15
votes
Accepted
Do we still need SIGHASH_NOINPUT for Lightning Network?
The lightning network as is is working without SIGHASH_NOINPUT. Thus in its current form it is not needed.
However Christian Decker came up with the eltoo payment channel construction. In a nutshell ...
- 11.9k
9
votes
Accepted
Why is the signature hash different for each input in a multi-input transaction?
Varying the signature per input helps prevents some attacks during multi-party transaction construction.
Consider a coinjoin involving Alice and Bob. Alice selects one of her UTXOs for the coinjoin. ...
- 466
7
votes
Accepted
Segwit includes the input amount in the SignatureHash. What possible attack can this prevent?
Consider a transaction that has 2 inputs and 1 output. Let's say that the inputs are both 1 BTC and the output is 1.5 BTC. This would mean that the transaction pays a 0.5 BTC fee, which is ridiculous.
...
- 72.2k
5
votes
Accepted
Is the Z value generated before the (r, s) values?
If by z you mean the hash of the message, then yes, z is required to compute s. Therefore, strictly speaking, you need to compute it before s, but not necessarily before r.
https://en.wikipedia.org/...
- 3,260
5
votes
Accepted
Can't verify Taproot signatures that use SIGHASH_ANYONECANPAY
It looks like your outpoints are serialized incorrectly. Txids are always displayed in reverse byte order, so when serializing them, they need to be in the reverse order of what everything displays ...
- 72.2k
5
votes
Accepted
Taproot Script Path - Multisig Invalid Schnorr Signature
The sighash for BIP342 script path spends is different from that of BIP341 key path spends.
From https://github.com/bitcoin/bips/blob/master/bip-0342.mediawiki#signature-validation:
If the sig is 64 ...
- 110k
4
votes
Accepted
How do you commit to the previous output's amount when signing a segwit input with rust-bitcoin?
There is a bitcoin::util::sighash module which has all of the sighashing stuff. I'm not certain that it is the correct way, but it is definitely a way to get the result that you want.
It looks like ...
- 72.2k
4
votes
Accepted
Where to find the sighash type?
Yes, it's generally part of the scriptSig.
More specifically, it's part of the signature pushed by the script.
Most specifically, it's the last byte of the signature.
- 110k
3
votes
Accepted
Trying to make SIGHASH_SINGLE transaction
I understand that second input can be not signed (really?).
No, it can and still must be signed. The use of SIGHASH_SINGLE does not remove the need to produce a valid signature. The script ...
- 72.2k
3
votes
Accepted
Taking the existing INPUT and changing the OUTPUT to steal bitcoins. Is this a possible bitcoin theft scenario and how to prevent it?
The digital signatures which are included in a transaction input to authorize the spending commit to (largely) the entire spending transaction. If any part of it changes (including which outputs are ...
- 110k
3
votes
Is SIGHASH_NONE encompassing of other signature types?
SIGHASH_NONE implies that Input 2 will only spend if Input 1 is included in the transaction.
This is false.
Input 2 is essentially a blank check. SIGHASH_NONE signs none of the outputs (I don't care ...
- 17.3k
3
votes
Accepted
Why hash witness script instead of pubkey script in signature?
I'm just guessing, but by having the transaction commit to the scriptCode, we ensure that the signer knows what script they're signing for. A hardware wallet, for example, can only be certain that ...
- 12.2k
3
votes
Code for computing SigHash for various input types
I have the following code laying around for the transaction 663becacc6368150a46725e404ccdfa34d1fffbececa784c31f0a7849b4dad08, which I picked off my mempool the other day, whose hex is:
...
- 721
2
votes
Question regarding the Z value of bitcoin Transaction
The result of an SHA256 operation is a typically presented as a 32-byte array or slice or similar structure. 32 x 8 = 256. It can be presented in software as an unsigned integer. It would arguably be ...
- 28.5k
2
votes
Accepted
What are the last bytes for in a taproot script-path sighash?
You'll find this in BIP342, under common signature message extension. BIP342 signatures reuse most of the BIP341 signature hash structure, but add a few fields of their own, as well as changing a flag ...
- 110k
2
votes
How do you calculate a taproot sighash?
