If we simply assumed 32 bytes of r and s each, then signatures can be 64 bytes. Now they are on average 71 bytes in DER plus an additional byte to declare their size, effectively making them use 72 bytes of space. Similarly, if we assume public key is always compressed then we can simply keep 2 stack items of 64+32 bytes. I guess it is to do with the way OP_CheckSig is implemented.

1 Answer 1


Segregated Witness was already a large collection of changes that impacted several parts of Bitcoin (P2P, validation, fee estimation, sighashing, script execution, ...).

Many small improvements could easily have been added to the proposal (including the signature encoding, the superfluous stack pop in OP_CHECKMULTISIG, the signature algorithm, various script extensions, new sighash flags, ...). However, we wanted to avoid letting the scope grow too large, to avoid bikeshedding and review burden. Instead, a script versioning system was introduced that would make it possible to later pretty much enable adding in any other change as a softfork).

So the answer is that DER is still in use in P2WPKH simply because it was in use in P2PKH and it didn't change. However, I expect that future proposals will come soon enough to change it to pure 64-byte signatures.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.