5

Why didn't Bitcoin implement segwit in the first place?

Why and how does non-segwit Bitcoin enable a miner to change a transaction's txid?

From Mastering Bitcoin ch. 7 ยง "Transaction identifiers":

Before segwit, transactions could have their signatures subtly modified by third parties, changing their transaction ID (hash) without changing any fundamental properties (inputs, outputs, amounts).

Improve this question
3

Why didn't Bitcoin implement segwit in the first place?

The reason Bitcoin didn't initially have SegWit is up to interpretation, I would say that it simply was not thought of prior to transaction malleability. Although that is not its only goal. Segregated Witness was an idea proposed in BIP 141 as a soft-fork, meaning it did not require an entire network upgrade. Due to the nature of a soft-fork, it is backwards compatible with previous versions of the Bitcoin software. Over time, it has been gradually adopted.

Why and how does non-segwit Bitcoin enable a miner to change a transaction's txid?

Mastering Bitcoin is referring to something called transaction malleability. Traditionally, the txid was a hash of ALL the data in the transaction including the signatures. Transaction malleability meant a signature could be slightly modified such that the txid would be changed entirely while the signature still remained valid.

As David has mentioned in his own answer:

changing even a single byte in the transaction completely changes the transaction ID.

This created an opportunity for a "Denial-of-Service" attack where while the transaction was still valid, and every part of the transaction would have the same inputs/outputs, nodes could reject modified transactions and prevent them from confirming. With SegWit, the signatures (as implied by the name "Segregated Witness") are no longer part of this hash. Eliminating the issue entirely.

I recommend reading this article for more information on how exactly it is done in practice.

Improve this answer
2

Why didn't Bitcoin implement segwit in the first place?

Nobody thought of it at the time. There wasn't interest in things like off-chain scaling at the time.

Why and how does non-segwit Bitcoin enable a miner to change a transaction's txid?

The signature for each input only covers critical parameters of the transaction such as who it makes payments to and how much. It is possible to modify the transaction and preserve the signature validity by not changing anything critical. Since the transaction ID is the hash of the entire transaction, changing even a single byte in the transaction completely changes the transaction ID.

Improve this answer
  • 1
    Transaction malleability totally messed up the original wallet and would cause effective funds loss (the wallet would never release coins for respending when killed by parent tx malleability). It was just an un-thought of vulnerability. Segwit is desirable without any thought to off-chain anything, and was first proposed in 2012 without any reference to it importance for smart contracts. – G. Maxwell Oct 28 '18 at 0:29
  • 1
    Had anyone thought of the malleability probably in the early days, it would likely have lead to a smaller change just to fix malleability, not segwit. But, of course, counterfactuals are hard to establish. – David Schwartz Oct 28 '18 at 0:30
  • That isn't at all clear to me, both the full data and the witnessless data must be committed to, no matter how it's constructed. When we created segwit we first did it as a from scratch redo for elements with no need to be compatible and only later realized we could retrofit it into Bitcoin. The two versions were almost identical. As a result I think it's likely that if the flaw was originally known the solution would be equivalent at a high level description level, other than also supporting the old style-- of course. – G. Maxwell Oct 28 '18 at 0:33

Your Answer

By clicking โ€œPost Your Answerโ€, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.