<p>First, if ECDSA were broken, a lot of other things would be broken, like ssh, https and a bunch of other things, including banking websites.</p>

<p>Second, if nobody reused addresses, then yes, bitcoin would be protected by SHA256 and RIPEMD160. There is currently no known way to get a preimage of a hash used by either of those functions so your bitcoin would be safe. Again, this assumes nobody reuses addresses.</p>

<p>As far as how much protection this gives, it's hard to say because it depends on the exploit used to break ECDSA. </p>

CC BY-SA 3.0
2016-06-06T14:04:16.440Z
I guess I'm just asking, are there other things ECDSA is used for on the network where it's not protected by a hash?
Elliot Gorokhovsky
CC BY-SA 3.0
2016-06-06T14:07:01.610Z
Also, I think you're wrong... the person who sent me the transaction knows my pubkey, so if ECDSA were broken they could send the bitcoins back to themselves after I've rendered them a service or given them a product.
Elliot Gorokhovsky
CC BY-SA 3.0
2016-06-06T16:02:45.630Z
No there aren't other things using ECDSA except for the signing. And no, the person that's sending you the transaction does NOT know the pubkey unless you tell them off-band. They only know the hash160 of the pubkey, which is encoded in your bitcoin address.
Jimmy Song
CC BY-SA 3.0
2016-06-06T16:08:37.617Z
Oh that's right! Then what's the point of the signing? Why cant I just announce to the network, "I can prove this transaction was sent to me since can reverse the hash. Now send the coins to address X please."
Elliot Gorokhovsky
CC BY-SA 3.0
2016-06-06T19:17:28.540Z
To prove that you have the preimage of a hash, you would have to reveal the the preimage itself. Once someone has a preimage, they can then create their own transaction to supplant their own. Miners, for example, could then change transactions to give themselves the bitcoins. You need public key cryptography to stop this sort of manipulation.
Jimmy Song
CC BY-SA 3.0
2016-06-06T20:24:09.960Z
Ok, so all hashing does is reduce the time an attacker has to break your pubkey from as long as you have the coins to the time it takes a transaction to get verified. So then, what's the point? If there were an attack that could break a public key in an hour we would move away from ECDSA anyway, so why care if the attacker has a year or just an hour?
Elliot Gorokhovsky
CC BY-SA 3.0
2016-06-06T13:56:48.900Z
2016-06-06T13:56:48.900Z
Jimmy Song
<p>I've read that one reason to use a new address for each transaction is because it hides the pubkey behind a hash, so that even if ECDSA is broken and someone is able to derive my privkey from my pubkey it would still be impossible to spend the output of the transaction, since they would need to be able not only to reverse the hash but reverse it into a valid pubkey. Assuming that's impossible, and assuming people use a new address for each transaction, what would be the full security implications for bitcoin if ECDSA were broken? How much protection does hashing the pubkey give from broken-ECDSA attacks?</p>

<security><ecdsa>
Bitcoin safe if ECDSA is broken?
Elliot Gorokhovsky
# Bitcoin safe if ECDSA is broken?

(Asked by: username_0 on 2016-06-06)

I've read that one reason to use a new address for each transaction is because it hides the pubkey behind a hash, so that even if ECDSA is broken and someone is able to derive my privkey from my pubkey it would still be impossible to spend the output of the transaction, since they would need to be able not only to reverse the hash but reverse it into a valid pubkey. Assuming that's impossible, and assuming people use a new address for each transaction, what would be the full security implications for bitcoin if ECDSA were broken? How much protection does hashing the pubkey give from broken-ECDSA attacks?

**Tags:** security, ecdsa


---

## 1 answers

### Answer by username_1 on 2016-06-06. Score: 2

First, if ECDSA were broken, a lot of other things would be broken, like ssh, https and a bunch of other things, including banking websites.

Second, if nobody reused addresses, then yes, bitcoin would be protected by SHA256 and RIPEMD160. There is currently no known way to get a preimage of a hash used by either of those functions so your bitcoin would be safe. Again, this assumes nobody reuses addresses.

As far as how much protection this gives, it's hard to say because it depends on the exploit used to break ECDSA.

> **Comments:**
> **username_0**: I guess I'm just asking, are there other things ECDSA is used for on the network where it's not protected by a hash?  
> **username_0**: Also, I think you're wrong... the person who sent me the transaction knows my pubkey, so if ECDSA were broken they could send the bitcoins back to themselves after I've rendered them a service or given them a product.  
> **username_1**: No there aren't other things using ECDSA except for the signing. And no, the person that's sending you the transaction does NOT know the pubkey unless you tell them off-band. They only know the hash160 of the pubkey, which is encoded in your bitcoin address.  
> **username_0**: Oh that's right! Then what's the point of the signing? Why cant I just announce to the network, "I can prove this transaction was sent to me since can reverse the hash. Now send the coins to address X please."  
> **username_1**: To prove that you have the preimage of a hash, you would have to reveal the the preimage itself. Once someone has a preimage, they can then create their own transaction to supplant their own. Miners, for example, could then change transactions to give themselves the bitcoins. You need public key cryptography to stop this sort of manipulation.  
> **username_0**: Ok, so all hashing does is reduce the time an attacker has to break your pubkey from as long as you have the coins to the time it takes a transaction to get verified. So then, what's the point? If there were an attack that could break a public key in an hour we would move away from ECDSA anyway, so why care if the attacker has a year or just an hour?  

---

