1

I'm just writing a small essay about the basics of BTC and I ran into a small problem.

I know, that there are digital signatures in our bitcoins' earlier transactions (our transaction inputs) and in the next owner's public key. How can the system verify, if the input is really from our earlier output? We can just use a random (unspent) output from an earlier block, can't we? I know that we are the next owner and our public key is in the transaction, but we can (and should) generate a a new public-private key for our next transaction, so the new private key won't match our "old" public key... What is that thing I don't know or understand?

Improve this question

1 Answer 1

Reset to default
2

Starting from basics, each input spends a previous output:

Input spending output

To spend the output, the input has to include a reference to it (called an outpoint). This includes the TXID that included the output as well as the sequence number of that output in the transaction (called a vout for output vector).

Spending an output

In order for Alice to pay Bob in a pay-to-public-key-hash (P2PKH) output, Bob needs to create a private key (which he keeps secret), derive a public key, hash that public key (encoding it as a Bitcoin address), and then give that hash to Alice. Alice uses that hash in a P2PKH output in TX1.

Creating a P2PKH output

When Bob wants to later spend that output from TX1 (using it as an input), his computer gets the hash (address) from the TX1 output, finds the corresponding public key, inserts that public key into the signature script, then finds the corresponding private key in its secure database, and uses that key to create an ECDSA signature which it also adds to the signature script.

Creating a signature script

So only one keypair is used per output, although the same keypair may be used in multiple outputs. (This is called key reuse, and it's discouraged to improve privacy and, possibly, security.)

(The images above are from the Bitcoin.org Developer Guide transactions section, which is under the MIT license.)

Improve this answer
5
  • One thing is not clear yet (anyway I accepted your answer). When I spend the coins from the previous transaction, I use another private key (because as I know unique keypairs should be used for every transaction), not that private key which is the pair of the public key included in the pubkey script, don't I? (yeah, I'm not familiar with this scripting system, yet)
    – Zoltán
    Commented Dec 6, 2014 at 20:45
  • I think you're confused about how addresses work. Give me a sec and I'll edit my answer.
    – David A. Harding
    Commented Dec 6, 2014 at 20:51
  • One more question, if you are still here and I'm not bothering you :) To put it in a nutshell, with the signing with earlier private keys I can prove that the earlier transactions were mine? So I also generate (maybe) an address when I spend these bitcoins, however I use private keys from my earlier transactions and this newly generated address is just for receiving the "change"...?
    – Zoltán
    Commented Dec 6, 2014 at 21:47
  • Right, signature A in TX2 mathematically corresponds to pubkey A in TX1's output in a provable way. TX2 may include pubkey B to return change to you. Pubkey B was created with a different private key than pubkey A.
    – David A. Harding
    Commented Dec 6, 2014 at 21:55
  • @Zoltán You can search matt thomas on youtube, his videos on bitcoin are very informative.
    – Suraj Jain
    Commented Feb 14, 2018 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.