Here are some of my understanding about signing a message with bitcoin address.
Kindly correct me if I misunderstood anything .
1. Basically bitcoin address has 2 parts :
a. Public address to share
b. Private key to keep secretly
c.
Public key to verify signatures made by the private key.
Private key -> public key -> address (you cant go backwards on this chain!).
2. We can derive a 3rd part from a bitcoin address.
a. This 3rd part is optional
b. Unlimited number of this kind of 3rd part can be generated
c. This 3rd part can be associated to some text.
No you dont derive the signature from the address. Its created by the private key and can be verified with the public key. The (version 1) address is the hash of a public key. The public key is part of the signature. There is however an unlimited number of messages you can sign.
3. To generate this 3rd part, we must need the private key of the address.
a. It is not possible to sign a message with online wallets who does not let access to private key
b. Online wallets (eg: Xapo or coinbase),
exchange or gambling deposit address are some example for without private key bitcoin addresses.
Yes and no. Coinbase allows you to sign a message even though you dont have access to your private keys. The just create the signed message for you.
4. By creating this 3rd part we can prove that we have the private key.
a. This 3rd part is called as Signature
b. This Signature is associated with some text, usually the purpose of signature along with time and owner.
Yes, it proves that someone has the private key for the address in question. It is however no proof that they are the only person.
Yes, each signature is unique for the given text and address. It makes sense to include certain information as they are not part of the signature (e.g. a timestamp).
5. Purpose: Prove the ownership of bitcoin address.
a. We can also prove ownership by adding "public note" in sending transaction from an address.
But it is costly and it has no privacy (can be seen by anyone).
No, the public note is a blockchain.info specific thing and not part of the bitcoin network. If blockchain.info is down there is no public note. There is also no way to verify a public note. I can create a public note "Whosdaddy" for one of my addresses on blockchain.info. That does not make me you, nor does it mean the address is yours. Its just text set by the owner of the address.
Similarly I can sign a message claiming that I am you, thats why its important to stake your address in the thread in meta if you want to use it to prove ownership over your account.