to spend this because they require the private key to do so. You cannot create a digital signature with only knowledge of the public key, but you can verify that the signature is correct using only the transaction and the public key.</p>

CC BY-SA 4.0
2020-12-20T08:01:48.930Z
2020-12-20T08:01:48.930Z
Mark H
<p>For example, let’s say I pick a random secret and hash it. Now, in the hypothetical hash-based scheme, my hash effectively replaces my public-key hash, and my random secret effectively replaces my private key. As far as I can tell, the only additional benefit of ECDSA is authentication of some identity. Is identity authentication really something Bitcoin needs to care about?</p>

<transactions><signature>
Why does Bitcoin use ECDSA, instead of plain old hashing, to secure transaction outputs?
divaconhamdip
# Why does Bitcoin use ECDSA, instead of plain old hashing, to secure transaction outputs?

(Asked by: username_0 on 2020-12-20)

For example, let’s say I pick a random secret and hash it. Now, in the hypothetical hash-based scheme, my hash effectively replaces my public-key hash, and my random secret effectively replaces my private key. As far as I can tell, the only additional benefit of ECDSA is authentication of some identity. Is identity authentication really something Bitcoin needs to care about?

**Tags:** transactions, signature


---

## 1 answers

### Answer by username_1 on 2020-12-20. Score: 9 | Accepted answer

You must reveal the secret in order to spend the output, else there is no way other users could verify that your hash is indeed the correct one. Once you reveal that secret, anybody could attempt to create a competing transaction which spends to a different output - miners in particular would be able to confirm this transaction into a block and ignore your own.

The purpose of using ECDSA is so that a transaction which spends some output is *signed* by the private key corresponding to a public key, but without ever needing to reveal the private key. Nobody can attempt to create a competing transaction to spend this because they require the private key to do so. You cannot create a digital signature with only knowledge of the public key, but you can verify that the signature is correct using only the transaction and the public key.


---

