1

I always thought that when my wallet create a transaction, it's transaction id is fixed (it is the SHA256 of the transaction message). Yes, the transaction might not be included in the next block (and can even be dropped completely) but if it will be included the transaction ID is fixed. Apparently this is not correct:

Transaction IDs are not authoritative until a transaction has been confirmed. Absence of a transaction hash in the blockchain does not mean the transaction was not processed. This is known as "transaction malleability," because transaction hashes can be modified prior to confirmation in a block. After confirmation, the txid is immutable and authoritative.

Can anyone explain

  1. the reasons why transaction ID can be changed?
  2. Who can change this ID (I assume a miner who mined a block)?
  3. What field in the transaction message can be changed to warrant the change of txId?
  • 1
    Possible duplicate of What is Transaction Malleability? – Nate Eldredge Sep 2 '17 at 21:59
  • @NateEldredge thank you for a link, but I do not think that this is a duplicate. I know that transaction malleability is the change of transaction id (which is what that question asks). I want to know some details what exactly can be changed and for what reason. – Salvador Dali Sep 2 '17 at 22:04
2

I think What is transaction malleability will answer most of it. But to summarize it in terms of your actual questions:

  1. the reasons why transaction ID can be changed?

Because someone can create another transaction (= different transaction message) that accomplishes the same thing as yours, while reusing your signatures.

The reason the signatures can be reused in a different message is because the signatures don't sign themselves. They don't sign themselves because that would require a dependency loop (the transaction message depends on the signature, and the signature signs the transaction message), which would be impossible to sign for.

The question is then what can be changed in a signature that doesn't invalidate it. The known ways for doing so are listed in BIP62 (which aimed to prevent some of them, but was retracted - it still gives a good overview).

  1. Who can change this ID (I assume a miner who mined a block)?

Anyone who relays your transaction (including miners), as they see your transaction but have the ability to produce a modified version and relay that one faster than someone else.

  1. What field in the transaction message can be changed to warrant the change of txId?

The scriptSig field in the transactions' inputs. It contains the ECDSA signatures, but also redeemscripts, public keys, and various other information needed to prove a spend was authorized.

With BIP141 (Segregated Witness), these issues are avoided by making the signatures not affect the txid anymore. Instead, they are stored in a separate field (called the witness) which is only necessary to prove a transaction's validity, and does not contribute to its effect.

  • Thank you very much. It is still kind of hard for me to understand how you can reuse the signature. I thought that the main point of the signature is to be non-reusable (you create a signature using your private key so no one can reuse it). Will read the BIP you linked and hopefully will get it. – Salvador Dali Sep 3 '17 at 12:01
  • A signature signs a message. That message is not the full transaction itself, as that would include the signature itself. So, it signs a modified version of the transaction which does not include the scriptSig field. As a result, things you change in the scriptSig do not invalidate the signatures. – Pieter Wuille Sep 3 '17 at 15:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.