Is it bad to expose the public key? I am studying about blockchain and have been focusing on encryption protocols that allow authentication. The digital signature of public and private key seems solid, I have focused on the algorithm ED25519.

But in some places, some people say about not exposing the public key because through the public key and signature it would be possible to derive the private key. Some say that quantum computers will easily accomplish this task.

At first, I thought the reason for the bitcoin addresses was to make the public key "human-readable." But I see that there are some security points having a public key hash.

So I have some doubts:


Is it really a risk of exposing the public key without any treatment?
If so, what are the alternatives?
How does bitcoin, for example, validate the transaction signature with a public key hash and not the public key itself? (After all, it would be "impossible" to reverse a sha256 hash to its origin)
From a cryptographic standpoint it is OK to expose a public key in the sense of revealing its value. The most basic assumption in cryptography involving public/private key pairs is that the value of a public key is public; hence its name.

It is extremely important that an adversary can not alter a public key. Any exposition that would allow alteration must be avoided !

Also, a public key is highly characteristic; so one might not want to reveal one's public key, in order to remain untraceable (and anonymous). However, that might not be enough: unless the signature scheme is designed to prevent this, revealing one's signatures might allow traceability (for some systems it is even possible to reconstruct the public key from signatures).

It is correct that not revealing a public key deprives adversaries from information that a sufficiently powerful adversary can use to find (an equivalent of) the private key and break the system. But we need a public key to be public so that signatures made with the owner's private key can be publicly checked. Concluding that one should not reveal a public key is like saying one should keep the location of a bank's safe room secret: that's an assumption ruled out by design, because it would make the design unfit for the intended purpose.

Yes, hypothetical quantum computers usable for cryptanalysis would allow an adversary to attack a known public key of the kind we use now (and in the blockchain). On the other hand


Currently, available quantum computers are less useful for cryptanalysis than available lightsabers are to break into a bank's safe room.
There is plausible reason to fear that in the signature systems that we use, a few signatures are as good as the public key to an attacker with such hypothetical quantum computer usable for cryptanalysis.




Update: regarding


  How does bitcoin for example validate the transaction signature with a public key hash and not public key itself?


It obtains the public key, validate (or reject) it by hashing it and comparing to the trusted public key hash, then validates the transaction signature against the validated public key. For more, see indiscreteLogarithm's answer.