0

I wrote a couple of algorithms that perform the ECDSA and also the verification. So I used my algorithm and the RPC call for signing and I got a couple of questions.

  1. Since we have the ephemeral private key which has to be random how can I sign two times the same transaction and get the same signature as Bitcoin RPC does.

  2. What is the hash that should be signed, the whole transaction without the signature, do I have to exclude any fields?

2

Since we have the ephemeral private key which has to be random how can I sign two times the same transaction and get the same signature as Bitcoin RPC does.

This "ephemeral private key" is known as a nonce. Bitcoin Core, and most other wallet software, use a technique called Deterministic Nonces. Specifically, they use the algorithm defined in RFC 6979 to produce the nonce deterministically. It essentially hashes together the message and the private key being used and uses that hash as the nonce. If you sign the same message with the same private key multiple times, the same nonce will be used and thus you always get the same signature.

What is the hash that should be signed, the whole transaction without the signature, do I have to exclude any fields?

For non-segwit inputs, the message that is signed is the entire transaction with all other input scripts empty. For the particular input being signed, the scriptPubKey or the redeemScript if there is one, is put in the input script. Then the sighash type is appended to the end. This is hashed twice and that hash is then signed.

For segwit, the message is a bit more complicated and described in BIP 143.

| improve this answer | |
  • If I have more than 1 input I have to sign more than one time? Also, If I use a different nonce, it will generate a diff R and S, will it still be valid? – Allan Romanato Mar 17 at 20:39
  • 1
    Yes. Each input will have its own message and require its own signatures. An input can have multiple signatures, in which case you will have the same message signed by multiple keys. With the nonces, any nonce can be used to produce a valid signature. It's why it can also be random. There is no single "correct" nonce or signature for a given message and private key. – Andrew Chow Mar 17 at 21:01
  • So if each input needs a signature, i will have to use the scriptPubKey for each in each signing iteration, and the others inputs empty, after all I insert each signature in the right place correct? Also if I have for example 3 inputs and 2 outputs or 1 input and 3 outputs, which scriptPubKey should I use? – Allan Romanato Mar 17 at 21:18
  • 1
    Please don’t write software handling money if this is the sum total of your understanding of the cryptography. – Anonymous Mar 17 at 21:40
  • 1
    You use the scriptPubKey of the output that is being spent. Each input refers to a specific output, you use the scriptPubKey of that output. Not the scriptPubkeys of the outputs that are created by the transaction. – Andrew Chow Mar 17 at 22:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.