2
  • I've decoderawtransaction and see in the vin part a "scriptSig" ,which I believe to be the "unlocking script" . Assuming I have the private key in a paper wallet and someone send me transaction to my bitcoin address, How do I generate the to unlock it ?
  • My second question is: after I generated it, can someone copy this
    part and use it in the future to unlock a future transaction made to my same bitcoin address ?
  • For the 1st question I'm looking for a mathematical answer, i.e: take PK hash 160 extra. don't send me to some library. – Haddar Macdasi Mar 30 '15 at 12:32
4

First question has a long answer, because it depends on the scriptPubKey, but also of the sigHash flag, I assume you are speaking about classic P2PKH transactions. (ScriptPubKey expose the condition for "unlocking", while ScriptSig satisfies them for "unlocking". It can use signature... or not, but will assume you are using P2PKH scriptPubKey, so it does)

So the scriptPubKey is

OP_DUP OP_HASH160 <PubkeyHash> OP_EQUALVERIFY OP_CHECKSIG

Where PubkeyHash is given by your bitcoin address.

The scriptSig should be

<Sig> <PubKey>

The PubKey is simple. From your Private key, you can get the public key (curve secp256k1)

Q = dG

where d private key : int, Q public key : EC Point, G : ECPoint given by curve.

<sig>

is composed of 2 components

<ecdsaSig> <sigHash>

ECDA Sig is the signature of a hash of the transaction in DER encoding. sigHash is a byte that specifies how to generate this hash (ie: what is actually signed).

sigHash itself contains 2 informations.

<AnyoneCanPay><All|None|Single>

So what is signed is a calculated hash of your transaction depending on the sigHash. The human friendly explanation is here, and the most readable code doing that is here.

Once you calculated the hash, you need to sign it according to this math on elliptic curves. Due to the need in the algorithm of a random K value, it supposes a fair RNG. So RFC6979 describes a way for finding a K value that is not random but secure to use. (implementation here)

So here is what is signed, depending on the sigHash you choose:

AnyoneCanPay : You allow someone to modify any input in the transaction. (don't sign inputs, except yours)

All : You deny modification of outputs in the transaction. (sign outputs)

Single : You deny modification of the output having the same index as you input (sign one output)

None : You allow modification of any output in the transaction. (sign no output)

Second question : No, whatever the sigHash you use, part of your signature contains the previous output reference you are spending. Since you can't double spend, you can't reuse the signature. However, if you really want to do that, then use the same K value for signing 2 different hashes, then you basically leaked your private key. So anyone would be able to "unlock" a future transaction made to your bitcoin address by knowing the two signatures.

  • If I sign sigHash=None then anyone can change the transaction to receive the bitcoin ? – Haddar Macdasi Aug 5 '15 at 20:55
  • 1
    Yes, if sigHash = None (with AnyoneCanPay), then basically anyone can take the input you sign and put it in whatever transaction they like. If sigHash=None without AnyoneCanPay, then someone can only change the other inputs. – Nicolas Dorier Aug 7 '15 at 0:00
0
  1. How to redeem a basic Tx?

  2. The question is not clear to me. Do you want to send your transaction after signing? Or do you want to hold the signature for later use?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.