<p>Public / Private key encryption requires that the private key is <em>never</em> revealed - the owner must keep it secret.</p>
<p>Message and transaction signing is done with the <em>private key</em> and verified with the associated public key. So <strong>the private key is never revealed to the blockchain</strong>. Note that <em>public key</em> here refers to the the full ECC public key, and not a Bitcoin address - which is a hashed and transformed representation of the public key. The public key can only be derived from a Bitcoin address if the SHA256 and ripeMD-160 hashing algorithms are ever broken. <a href="https://bitcoin.stackexchange.com/questions/7683/why-is-it-impossible-to-derive-public-key-from-address">This question</a> explores the challenge.</p>
<p><strike>To answer your question: Yes, each new signature produced by a private key may bring an attacker, who already knows the associated public key, closer to discovering the private key.</strike></p>
<p>Comments to this answer have informed an updated position:</p>
<p>Although there is no <a href="https://en.wikipedia.org/wiki/Provable_security" rel="nofollow noreferrer">provable security</a> for ECDSA, it is commonly assumed that, even with knowledge of multiple signatures produced by a particular key, an attacker will not have improved odds at deriving the associated private key or forging its signature.</p>
<p>It is an <a href="https://bitcoin.stackexchange.com/questions/111260/why-is-it-not-possible-to-get-the-private-key-out-of-the-public-key">almost impossible</a> task to discover a Bitcoin private key from its public key. An answer to <a href="https://bitcoin.stackexchange.com/questions/2847/how-long-would-it-take-a-large-computer-to-crack-a-private-key">this question</a> illustrates the challenge mathematically.</p>
<p>Some people advise an attitude of &quot;better safe than sorry&quot; - that public keys should not be revealed, where possible. Yet, caution should not discourage practical utility - as pointed out in the comments below.</p>
<p>Best practice, as you say, is to  frequently change keys and to preferably use a new address for every receive transaction. If you want someone to be able to verify a signature they will, of course, need your public key.</p>
<p>As far as I'm aware, the only Bitcoin transaction type that reveals public keys is Pay-To-Public-Key-Hash (P2PKH) which contains the full public key in its script.</p>

CC BY-SA 3.0
2017-06-24T05:08:07.880Z
Thank you for your answer. I guess I will pass up on that Stellar Lumens giveaway that requires signing message. Better be safe than sorry.
Dorky
CC BY-SA 3.0
2017-06-24T15:08:45.783Z
I think "better safe than sorry" here is misleading.   Attacks based on knowing the public key are purely theoretical and I know of no reason to think they will become practical in the foreseeable future.  Yes, you might as well avoid revealing the public key **if there is no reason to do so**.  But if, as in your case, there **is** something to be gained by doing it, then that probably outweighs the negligible risks.
Nate Eldredge
CC BY-SA 3.0
2017-06-24T18:37:42.730Z
While ECDSA does not technically have a security proof, it is commonly assumed that an attacker is allowed to see an arbitrarily large number of signatures with a certain key, on messages he chooses, and would still be unable to derive the private key or otherwise forge a signature. I believe this answer is incorrect for that reason.
Pieter Wuille
CC BY-SA 3.0
2017-06-25T05:50:59.903Z
answer updated with respect to comments by Nate Eldredge and @PieterWuille .
venzen
CC BY-SA 3.0
2017-06-25T06:12:02.617Z
Indeed an attack is almost impossible to hack for the private key after an address is used in a transaction, theoretically speaking. Just as theoretically speaking it's impossible to have collision but the Large Bitcoin Collider project has so far collided more than 50 addresses. So much for being theoretical that doesn't work in practice. So why are people recommending to use a new address with every new transaction if the hack is impossible? To suggest using new address with every new transaction while saying its impossible to hack the private key sounds very much self-contradicting.
Dorky
CC BY-SA 3.0
2017-06-25T16:26:59.733Z
LBC only found keys that were generated with broken random number generators. The reason to not reuse addresses is privacy first and foremost. In the unlikely event of an EC crypto break, it may offer some extra protection as long as miners don't have access to a means of breaking EC.
Pieter Wuille
CC BY-SA 4.0
2017-06-24T03:16:15.643Z
2022-06-03T14:05:26.677Z
2022-06-03T14:05:26.677Z
venzen
<p>Will signing a message (without doing any $ transaction) reveal the private key to the blockchain just the same/similar way the private key is revealed to the blockchain when you do a $ transaction?</p>
<p>The point is, doing a transaction weakens the security of the address a tiny bit because the private key is revealed to the blockchain. That's one reason why change/new address is used with every transaction.</p>
<p>But what about just signing a message? Will that weakens the security of the address a tiny bit too?</p>

CC BY-SA 4.0
2022-06-03T14:03:28.923Z
There was a suggested edit on this post to change the instances of "private key" to "public key" since the private key is of course never revealed. I've declined the suggested edit since addressing this misunderstanding is the main point of the answer which then would make a lot less sense.
Murch
<security><private-key><public-key><signature>
Does signing a message weaken the address' security?
Dorky
# Does signing a message weaken the address' security?

