5

I'm looking to track transactions in a non-malleable way. To achieve this I've read the recommendations in this answer, but I don't understand how the order of transaction inputs isn't malleable. It's my understanding that each separate input is signed by the private key it's address is associated with, and thus a malleability attack could just swap the order of inputs and a tracking hash dependent a specific order would be rendered useless. Am I missing something here?

Improve this question

2 Answers 2

Reset to default
5

The signature associated with an input doesn't just sign that input, it signs the entire transaction payload - basically every part of the transaction except the signatures themselves. (Technically, it appears to actually sign a hash of a serialized version of the transaction.)

It has to be that way. Otherwise, you could take someone else's signed transaction and modify the outputs to pay it to yourself instead of the intended recipient.

So if you modify the order of the inputs, you modify the signed payload. The signatures will no longer verify and the modified transaction will not be accepted as valid by anyone.

The malleable transaction attack worked by modifying the signature itself to a different but still valid alternate version. The payload of the transaction never changed.

Improve this answer
2
  • Do you mind elaborating on the last paragraph?
    – Pacerier
    May 22, 2014 at 16:58
  • @Pacerier: Unfortunately I am not familiar with the precise details as to how the modified signature works. If I figure it out I will try to update my answer.
    – Nate Eldredge
    May 22, 2014 at 17:50
0

I have a feeling you are missing the index.

Each input is actually a transaction output from a previous transaction. The whole previous transaction is identified by the transaction hash, however the previous transaction can be paying to one or more addresses. Usually you control at least one of those addresses and so when you make a payment your software is

  1. identifying the (hopefully already confirmed) transaction
  2. identifying the index of the payment (ie your address) which you will use coins from

Point 2 is not malleable, the index is specific to the previous transaction. However you are able to compile your payment transaction in any order you choose, before it gets signed, and becomes your output.

This has nothing to do with the transaction malleability issue though.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.