How to manually verify a signature given scriptSig and scriptPubKey?

Question

First transaction

Given a transaction on the blockchain: 3a1b9e330d32fef1ee42f8e86420d2be978bbe0dc5862f17da9027cf9e11f8c4

One of the outputs transfers 424,242.42424242 BTC to 1eHhgW6vquBYhwMPhQ668HPjxTtpvZGPC

scriptPubKey:

OP_DUP OP_HASH160 070d550bc5bc843149410b8863b5b72857d91439 OP_EQUALVERIFY OP_CHECKSIG 

Second transaction

And the input to spend that output is in this transaction: 7a2a6f66e87ed4e72d85ba7a82eda1572605c3330c461e171f58d7ff2763ac63

scriptSig:

30450221009c45573098c41e5ebd1e41fea5f6d0f96c7833a631c7ae890de328ca7e643a79022037cb1736d6aeeed517b234a16d731072cddf1917947dab25776a0f6dff9d741f01 
041b4c38a55f7d3de915a0732c2237e13349c17250c05b4803e147fcee08ebad75fa76cfcde6aa5f45cde1201f63920c3625c6cba17c42ce052c07cdea0607f488

Question

How does one go about manually verifying the signature with ECDSA given the signature, public key, and the two transactions?

My naive attempt using pybitcointools:

>>> from bitcoin import *
>>> public_key = '041b4c38a55f7d3de915a0732c2237e13349c17250c05b4803e147fcee08ebad75fa76cfcde6aa5f45cde1201f63920c3625c6cba17c42ce052c07cdea0607f488'
>>> sig = '30450221009c45573098c41e5ebd1e41fea5f6d0f96c7833a631c7ae890de328ca7e643a79022037cb1736d6aeeed517b234a16d731072cddf1917947dab25776a0f6dff9d741f01'
>>> tx = '7a2a6f66e87ed4e72d85ba7a82eda1572605c3330c461e171f58d7ff2763ac63'
>>> print ecdsa_verify(tx, sig, public_key)
False

It might be that I have to go through this diagram to construct the "message" to use in verification: https://dl.dropboxusercontent.com/u/1139081/BitcoinImg/OpCheckSigDiagram.png

Thanks in advance for any help on this!

Answer 1

Remember that 'scriptPubKey' and 'scriptSig' are scripts. They are intended to be executed by an interpreter. The reason your naive attempt didn't work, is because these values are not simple numbers, but are executable lines of code.

What happens, is that scriptSig is executed first, leaving values on the stack. Then scriptPubKey is executed to check if the values left by scriptSig are valid. Because scriptPubKey is the script specified by the output being spent, it encumbers the bitcoins, and is also called the encumbrance script. So whoever last spent the bitcoins, gets to decide the terms by which the bitcoins are encumbered. Usually it says something like "pay this output to whosoever has the private key that matches this public key"...but it doesn't have to. This is how the system can handle multisig transaction, storing data, smart contracts, and multiple types of payments. It's actually fairly complicated, which is why there is a programming language used rather than static keys and signatures.

Unfortunately, the best reference on how this code executes would be the interpreter.cpp file of the reference client (Bitcoin Core). I know that's probably not the answer you were looking for, but this is really at the heart of what makes Bitcoin so flexible.

Answer 2

Point is, that the TX is not "the input to spend that output ...". amaclin has provided correct link, the hash is calculated over un unsigned transaction, which follows specific rules. If you have more than one input (as in this case), the logic is well explained by Nathan: How to sign a transaction with multiple inputs? So you would have to deconstruct the TX, create the hash over it, and then run your code...