15 votes
Accepted

Do we still need SIGHASH_NOINPUT for Lightning Network?

The lightning network as is is working without SIGHASH_NOINPUT. Thus in its current form it is not needed. However Christian Decker came up with the eltoo payment channel construction. In a nutshell ...
Rene Pickhardt's user avatar
9 votes
Accepted

Why is the signature hash different for each input in a multi-input transaction?

Varying the signature per input helps prevents some attacks during multi-party transaction construction. Consider a coinjoin involving Alice and Bob. Alice selects one of her UTXOs for the coinjoin. ...
Russell O'Connor's user avatar
7 votes
Accepted

Segwit includes the input amount in the SignatureHash. What possible attack can this prevent?

Consider a transaction that has 2 inputs and 1 output. Let's say that the inputs are both 1 BTC and the output is 1.5 BTC. This would mean that the transaction pays a 0.5 BTC fee, which is ridiculous. ...
Ava Chow's user avatar
  • 70.4k
5 votes
Accepted

Is the Z value generated before the (r, s) values?

If by z you mean the hash of the message, then yes, z is required to compute s. Therefore, strictly speaking, you need to compute it before s, but not necessarily before r. https://en.wikipedia.org/...
sr_gi's user avatar
  • 3,220
5 votes
Accepted

Can't verify Taproot signatures that use SIGHASH_ANYONECANPAY

It looks like your outpoints are serialized incorrectly. Txids are always displayed in reverse byte order, so when serializing them, they need to be in the reverse order of what everything displays ...
Ava Chow's user avatar
  • 70.4k
5 votes
Accepted

Taproot Script Path - Multisig Invalid Schnorr Signature

The sighash for BIP342 script path spends is different from that of BIP341 key path spends. From https://github.com/bitcoin/bips/blob/master/bip-0342.mediawiki#signature-validation: If the sig is 64 ...
Pieter Wuille's user avatar
4 votes
Accepted

How do you commit to the previous output's amount when signing a segwit input with rust-bitcoin?

There is a bitcoin::util::sighash module which has all of the sighashing stuff. I'm not certain that it is the correct way, but it is definitely a way to get the result that you want. It looks like ...
Ava Chow's user avatar
  • 70.4k
3 votes

Code for computing SigHash for various input types

I have the following code laying around for the transaction 663becacc6368150a46725e404ccdfa34d1fffbececa784c31f0a7849b4dad08, which I picked off my mempool the other day, whose hex is: ...
Andrew Poelstra's user avatar
3 votes
Accepted

Trying to make SIGHASH_SINGLE transaction

I understand that second input can be not signed (really?). No, it can and still must be signed. The use of SIGHASH_SINGLE does not remove the need to produce a valid signature. The script ...
Ava Chow's user avatar
  • 70.4k
3 votes
Accepted

Taking the existing INPUT and changing the OUTPUT to steal bitcoins. Is this a possible bitcoin theft scenario and how to prevent it?

The digital signatures which are included in a transaction input to authorize the spending commit to (largely) the entire spending transaction. If any part of it changes (including which outputs are ...
Pieter Wuille's user avatar
3 votes
Accepted

Where to find the sighash type?

Yes, it's generally part of the scriptSig. More specifically, it's part of the signature pushed by the script. Most specifically, it's the last byte of the signature.
Pieter Wuille's user avatar
3 votes

Is SIGHASH_NONE encompassing of other signature types?

SIGHASH_NONE implies that Input 2 will only spend if Input 1 is included in the transaction. This is false. Input 2 is essentially a blank check. SIGHASH_NONE signs none of the outputs (I don't care ...
Raghav Sood's user avatar
3 votes
Accepted

Why hash witness script instead of pubkey script in signature?

I'm just guessing, but by having the transaction commit to the scriptCode, we ensure that the signer knows what script they're signing for. A hardware wallet, for example, can only be certain that ...
David A. Harding's user avatar
2 votes

"mandatory-script-verify-flag-failed (signature must be zero for failed check(multi)sig operation)"

After some additional research and helpful information found here, I was able to conclude the following: Transactions encoded on 0.12.X bitcoin and then broadcast on 0.15 bitcoin may encounter "...
xagau's user avatar
  • 51
2 votes

Why is the signature hash different for each input in a multi-input transaction?

I'd been wondering about this for quite a long time, since it was the reason behind the quadratic hashing problem. The best answer I found so far is the one given by Pieter Wuille in the Bitcoin talk ...
sr_gi's user avatar
  • 3,220
2 votes
Accepted

How do you calculate a taproot sighash?

