<p>Unfortunately, that would not be secure. Imagine an output with scriptPubkey <code>OP_HASH160 &lt;hash(P1)&gt; OP_EQUALVERIFY OP_CHECKSIG</code>. Now anyone can spend such an output by generating their own key <code>P2</code>, and spending with scriptSig <code>&lt;sig with P2&gt; &lt;P2&gt; &lt;P1&gt;</code>.</p>

CC BY-SA 4.0
2021-08-01T21:44:14.327Z
But the attacker doesn't know `P1`. So that would require the attacker to compute the pubkey `P1` from `hash(P1)`. Isn't that (practically) impossible since the hash function is preimage-resistant?
csstudent1418
CC BY-SA 4.0
2021-08-01T21:54:26.327Z
The attacker does know if they are a miner. They can look at a legitimate transaction and substitute their own key. You cannot assume that anything except the private key is private.
Pieter Wuille
CC BY-SA 4.0
2022-12-26T15:52:23.140Z
Follow-up question moved to https://bitcoin.stackexchange.com/questions/116509/a-question-about-the-role-of-op-dup-in-the-p2pkh-transaction-specification-an
Poseidon
CC BY-SA 4.0
2021-08-01T21:21:45.010Z
2021-08-01T21:21:45.010Z
Pieter Wuille
<p>We know that a P2PKH script looks as follows:</p>
<pre><code>scriptPubKey: OP_DUP OP_HASH160 &lt;PubKeyHash&gt; OP_EQUALVERIFY OP_CHECKSIG
scriptSig: &lt;Signature&gt; &lt;PubKey&gt;
</code></pre>
<p>Since full nodes are maintaing UTXO sets, wouldn't it save space to omit the <code>OP_DUP</code> and have the user provide their public key twice instead, like so? And would that create any sort of security issues?</p>
<pre><code>scriptPubKey: OP_HASH160 &lt;PubKeyHash&gt; OP_EQUALVERIFY OP_CHECKSIG
scriptSig: &lt;Signature&gt; &lt;PubKey&gt; &lt;PubKey&gt;
</code></pre>

<script><p2pkh>
Why OP_DUP instead of providing the PubKey twice in P2PKH?
csstudent1418
# Why OP_DUP instead of providing the PubKey twice in P2PKH?

(Asked by: username_0 on 2021-08-01)

We know that a P2PKH script looks as follows:

```
scriptPubKey: OP_DUP OP_HASH160 <PubKeyHash> OP_EQUALVERIFY OP_CHECKSIG
scriptSig: <Signature> <PubKey>

```

Since full nodes are maintaing UTXO sets, wouldn't it save space to omit the `OP_DUP` and have the user provide their public key twice instead, like so? And would that create any sort of security issues?

```
scriptPubKey: OP_HASH160 <PubKeyHash> OP_EQUALVERIFY OP_CHECKSIG
scriptSig: <Signature> <PubKey> <PubKey>

```

**Tags:** script, p2pkh


---

## 1 answers

### Answer by username_1 on 2021-08-01. Score: 4 | Accepted answer

Unfortunately, that would not be secure. Imagine an output with scriptPubkey `OP_HASH160 <hash(P1)> OP_EQUALVERIFY OP_CHECKSIG`. Now anyone can spend such an output by generating their own key `P2`, and spending with scriptSig `<sig with P2> <P2> <P1>`.

> **Comments:**
> **username_0**: But the attacker doesn't know `P1`. So that would require the attacker to compute the pubkey `P1` from `hash(P1)`. Isn't that (practically) impossible since the hash function is preimage-resistant?  
> **username_1**: The attacker does know if they are a miner. They can look at a legitimate transaction and substitute their own key. You cannot assume that anything except the private key is private.  
> **username_2**: Follow-up question moved to https://bitcoin.stackexchange.com/questions/116509/a-question-about-the-role-of-op-dup-in-the-p2pkh-transaction-specification-an  

---

