Why is the signature hash different for each input in a multi-input transaction?

Question

In pre-BIP143 signature hashes, I know that the signature hash differs because you have to substitute the previous scriptPubKey for each input and thus the serialization changes.

The question is why? If the HASH_TYPE is SIGHASH_ALL, why does the signature hash need to change for each input? Why not sign the same "blanked" transaction or the same transaction with the scriptPubKeys?

Answer 1

Varying the signature per input helps prevents some attacks during multi-party transaction construction.

Consider a coinjoin involving Alice and Bob. Alice selects one of her UTXOs for the coinjoin. Bob chooses a UTXO for his input, but he actually selects ones of Alice's other UTXOs that reuse the same address as the one she selected. Alice does not notice that Bob selected one of her UTXOs and continues with the coinjoin protocol, signing her input. Now Bob copies her signature, which would be valid for the UTXO of Alice's that he selected if SIGHASH_ALL were constant for all inputs. Now Bob has procured Alice's funds for himself.

Technically this can be prevented if Alice checks all other inputs to the coinjoin to make sure that they are not controlled by herself, but that is a huge pain, error prone, surprising, and likely means a secure signing module needs to be aware of all UTXOs that use the same public key.

Answer 2

I'd been wondering about this for quite a long time, since it was the reason behind the quadratic hashing problem. The best answer I found so far is the one given by Pieter Wuille in the Bitcoin talk forum. The answers is most likely not going to be satisfying though.