Bitcoin safe if ECDSA is broken?

6

I've read that one reason to use a new address for each transaction is because it hides the pubkey behind a hash, so that even if ECDSA is broken and someone is able to derive my privkey from my pubkey it would still be impossible to spend the output of the transaction, since they would need to be able not only to reverse the hash but reverse it into a valid pubkey. Assuming that's impossible, and assuming people use a new address for each transaction, what would be the full security implications for bitcoin if ECDSA were broken? How much protection does hashing the pubkey give from broken-ECDSA attacks?

Elliot Gorokhovsky

Posted 2016-06-06T13:46:12.833

Reputation: 239

Answers

2

First, if ECDSA were broken, a lot of other things would be broken, like ssh, https and a bunch of other things, including banking websites.

Second, if nobody reused addresses, then yes, bitcoin would be protected by SHA256 and RIPEMD160. There is currently no known way to get a preimage of a hash used by either of those functions so your bitcoin would be safe. Again, this assumes nobody reuses addresses.

As far as how much protection this gives, it's hard to say because it depends on the exploit used to break ECDSA.

Jimmy Song

Posted 2016-06-06T13:46:12.833

Reputation: 7 067

I guess I'm just asking, are there other things ECDSA is used for on the network where it's not protected by a hash? – Elliot Gorokhovsky – 2016-06-06T14:04:16.440

Also, I think you're wrong... the person who sent me the transaction knows my pubkey, so if ECDSA were broken they could send the bitcoins back to themselves after I've rendered them a service or given them a product. – Elliot Gorokhovsky – 2016-06-06T14:07:01.610

No there aren't other things using ECDSA except for the signing. And no, the person that's sending you the transaction does NOT know the pubkey unless you tell them off-band. They only know the hash160 of the pubkey, which is encoded in your bitcoin address. – Jimmy Song – 2016-06-06T16:02:45.630

Oh that's right! Then what's the point of the signing? Why cant I just announce to the network, "I can prove this transaction was sent to me since can reverse the hash. Now send the coins to address X please." – Elliot Gorokhovsky – 2016-06-06T16:08:37.617

To prove that you have the preimage of a hash, you would have to reveal the the preimage itself. Once someone has a preimage, they can then create their own transaction to supplant their own. Miners, for example, could then change transactions to give themselves the bitcoins. You need public key cryptography to stop this sort of manipulation. – Jimmy Song – 2016-06-06T19:17:28.540

Ok, so all hashing does is reduce the time an attacker has to break your pubkey from as long as you have the coins to the time it takes a transaction to get verified. So then, what's the point? If there were an attack that could break a public key in an hour we would move away from ECDSA anyway, so why care if the attacker has a year or just an hour? – Elliot Gorokhovsky – 2016-06-06T20:24:09.960

Asked: 2016-06-06T13:46:12.833

Viewed: 425 times

Active: 2016-06-06T13:56:48.900