2

In pre-BIP143 signature hashes, I know that the signature hash differs because you have to substitute the previous scriptPubKey for each input and thus the serialization changes.

The question is why? If the HASH_TYPE is SIGHASH_ALL, why does the signature hash need to change for each input? Why not sign the same "blanked" transaction or the same transaction with the scriptPubKeys?

6

Varying the signature per input helps prevents some attacks during multi-party transaction construction.

Consider a coinjoin involving Alice and Bob. Alice selects one of her UTXOs for the coinjoin. Bob chooses a UTXO for his input, but he actually selects ones of Alice's other UTXOs that reuse the same address as the one she selected. Alice does not notice that Bob selected one of her UTXOs and continues with the coinjoin protocol, signing her input. Now Bob copies her signature, which would be valid for the UTXO of Alice's that he selected if SIGHASH_ALL were constant for all inputs. Now Bob has procured Alice's funds for himself.

Technically this can be prevented if Alice checks all other inputs to the coinjoin to make sure that they are not controlled by herself, but that is a huge pain, error prone, surprising, and likely means a secure signing module needs to be aware of all UTXOs that use the same public key.

  • 1
    "a huge pain, error prone, surprising, and likely means a secure signing module needs to be aware of all UTXOs" because of a race with unconfirmed transactions, I argue this is actually not even possible! :) One could require the other party to provide all the input transactions but that would be inefficient and all your error prone comments would still apply. – G. Maxwell Mar 28 at 6:49
2

I'd been wondering about this for quite a long time, since it was the reason behind the quadratic hashing problem. The best answer I found so far is the one given by Pieter Wuille in the Bitcoin talk forum. The answers is most likely not going to be satisfying though.

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.