2

I was just trying to pin-point which BIP made high-s signatures non-standard. BIP62 proposed it as a new consensus rule, but was withdrawn. I couldn't find it in another BIP.

1 Answer 1

3

The requirement for transactions to only have low-s signatures is a standardness rule. Standardness is enforced at the mempool policy level and is not a protocol rule. Although the mempool behavior of Bitcoin Core has broad impact on the viability of transactions on the network, since mempool policy and standardness are local choices of Bitcoin Core, they have not always been documented in BIPs.

As mentioned, it was proposed to forbid high-s signatures at the protocol level in BIP62 with the original goal to resolve malleability concerns pertaining to scripts. BIP62 was withdrawn because just script rules were not enough to resolve transaction malleability concerns.

Signatures were later canonicalized in BIP66, and third-party malleability concerns regarding scripts were entirely resolved with BIP141. High-s signatures are still permitted: even for segwit outputs they are only non-standard, so while the txid is no longer influenced by signature data, the wtxid still is, and is still vulnerable to third-party malleability.

Returning to the main question, it turns out that the Bitcoin 0.9.0 release both started considering high-s signatures non-standard and only creating low-s signatures.


Note that third-party transaction malleability generally only concerns ECDSA signatures, Schnorr signatures are inherently non-malleable.

2
  • 1
    BIP62 was withdrawn because its original goal (fixing malleability) wasn't achievable with just script rules (specifically, it couldn't prevent a co-signer from re-signing). The somewhat later and more narrow spun-off goal of canonicalizing signatures for the purpose of switching off OpenSSL for validation (and, the issues it had) was achieved by BIP66. Malleability was later actually made a non-concern with BIP141. Jul 5 at 15:49
  • Thanks, made a couple more improvements to my post.
    – Murch
    Jul 5 at 15:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.