I'm reading Programming Bitcoin. And in Chapter7, the author talked about the way how signature hash is calculated by replacing the transaction's ScriptSig with the corresponding previous ScriptPubKey. I understand that we can't calculate the signature of a transaction with the signature inside it. But why not just drop the ScriptSig part instead of replace it with the previous ScriptPubKey? And by the way, the same confusion arise on me with the p2sh , where the ScriptSig is replaced with the corresponding RedeemScript.
Add a comment
|
1 Answer
Any data that is included in the sighash must be revealed to the signer. It also means that the signature itself directly commits to that information and so must be truthfully provided to the signer as otherwise an invalid signature would be created.
By including the scriptPubKey or the redeemScript, we ensure that the signers are aware of the script that their signature will be involved in. This removes a class of potential attacks where the signer is lied to about the script that is involved in that input. It may be that the signer does not want to sign for certain scripts, and so having the script be part of the signature means that the signer will always know what script it signed for.
answered Jul 22, 2022 at 15:31
-
As long as the prevout is committed to, it's just a shortcut though: the Script is already indirectly committed to? Commented Jul 22, 2022 at 15:46
-
3@AntoinePoinsot The point isn't commitment (which is indeed true regardless of whether this replacement happens), but making it cheap for signers make sure their information is correct (without it, signers would need to be given the full transactions creating the outputs to know the scriptPubKeys being spent). Of course, as we now know, the substitution in legacy sighashing isn't sufficient, and even the segwit one (which includes more information directly) isn't. Commented Jul 22, 2022 at 15:56