I believe you're missing the fact that the hash function used in BIP341/BIP342 is not SHA256 directly, but a tagged hash "hashTapSighash()". From the BIP: hashtag(x) notation to refer to ...
Pieter Wuille's user avatar
2 votes
Accepted

Can a transaction be dependent on another in the same block?

To accomplish this you could create a single transaction that you both supplies inputs to, and that creates an output paying to your multi sig address. In order for the transaction to be valid you ...
chytrik's user avatar
  • 18.3k
2 votes

How long is SIGHASH?

So how long SIGHASH is? The sighash type is a number (it is 1, 2, 3, 129, 130, 131; or since BIP341/BIP342 also 0). It doesn't have a length per se. When computing the signature hash, the sighash ...
Pieter Wuille's user avatar
2 votes
Accepted

sign native P2WPKH with bitcoinjs-lib (signing sighash) (non-mandatory-script-verify-flag)

i have fixed the problem by using a P2PKH output script for the sighash const sighash = tx.hashForWitnessV0( 0, Buffer.from(utxo.scriptPubKey, 'hex'), utxo.amount, hashtype ); has been changed to ...
Antoni's user avatar
  • 287
2 votes
Accepted

Strange double-spending attack possibility

The signing of the transaction is done over the entire content of the transaction. Any subsequent changes to the transaction would invalidate that signature and thus the entire transaction. It should ...
dassd's user avatar
  • 1,069
2 votes
Accepted

Do p2pk and SIGHASH_SINGLE still working nowadays?

Both P2PK and SIGHASH_SINGLE are still consensus valid and accepted by Bitcoin Core's default mempool policy. SIGHASH_SINGLE was even included in the Taproot soft fork for use in signatures in a ...
Ava Chow's user avatar
  • 70.4k
2 votes

Question regarding the Z value of bitcoin Transaction

The result of an SHA256 operation is a typically presented as a 32-byte array or slice or similar structure. 32 x 8 = 256. It can be presented in software as an unsigned integer. It would arguably be ...
RedGrittyBrick's user avatar
2 votes
Accepted

What are the last bytes for in a taproot script-path sighash?

You'll find this in BIP342, under common signature message extension. BIP342 signatures reuse most of the BIP341 signature hash structure, but add a few fields of their own, as well as changing a flag ...
Pieter Wuille's user avatar
1 vote
Accepted

I cannot broadcast my raw tx (P2PKH) on testnet: Signature must be zero for failed CHECK(MULTI)SIG operation

The modified transaction you're hashing (raw_tx_string) is missing the output script (scriptPubKey_out), which is why the signature then fails to verify.
Vojtěch Strnad's user avatar
1 vote
Accepted

Example of key-path BIP-0341 signature message computation

There are 4 issues: Missing 0x00 prefix byte (epoch byte) The message needs to be hashed before it can be signed. It should be a tagged hash with the tag "TapSighash". The txid in your ...
Ava Chow's user avatar
  • 70.4k
1 vote

How do you calculate a taproot sighash?

From Pieter Wuille's answer, here's what the correct hash function from BIP340 should be: import hashlib def tagged_hash(tag: str, msg: bytes) -> bytes: tag_hash = hashlib.sha256(tag.encode())....
Darius's user avatar
  • 789
1 vote
Accepted

signing multiple input raw transaction - algorithm and sighash types

Do I understand correctly that both inputs are to be signed separately? yes So first, we sign the first one, then the second one. To sign an input we replace scriptSig for this input with the ...
amaclin's user avatar
  • 6,760
1 vote
Accepted

Is it possible to reference an input outpoint more than once in a transaction?

No, this is not possible - once an outpoint is consumed by a transaction, it is considered spent, including within the same transaction. Your only option here would be to have an intermediary ...
Raghav Sood's user avatar
1 vote

BIP118 (SIGHASH_NOINPUT) vs. ANYPREVOUT

The differences between SIGHASH_NOINPUT (BIP 118) and SIGHASH_ANYPREVOUT (proposed update to BIP 118) were discussed at the Sydney Socratic Seminar in July 2020. There is not a real conflict between ...
Michael Folkson's user avatar
1 vote

SignatureHash description

In this particular case, the parameter script code refers to a public key script. Usually, the function SignatureHash is invoked to either sign a transaction or to verify a signature. Thus it refers ...
christianb93's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible