The use of Elliptic Curves as part of a blockchain transaction

Question

As I understand it, Elliptic-Curve Cryptography is used in the verification step of a transaction (i.e. when creating a digital signature), but not in the creation and security of a 'block' (when assigning a nonce to a hash value with a set number of zeros). Why do we use ECC when validating the initial transaction request, and not when validating the block? Or to flip that around, why not just use Cryptographic hashing in the validating transaction step (and not use ECC at all)? I know hashing is used on the message component during the validating transaction request, so why not use it again for the whole digital signature?

My understanding of blockchain is limited, so upfront apologies for any unclear language!

Answer 1

If you're asking why don't we use a simple hash to authenticate, well, that doesn't actually provide any authentication (as anyone can compute that hash).

On the other hand, there are signature algorithms based on hash functions (oddly enough, called hashed-based signatures) which rely on the preimage resistance (or collision resistance) of a hash function. They would appear to be ideal for block chains, except that they do have these drawbacks:

• These signatures are significantly larger than ECDSA signatures; we might be talking on the order of 1kbyte rather than 64 bytes for what bitcoin is currently using.

• There are practical drawbacks; in the simplest case ("one time hash based signatures") a public key can safely sign only one message. On the other hand, this might be an acceptable limitation in the bitcoin case; everytime we sign a transaction, we'd generate a fresh public/private key pair, and include the public key in with the transaction we're signing (and use the new private key the next time). There are other schemes that lessen this restriction (in case this approach turns out not to be feasible).

I suspect reason #1 is the main reason why bitcoin hasn't transitioned to this approach

Answer 2

Signing and Hashing serve two different needs in blockchain transactions. Consequently two different cryptographic constructs are used.

Signing is used to prove ownership. The payment address (transaction output) is a public key and only somebody in possession of the corresponding secret key can produce a valid signature for that public key. Consequently whoever is in possession of the secret key value has the ability to spend that transaction output.

Hashing is used to prove "work". Any particular nonce value has a certain probability of meeting the hash target value. This controls how many nonces need to be tried, on average, to find one which generates a valid block which the other nodes will accept (thereby enabling these distributed nodes to establish a consensus).

Different needs = different algorithms.