<p>A major pro other than shorter addresses is that breaking into your private key takes one more step (hash -> public key -> private key). Plus, if ECDSA gets cracked someday and you follow the one-address-per-transaction best practice, transactions with P2PKH scripts will only unveil public keys when the amount they "hold" is going to be spent, so anyone attempting to hack your private keys from public keys would end up with empty addresses.</p>

CC BY-SA 3.0
2014-08-29T23:01:53.253Z
2014-08-29T23:01:53.253Z
keeshux
<p>The ScriptPubKey contains the hash of the public key, and this is compared to the public key in the ScriptSig. It is not possible to derive the public key from the hash (address). But when the output is spent, the public key is visible to the world. This isn't a problem though, and the same public key (address/private key) can be used multiple times. So why have the hash step? Why not just have the public key in the ScriptPubKey as well, without the <code>OP_HASH160</code> step? The hash doesn't add any security (afaict), since an address can be reused multiple times without loss of security (only privacy). </p>

<protocol><script>
Why does the script contain the hash of the public key
Marius
# Why does the script contain the hash of the public key

(Asked by: username_0 on 2014-08-29)

The ScriptPubKey contains the hash of the public key, and this is compared to the public key in the ScriptSig. It is not possible to derive the public key from the hash (address). But when the output is spent, the public key is visible to the world. This isn't a problem though, and the same public key (address/private key) can be used multiple times. So why have the hash step? Why not just have the public key in the ScriptPubKey as well, without the `OP_HASH160` step? The hash doesn't add any security (afaict), since an address can be reused multiple times without loss of security (only privacy).

**Tags:** protocol, script


---

## 1 answers

### Answer by username_1 on 2014-08-29. Score: 2

A major pro other than shorter addresses is that breaking into your private key takes one more step (hash -> public key -> private key). Plus, if ECDSA gets cracked someday and you follow the one-address-per-transaction best practice, transactions with P2PKH scripts will only unveil public keys when the amount they "hold" is going to be spent, so anyone attempting to hack your private keys from public keys would end up with empty addresses.


---

