What exactly is signed in "prev_out"?

Question

1. What is signed by scriptSig? I use my private key to sign data from the unspent transaction? I sign the "prev_out" object?
2. I read that the signature in "prev_out" is there to secure "prev_out" from being changed. But if the whole transaction is signed, doesn't that secure also the "prev_out" objects?

Answer 1

In short, yes. The prev_out field is a field of the transaction, AND part of the transaction which gets signed. Note that not all fields in a transaction are signed. What is signed depends on the SIGHASH_FLAG. Additionally, since each input has its own signature(s), the same fields/data are not signed for each signature in a transaction.

Signature Creation Background:

To create an ECDSA or Schnorr Signature of certain data, you take the hash (hash256) of that data (an integer), and sign that. Effectively, whatever data is hashed and then signed is committed to, making it immutable.

Bitcoin Signatures

In a transaction with 3 inputs, each input will require at least one signature. The signature for each input will sign the transaction, including the version, input_count, prev_outs, output_count, and outputs but ignore the ScriptSig field of the other two inputs. Read more about this process here: https://github.com/jimmysong/programmingbitcoin/blob/master/ch05.asciidoc