<p>Exposing your public key does weaken the security a bit.  That is why it is recommended that you do not reuse addresses since your public key is exposed when you sign the first transaction spending money from that address.  Using Pay-To-PubKey instead of Pay-To-Pubkey-Hash exposes your public key immediately.  </p>

CC BY-SA 3.0
2014-04-03T18:40:17.737Z
That is a reason, but not the primary one, or the reason it was done originally.
Pieter Wuille
CC BY-SA 3.0
2014-03-11T16:12:48.783Z
2014-03-11T16:12:48.783Z
ScripterRon
<p>This is the standard pay-to-pubkey script, which was the original "standard script" for a while, and is still used if you'd solo mine from within bitcoind.</p>

<p>Originally, Bitcoin transactions were intended to use pay-to-IP, where the "address" was an IP address, and the public key to pay to was computed on the fly when requested by the sender. These transactions used pay-to-pubkey scripts.</p>

<p>Pay-to-IP became deprecated and eventually removed quickly, mostly because of security reasons (man-in-the-middle), and the "workaround" (intended for when the recipient was offline) pay-to-pubkeyhash took over, with several unfortunate side effects (address reuse, no comments on transactions, ...). Hopefully the Payment Protocol (BIP 70-72) can bring these back.</p>

<p>There are other reasons for preferring pay-to-pubkeyhash instead of pay-to-pubkey, such as a very minor security advantage (before the pubkey is revealed, the attacker first needs a preimage attack on the hash, before starting to attack the EC key), and smaller effect on the UTXO set (the database every full node maintains in addition to the block chain).</p>

CC BY-SA 3.0
2014-03-11T16:24:49.267Z
2014-03-11T16:24:49.267Z
Pieter Wuille
<p>This is not useful because anyone can redeem it with a valid ECDSA signature signed under ANY key.</p>

CC BY-SA 3.0
2014-03-11T04:36:55.557Z
You're right, I typed in the script wrong.  I revised it.
makerofthings7
CC BY-SA 3.0
2014-03-11T15:47:36.927Z
Thanks but this script is only useful if people publish the public key instead of the address. Even after compression a pubkey is still 60% longer than an address.
uminatsu
CC BY-SA 3.0
2014-03-11T04:00:38.127Z
2014-03-11T04:00:38.127Z
uminatsu
<p>What if I had a scriptPubKey of </p>

<pre><code>&lt;pubKey&gt;OP_CHECKSIG
</code></pre>

<p>And an scriptSig of</p>

<pre><code>&lt;sig&gt;
</code></pre>

<p><strong>Question</strong></p>

<ol>
<li><p>Would that work in the standard client?</p></li>
<li><p>Why do we need to check the hash?</p></li>
</ol>

<p>The only possible reason I could come up with is that it makes a DDOS much more difficult since people aren't flooding the network with invalid signatures that eats up the CPU, and a hash is relatively inexpensive.</p>

<p>If the explanation I have is correct, is it documented anywhere?   </p>

<p>The wiki says that that the pay to pub key hash is <a href="https://en.bitcoin.it/wiki/Script#Standard_Generation_Transaction_.28pay-to-pubkey.29" rel="nofollow">to prevent a break in the ECDSA</a> algorithm, but I wonder what the real answer might be. </p>

CC BY-SA 3.0
2014-03-11T03:22:28.740Z
Interestingly, the use of the hash also uses extra space in the blockchain, since the public key has to appear in the spending transaction anyway.  On the other hand, without the hash, you'd use the public key as your address; it's about 60% longer, which might be a little inconvenient.
Nate Eldredge
CC BY-SA 3.0
2014-03-11T03:25:31.310Z
Protection against an attack on ECDSA seems a perfectly reasonable explanation; why do you doubt it?
Nate Eldredge
<transactions><script><p2pk>
Could the standard pay to address script be simpler? e.g. no compare of the HASH160?
makerofthings7
# Could the standard pay to address script be simpler? e.g. no compare of the HASH160?

(Asked by: username_0 on 2014-03-11)

What if I had a scriptPubKey of

```
<pubKey>OP_CHECKSIG

```

And an scriptSig of

```
<sig>

```

**Question**

1. Would that work in the standard client?
2. Why do we need to check the hash?

The only possible reason I could come up with is that it makes a DDOS much more difficult since people aren't flooding the network with invalid signatures that eats up the CPU, and a hash is relatively inexpensive.

If the explanation I have is correct, is it documented anywhere?

The wiki says that that the pay to pub key hash is [to prevent a break in the ECDSA](https://en.bitcoin.it/wiki/Script#Standard_Generation_Transaction_.28pay-to-pubkey.29) algorithm, but I wonder what the real answer might be.

**Tags:** transactions, script, p2pk

> **Comments:**
> **username_1**: Interestingly, the use of the hash also uses extra space in the blockchain, since the public key has to appear in the spending transaction anyway.  On the other hand, without the hash, you'd use the public key as your address; it's about 60% longer, which might be a little inconvenient.  
> **username_1**: Protection against an attack on ECDSA seems a perfectly reasonable explanation; why do you doubt it?  

---

## 3 answers

### Answer by username_2 on 2014-03-11. Score: 1 | Accepted answer

Exposing your public key does weaken the security a bit. That is why it is recommended that you do not reuse addresses since your public key is exposed when you sign the first transaction spending money from that address. Using Pay-To-PubKey instead of Pay-To-Pubkey-Hash exposes your public key immediately.

> **Comments:**
> **username_3**: That is a reason, but not the primary one, or the reason it was done originally.  

---

### Answer by username_3 on 2014-03-11. Score: 4

This is the standard pay-to-pubkey script, which was the original "standard script" for a while, and is still used if you'd solo mine from within bitcoind.

Originally, Bitcoin transactions were intended to use pay-to-IP, where the "address" was an IP address, and the public key to pay to was computed on the fly when requested by the sender. These transactions used pay-to-pubkey scripts.

Pay-to-IP became deprecated and eventually removed quickly, mostly because of security reasons (man-in-the-middle), and the "workaround" (intended for when the recipient was offline) pay-to-pubkeyhash took over, with several unfortunate side effects (address reuse, no comments on transactions, ...). Hopefully the Payment Protocol (BIP 70-72) can bring these back.

There are other reasons for preferring pay-to-pubkeyhash instead of pay-to-pubkey, such as a very minor security advantage (before the pubkey is revealed, the attacker first needs a preimage attack on the hash, before starting to attack the EC key), and smaller effect on the UTXO set (the database every full node maintains in addition to the block chain).


---

### Answer by username_4 on 2014-03-11. Score: 1

This is not useful because anyone can redeem it with a valid ECDSA signature signed under ANY key.

> **Comments:**
> **username_0**: You're right, I typed in the script wrong.  I revised it.  
> **username_4**: Thanks but this script is only useful if people publish the public key instead of the address. Even after compression a pubkey is still 60% longer than an address.  

---

