A coin
is described by 3 things.
- The outpoint: the
txid
and output index in the creating transaction. Explicitly identifies coins being spent
- The amount
- The scriptPubKey
To spend a coin, you create a transaction specifying the outpoint as an input. You specify some destinations (known as outputs). The scriptPubKey
often requires you to provide a signature authenticating the spend.
ECDSA specifies to take h = H(m) mod n
, where H(m) is a hashing algorithm, and use this data to calculate a signature by a private key. Your question is, what is m
?
m
(the data being signed) is a transaction serialized according to SIGHASH flags which determine what parts are committed to in the signature.
- SIGHASH_ALL commits the entire transaction as 'data', so if any of that data changes (someone adds an input, or changes a destination), the signature is rendered invalid.
- SIGHASH_NONE captures everything but the outputs (the output index is resized to zero). This ensures the signature is valid so long as the inputs remain the same. The outputs can be changed at will.
- SIGHASH_SINGLE captures an input and an output. Anything else can change without rendering the signature invalid.
- SIGHASH_ANYONECANPAY can be applied on top of the other sighash types. Only one input is signed (yours), and the outputs.
The SIGHASH flags are appended to the signature, which allows others to repeat the procedure done while signing.
There are some other modifications:
- input scripts are set to zero, since signatures can't sign themselves.
- the txout.scriptPubKey
is added as the txin.scriptSig
for this vin (the part since the last OP_CODESEPARATOR)
- at the very end, the hashTypeCode
(4-byte sighash flag) is appended
For more detail on this process, read over this page and the image: https://en.bitcoin.it/wiki/OP_CHECKSIG
Segregated witness includes a modification to how m
is derived. See BIP 143: https://github.com/bitcoin/bips/blob/master/bip-0143.mediawiki