3

According to the bitcoin wiki, the most common form of transaction (pay-to-pubkey-hash) looks like this:

scriptPubKey: OP_DUP OP_HASH160 <pubKeyHash> OP_EQUALVERIFY OP_CHECKSIG
scriptSig: <sig> <pubKey>

I am curious why OP_CHECKSIG comes at the end. Couldn't we check the signature even before doing the hash?

More precisely, couldn't it instead do:

scriptPubKey: OP_CHECKSIGVERIFY OP_DUP OP_HASH160 <pubKeyHash> OP_EQUAL
scriptSig: <pubKey> <sig>

This way you don't have to go through all the hashing if the pubkey and sig don't match to begin with.

I'm sure there's a good reason for this or i'm completely misunderstanding something, please enlighten me. Thank you!

Improve this question

1 Answer 1

Reset to default
4

Couldn't we check the signature even before doing the hash?

We certainly could, but that would be silly. The hash is about 1000x faster than checking a signature. Doing the signature check when the hash fails would be a waste of time

More precisely, couldn't it instead do:

scriptPubKey: OP_CHECKSIGVERIFY OP_DUP OP_HASH160 OP_EQUAL

No, that certainly wouldn't work. The OP_CHECKSIGVERIFY would remove the public key from the stack, so there is nothing to compare it with. The OP_DUP would always fail, as there is nothing to duplicate anymore.

Improve this answer
4
  • aha i see. thanks for the answer. Just to make sure i understood completely, so if we do scriptPubKey: OP_DUP OP_CHECKSIGVERIFY OP_HASH160 <pubKeyHash> OP_EQUAL and scriptSig: <sig> <pubKey>, this would: 1. work; 2. but not efficient therefore not used because hashing is much faster than checksig?
    – Vlad
    Commented Oct 8, 2017 at 7:08
  • Not quite. After OP_DUP, your stack will be <sig> <pubkey> <pubkey>. Invoking OP_CHECKSIGVERIFY at that point will do a verification with <pubkey> as signature.
    – Pieter Wuille
    Commented Oct 8, 2017 at 7:50
  • 1
    What would work (but be inefficient): scriptSig={<pubkey> <sig>}, scriptPubKey={OP_OVER OP_CHECKSIGVERIFY OP_HASH160 <pubkeyhash> OP_EQUAL}.
    – Pieter Wuille
    Commented Oct 8, 2017 at 8:07
  • Actually, the scriptSig would be "<sig> <pubkey>" to use OP_OVER. If it was already "<pubkey> <sig>" the suggestion in the first comment would work, but it would require a change in the scriptSig, not only the scriptPubKey.
    – diego nunes
    Commented Apr 23, 2018 at 16:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.