<p>Recovery of a public key from an ECDSA signature <a href="https://crypto.stackexchange.com/a/18106/49392">is not unique</a>. This is because the <code>r</code> value in a signature is only the x-coordinate of a point, so there are actually two points <code>R</code> and <code>-R</code> that have the same x-coordinate, and both will give a different public key. Actually, for completeness, you can even end up with <a href="https://crypto.stackexchange.com/a/60219/49392">four possible public keys</a> - but this happens with negligible probability.</p>
<p>In bolt-11, a recovery ID which takes values 0, 1, 2, or 3 is used to specify which of these four public keys should be used. But indeed, it is more efficient to simply use the given public key <code>n</code>. I don't think there are other practical benefits other than efficiency and perhaps robustness in case something goes wrong during recovery. <code>n</code> should always be one of the keys recovered, otherwise signature validation will fail.</p>

CC BY-SA 4.0
2021-12-20T01:31:16.103Z
2021-12-20T01:31:16.103Z
meshcollider
<p>From Bolt-11:</p>
<pre><code>A reader
if a valid `n` field is provided:
MUST use the `n` field to validate the signature instead 
  of performing signature recovery.
</code></pre>
<p>Is this merely a performance optimization? Is there a situation where the declared public key field differs from the public key that would have been recovered from the signature?</p>

<lightning-network>
Optional tagged field 19 vs signature recovery. Can these pub keys ever differ?
Synesso
# Optional tagged field 19 vs signature recovery. Can these pub keys ever differ?

(Asked by: username_0 on 2021-12-16)

From Bolt-11:

```
A reader
if a valid `n` field is provided:
MUST use the `n` field to validate the signature instead 
  of performing signature recovery.

```

Is this merely a performance optimization? Is there a situation where the declared public key field differs from the public key that would have been recovered from the signature?

**Tags:** lightning-network


---

## 1 answers

### Answer by username_1 on 2021-12-20. Score: 1 | Accepted answer

Recovery of a public key from an ECDSA signature [is not unique](https://crypto.stackexchange.com/a/18106/49392). This is because the `r` value in a signature is only the x-coordinate of a point, so there are actually two points `R` and `-R` that have the same x-coordinate, and both will give a different public key. Actually, for completeness, you can even end up with [four possible public keys](https://crypto.stackexchange.com/a/60219/49392) - but this happens with negligible probability.

In bolt-11, a recovery ID which takes values 0, 1, 2, or 3 is used to specify which of these four public keys should be used. But indeed, it is more efficient to simply use the given public key `n`. I don't think there are other practical benefits other than efficiency and perhaps robustness in case something goes wrong during recovery. `n` should always be one of the keys recovered, otherwise signature validation will fail.


---

