Quote from: publickeyhash on May 30, 2011, 08:18:47 PM

If I understand correctly the bitcoin adresses are Base58(Version+RIPEMD160(SHA256(PublicKey))+FirstFourBytes(SHA256(SHA256(PublicKey))))

Since Base58 is easily invertible (just encoding and not encrytion) we can ignore the ~~inner~~ outer brackets.

Now if ECDSA is considered trusted, why hide public key with a hash?

As others have answered, it's a more secure way of making addresses shorter.

However it does have a theoretical security benefit: It makes bitcoin a little less brittle against weak but semi-practical attacks on ECDSA.

E.g. imagine if bitcoin used RSA-512 for signatures today. RSA-512 is horribly week, many people (including myself) have cracked it on their own at home. Even so, if this weakness was known bitcoin users could change practices to only ever send once from an address (transferring all value to a new address) and so an attack would have to be performed in the narrow window between the transmission of the spending TXN and the mining of the block (or somewhat longer if also coupled with a high hash power attack). This is _much_ harder, and while I can trivially crack RSA-512 at home or using EC2 I don't believe I could pull off that attack.

It's likely that when there is some practical attack on ECC it will creepy up slowly initially taking a very long time and a lot of resources. When this happens concerned bitcoin users could move to more conservative practices (especially for large stores of wealth) while the long process of upgrading bitcoin happens.