<p>Address reuse is chiefly a privacy issue: because your UTXOs share the same output script, they are obviously controlled by the same entity. Reusing addresses reveals your receiving pattern, and if you spend those UTXOs in multiple different transactions, it heavily suggests that all spending transactions are (co-)authored by the same spender.</p>
<p>Address reuse would be a security issue <em>if</em> ECDSA were to become insecure in the future. The hypothetical scenario is that when a public key is known, an attacker would be able to use a quantum computer to solve the discrete logarithm problem and calculate the private key from the public key to steal your funds. Since many output types lock the funds to a hash, and hashes are more secure against quantum computing, a reused address would be more vulnerable because its public key has been revealed while an address that has only received funds would still have its public key hidden behind the hash.</p>
<p><strong>You do not need to lose sleep about this</strong>. Quantum computers are decades away from doing anything interesting, if they ever will. Further, if quantum computers end-up being more of a thing than cold fusion, more than a quarter of all bitcoins are in outputs whose public keys are known. Your withdrawals from Fold would not make much of a dent either way, it would necessitate a network wide solution to keep Bitcoin viable.</p>

CC BY-SA 4.0
2023-07-14T15:57:04.840Z
So in this hypothetical scenario where ECDSA is cracked, am I right in understanding that address reuse would only put the coins associated with that particular address at risk? Not the entirety of the coins associated with the main seedphrase?
anonpleb
CC BY-SA 4.0
2023-07-14T16:21:06.240Z
Note that in theory, it's possible that even without quantum computer, elliptic curve cryptography, the secp256k1 curve, or even just ECDSA specifically get broken. If that happens, key reuse may or may not help such an attack. Similarly, even with a sufficiently powerful quantum computer capable of attacking secp256k1 ECDSA, key reuse may or may not help the attack. In general, it's very hard to talk about hypothetical future cryptographic or computational breakthroughs.
Pieter Wuille
CC BY-SA 4.0
2023-07-14T16:58:46.170Z
I see, yes. But I think I'm still a little confused on some fundamentals. When I spend from a particular UTXO, I reveal the public key associated with it, right? So, if in the future a way to reverse engineer a public key is found, the funds associated with that particular UTXO would be at risk, correct? But what about all the other UTXOs that are associated with the parent seedphrase. Would they be at risk also? Or not?
anonpleb
CC BY-SA 4.0
2023-07-14T17:05:59.397Z
@anonpleb That all depends on which piece of cryptography is broken, and what is revealed. In general, if all the attacker has is a way to break break EC keys, they cannot go from one key to another key generated by the same seed. However, if they have the parent xpub of both keys, it is trivial.
Pieter Wuille
CC BY-SA 4.0
2023-07-14T17:51:44.110Z
And what would have to happen for an attacker to gain access to the parent xpub?
anonpleb
CC BY-SA 4.0
2023-07-17T02:13:09.580Z
@anonpleb You, or someone else who has it, must reveal it to the attacker. It can't just be computed from observing your addresses or signatures. How really depends on how you interact with your key (e.g. in multisig setups, it's common to your cosigners know your xpubs), and what software you use.
Pieter Wuille
CC BY-SA 4.0
2023-07-14T15:02:02.667Z
2023-07-14T15:19:04.110Z
2023-07-14T15:19:04.110Z
Murch
<p>I have a question about address reuse. Admittedly, I'm a little confused on the matter, so please bear with me if the framing of my question doesn't make much sense.</p>
<p>Recently I started using Sparrow Wallet and Coldcard (previously I was using a Nano X and Ledger Live) and noticed I'd been reusing receiving addresses in batches of two, always one after another within the span of a few hours or a few days. After some thinking, I realized that these were my withdrawals from the Fold rewards card. Even though my wallet was creating new receiving addresses each time it detected one had been used, there was, of course, no way for it to detect I was copying and pasting the address over to Fold, hence the reuse.</p>
<p>I understand that this has compromised my privacy somewhat, which is a shame, but not a major concern.</p>
<p>The major concern I have is that a potential security vulnerability has now been exposed. I can't claim to understand this very well, but I know it has something to do with ECDSA, and if ECDSA is ever cracked in the future, my coins could be vulnerable.</p>
<p>However, I've only ever reused <em>receiving</em> addresses. I've never <em>spent</em> from the same address more than once, so does that exclude me from that concern?</p>
<p>If it <em>is</em> still a concern, what's the best recourse? Creating an entirely new seedphrase and transferring the funds over? Coinjoining?</p>
<p>Again, I'm not particularly well versed in all of this, so please explain to me like I'm 5.</p>

<security><hash><ecdsa><address-reuse><quantum-computing>
Address Reuse and ECDSA Concern
anonpleb
# Address Reuse and ECDSA Concern

(Asked by: username_0 on 2023-07-14)

I have a question about address reuse. Admittedly, I'm a little confused on the matter, so please bear with me if the framing of my question doesn't make much sense.

