ScriptSig content during signature (quadratic hashing)

Question

As far as I know, the quadratic hashing problem came from the fact that every time a transaction is verified (or signed), the "unsigned transaction" that is hashed and verified changes depending on the transaction input that is being analysed. Basically, the target input ScriptSig is set to the ScriptPubKey of the UTXO to be redeemed, while the other inputs are left empty.

However, what I can't see is what's the reason behind that. Why aren't all the ScriptSig fields assigned either to their UTXO ScriptPubkey field, or left empty? The way it was designed doesn't seems to provide any kind of benefit (at least I can't see it), while it makes you recalculate the double-sha256 every single time an input is analysed, leading to a quadratic hashing problem.

Answer 1

It's like that because that is how Satoshi wrote the code for it and it has never changed. It can't change without some sort of fork, and thus far, no fork has happened to change it (although segwit will once it activates).

However doing it this way allows for people to more easily do multi-party transactions like CoinJoins. They don't require you to know the scriptPubKey of everyone else's inputs, you just sign what you are able to sign. You don't know the scriptPubKey's and you don't care, all you need to know is the scriptPubKey for the input that you are signing. This makes it much easier to participate in multi-party transactions especially for those using lite wallets as they don't have the UTXO set.