From Pieter Wuille's answer, here's what the correct hash function from BIP340 should be:
import hashlib
def tagged_hash(tag: str, msg: bytes) -> bytes:
tag_hash = hashlib.sha256(tag.encode())....
- 829
2
votes
Accepted
How do you calculate a taproot sighash?
I believe you're missing the fact that the hash function used in BIP341/BIP342 is not SHA256 directly, but a tagged hash "hashTapSighash()".
From the BIP:
hashtag(x) notation to refer to ...
- 110k
2
votes
"mandatory-script-verify-flag-failed (signature must be zero for failed check(multi)sig operation)"
After some additional research and helpful information found here, I was able to conclude the following:
Transactions encoded on 0.12.X bitcoin and then broadcast on 0.15 bitcoin may encounter "...
- 51
2
votes
Why is the signature hash different for each input in a multi-input transaction?
I'd been wondering about this for quite a long time, since it was the reason behind the quadratic hashing problem. The best answer I found so far is the one given by Pieter Wuille in the Bitcoin talk ...
- 3,260
2
votes
Accepted
Can a transaction be dependent on another in the same block?
To accomplish this you could create a single transaction that you both supplies inputs to, and that creates an output paying to your multi sig address. In order for the transaction to be valid you ...
- 18.4k
2
votes
How long is SIGHASH?
So how long SIGHASH is?
The sighash type is a number (it is 1, 2, 3, 129, 130, 131; or since BIP341/BIP342 also 0). It doesn't have a length per se.
When computing the signature hash, the sighash ...
- 110k
2
votes
Accepted
sign native P2WPKH with bitcoinjs-lib (signing sighash) (non-mandatory-script-verify-flag)
i have fixed the problem by using a P2PKH output script for the sighash
const sighash = tx.hashForWitnessV0(
0, Buffer.from(utxo.scriptPubKey, 'hex'), utxo.amount, hashtype
);
has been changed to
...
- 287
2
votes
Accepted
Strange double-spending attack possibility
The signing of the transaction is done over the entire content of the transaction. Any subsequent changes to the transaction would invalidate that signature and thus the entire transaction.
It should ...
- 1,099
2
votes
Accepted
Do p2pk and SIGHASH_SINGLE still working nowadays?
Both P2PK and SIGHASH_SINGLE are still consensus valid and accepted by Bitcoin Core's default mempool policy. SIGHASH_SINGLE was even included in the Taproot soft fork for use in signatures in a ...
- 72.2k
2
votes
Hash-Preimage Construction for a two p2pkh Input transaction?
Yes, you are correct. When serializing the transaction for signing, the input you are targeting is set to the ScriptPubKey of the UTXO it is trying to spend, while the other inputs are left empty, ...
- 3,260
1
vote
Accepted
I cannot broadcast my raw tx (P2PKH) on testnet: Signature must be zero for failed CHECK(MULTI)SIG operation
The modified transaction you're hashing (raw_tx_string) is missing the output script (scriptPubKey_out), which is why the signature then fails to verify.
- 10.4k
1
vote
Accepted
Example of key-path BIP-0341 signature message computation
There are 4 issues:
Missing 0x00 prefix byte (epoch byte)
The message needs to be hashed before it can be signed. It should be a tagged hash with the tag "TapSighash".
The txid in your ...
- 72.2k
1
vote
Accepted
signing multiple input raw transaction - algorithm and sighash types
Do I understand correctly that both inputs are to be signed
separately?
yes
So first, we sign the first one, then the second one. To sign an input
we replace scriptSig for this input with the ...
- 6,835
1
vote
Accepted
Is it possible to reference an input outpoint more than once in a transaction?
No, this is not possible - once an outpoint is consumed by a transaction, it is considered spent, including within the same transaction.
Your only option here would be to have an intermediary ...
- 17.3k
1
vote
BIP118 (SIGHASH_NOINPUT) vs. ANYPREVOUT
The differences between SIGHASH_NOINPUT (BIP 118) and SIGHASH_ANYPREVOUT (proposed update to BIP 118) were discussed at the Sydney Socratic Seminar in July 2020.
There is not a real conflict between ...
- 15.8k
Only top scored, non community-wiki answers of a minimum length are eligible