(Asked by: username_0 on 2017-06-24)

Will signing a message (without doing any $ transaction) reveal the private key to the blockchain just the same/similar way the private key is revealed to the blockchain when you do a $ transaction?

The point is, doing a transaction weakens the security of the address a tiny bit because the private key is revealed to the blockchain. That's one reason why change/new address is used with every transaction.

But what about just signing a message? Will that weakens the security of the address a tiny bit too?

**Tags:** security, private-key, public-key, signature

> **Comments:**
> **username_1**: There was a suggested edit on this post to change the instances of "private key" to "public key" since the private key is of course never revealed. I've declined the suggested edit since addressing this misunderstanding is the main point of the answer which then would make a lot less sense.  

---

## 1 answers

### Answer by username_2 on 2017-06-24. Score: 2 | Accepted answer

Public / Private key encryption requires that the private key is *never* revealed - the owner must keep it secret.

Message and transaction signing is done with the *private key* and verified with the associated public key. So **the private key is never revealed to the blockchain**. Note that *public key* here refers to the the full ECC public key, and not a Bitcoin address - which is a hashed and transformed representation of the public key. The public key can only be derived from a Bitcoin address if the SHA256 and ripeMD-160 hashing algorithms are ever broken. [This question](https://bitcoin.stackexchange.com/questions/7683/why-is-it-impossible-to-derive-public-key-from-address) explores the challenge.

To answer your question: Yes, each new signature produced by a private key may bring an attacker, who already knows the associated public key, closer to discovering the private key.

Comments to this answer have informed an updated position:

Although there is no [provable security](https://en.wikipedia.org/wiki/Provable_security) for ECDSA, it is commonly assumed that, even with knowledge of multiple signatures produced by a particular key, an attacker will not have improved odds at deriving the associated private key or forging its signature.

It is an [almost impossible](https://bitcoin.stackexchange.com/questions/111260/why-is-it-not-possible-to-get-the-private-key-out-of-the-public-key) task to discover a Bitcoin private key from its public key. An answer to [this question](https://bitcoin.stackexchange.com/questions/2847/how-long-would-it-take-a-large-computer-to-crack-a-private-key) illustrates the challenge mathematically.

Some people advise an attitude of "better safe than sorry" - that public keys should not be revealed, where possible. Yet, caution should not discourage practical utility - as pointed out in the comments below.

Best practice, as you say, is to frequently change keys and to preferably use a new address for every receive transaction. If you want someone to be able to verify a signature they will, of course, need your public key.

As far as I'm aware, the only Bitcoin transaction type that reveals public keys is Pay-To-Public-Key-Hash (P2PKH) which contains the full public key in its script.

> **Comments:**
> **username_0**: Thank you for your answer. I guess I will pass up on that Stellar Lumens giveaway that requires signing message. Better be safe than sorry.  
> **username_3**: I think "better safe than sorry" here is misleading.   Attacks based on knowing the public key are purely theoretical and I know of no reason to think they will become practical in the foreseeable future.  Yes, you might as well avoid revealing the public key **if there is no reason to do so**.  But if, as in your case, there **is** something to be gained by doing it, then that probably outweighs the negligible risks.  
> **username_4**: While ECDSA does not technically have a security proof, it is commonly assumed that an attacker is allowed to see an arbitrarily large number of signatures with a certain key, on messages he chooses, and would still be unable to derive the private key or otherwise forge a signature. I believe this answer is incorrect for that reason.  
> **username_2**: answer updated with respect to comments by username_3 username_3 and @username_4 .  
> **username_0**: Indeed an attack is almost impossible to hack for the private key after an address is used in a transaction, theoretically speaking. Just as theoretically speaking it's impossible to have collision but the Large Bitcoin Collider project has so far collided more than 50 addresses. So much for being theoretical that doesn't work in practice. So why are people recommending to use a new address with every new transaction if the hack is impossible? To suggest using new address with every new transaction while saying its impossible to hack the private key sounds very much self-contradicting.  
> **username_4**: LBC only found keys that were generated with broken random number generators. The reason to not reuse addresses is privacy first and foremost. In the unlikely event of an EC crypto break, it may offer some extra protection as long as miners don't have access to a means of breaking EC.  

---