Recently I started using Sparrow Wallet and Coldcard (previously I was using a Nano X and Ledger Live) and noticed I'd been reusing receiving addresses in batches of two, always one after another within the span of a few hours or a few days. After some thinking, I realized that these were my withdrawals from the Fold rewards card. Even though my wallet was creating new receiving addresses each time it detected one had been used, there was, of course, no way for it to detect I was copying and pasting the address over to Fold, hence the reuse.

I understand that this has compromised my privacy somewhat, which is a shame, but not a major concern.

The major concern I have is that a potential security vulnerability has now been exposed. I can't claim to understand this very well, but I know it has something to do with ECDSA, and if ECDSA is ever cracked in the future, my coins could be vulnerable.

However, I've only ever reused *receiving* addresses. I've never *spent* from the same address more than once, so does that exclude me from that concern?

If it *is* still a concern, what's the best recourse? Creating an entirely new seedphrase and transferring the funds over? Coinjoining?

Again, I'm not particularly well versed in all of this, so please explain to me like I'm 5.

**Tags:** security, hash, ecdsa, address-reuse, quantum-computing


---

## 1 answers

### Answer by username_1 on 2023-07-14. Score: 2

Address reuse is chiefly a privacy issue: because your UTXOs share the same output script, they are obviously controlled by the same entity. Reusing addresses reveals your receiving pattern, and if you spend those UTXOs in multiple different transactions, it heavily suggests that all spending transactions are (co-)authored by the same spender.

Address reuse would be a security issue *if* ECDSA were to become insecure in the future. The hypothetical scenario is that when a public key is known, an attacker would be able to use a quantum computer to solve the discrete logarithm problem and calculate the private key from the public key to steal your funds. Since many output types lock the funds to a hash, and hashes are more secure against quantum computing, a reused address would be more vulnerable because its public key has been revealed while an address that has only received funds would still have its public key hidden behind the hash.

**You do not need to lose sleep about this**. Quantum computers are decades away from doing anything interesting, if they ever will. Further, if quantum computers end-up being more of a thing than cold fusion, more than a quarter of all bitcoins are in outputs whose public keys are known. Your withdrawals from Fold would not make much of a dent either way, it would necessitate a network wide solution to keep Bitcoin viable.

> **Comments:**
> **username_0**: So in this hypothetical scenario where ECDSA is cracked, am I right in understanding that address reuse would only put the coins associated with that particular address at risk? Not the entirety of the coins associated with the main seedphrase?  
> **username_2**: Note that in theory, it's possible that even without quantum computer, elliptic curve cryptography, the secp256k1 curve, or even just ECDSA specifically get broken. If that happens, key reuse may or may not help such an attack. Similarly, even with a sufficiently powerful quantum computer capable of attacking secp256k1 ECDSA, key reuse may or may not help the attack. In general, it's very hard to talk about hypothetical future cryptographic or computational breakthroughs.  
> **username_0**: I see, yes. But I think I'm still a little confused on some fundamentals. When I spend from a particular UTXO, I reveal the public key associated with it, right? So, if in the future a way to reverse engineer a public key is found, the funds associated with that particular UTXO would be at risk, correct? But what about all the other UTXOs that are associated with the parent seedphrase. Would they be at risk also? Or not?  
> **username_2**: @username_0 That all depends on which piece of cryptography is broken, and what is revealed. In general, if all the attacker has is a way to break break EC keys, they cannot go from one key to another key generated by the same seed. However, if they have the parent xpub of both keys, it is trivial.  
> **username_0**: And what would have to happen for an attacker to gain access to the parent xpub?  
> **username_2**: @username_0 You, or someone else who has it, must reveal it to the attacker. It can't just be computed from observing your addresses or signatures. How really depends on how you interact with your key (e.g. in multisig setups, it's common to your cosigners know your xpubs), and what software you use.  

---

