OP CHECKSIG

DISCLAIMER

This article is a direct copy of the article at https://en.bitcoin.it/w/index.php?title=OP_CHECKSIG and has not been checked for correctness or edited. 24 September 2019 Expected review by: 15 October 2019

OP_CHECKSIG is an opcode used to verify that the ECDSA signature in a transaction input is valid. OP_CHECKSIG expects two values to be on the stack, the public key (on the top of the stack) and the signature. These two values are normally obtained by running the scriptSig script of the transaction input we are attempting to validate. The scriptSig script is deleted after it is run, but the stack is left as is. Then, the scriptPubKey script from the previous transaction output that is now being spent is run, generally concluding in an OP_CHECKSIG.

The standard scriptPubKey checks that the public key (actually a hash of) is a particular value, and that OP_CHECKSIG passes.

For normal transaction inputs, if the creator of the current transaction can successfully create a ScriptSig signature that uses the right public key for the ScriptPubKey of the transaction output they are attempting to spend, that transaction input is considered valid.

Parameters

In addition to the stack parameters and the script code itself, in order to operate correctly OP_CHECKSIG needs to know the current transaction and the index of current transaction input.

How it works

Firstly always this (the default) procedure is applied:

File:Bitcoin OpCheckSig InDetail.png

Signature verification process of the default procedure

1. the public key and the signature are popped from the stack, in that order. Signature format is [<DER signature> <1 byte hash-type>]. Hashtype value is last byte of the sig.
2. A new subScript is created from the scriptCode (the scriptCode is the actually executed script - either the scriptPubKey for non-segwit, non-P2SH scripts, or the redeemscript in non-segwit P2SH scripts). The script from the immediately after the most recently parsed OP_CODESEPARATOR to the end of the script is the subScript. If there is no OP_CODESEPARATOR the entire script becomes the subScript
3. Any occurrences of sig are deleted from subScript, if present (it is not standard to have a signature in an input script of a transaction)
4. Any remaining OP_CODESEPARATORS are removed from subScript
5. The hashtype is removed from the last byte of the sig and stored
6. A copy is made of the current transaction (hereby referred to txCopy)
7. The scripts for all transaction inputs in txCopy are set to empty scripts (exactly 1 byte 0x00)
8. The script for the current transaction input in txCopy is set to subScript (lead in by its length as a var-integer encoded!)

Now depending on the hashtype various things can happen to txCopy, these will be discussed individually.

Hashtype Values (from script.h):

Name	Value
SIGHASH_ALL	0x00000001
SIGHASH_NONE	0x00000002
SIGHASH_SINGLE	0x00000003
SIGHASH_ANYONECANPAY	0x00000080

1. If (hashtype&31) = SIGHASH_NONE then apply the SIGHASH_NONE-procedure
2. If (hashtype&31) = SIGHASH_SINGLE then apply the SIGHASH_SINGLE-procedure
3. If hashtype & SIGHASH_ANYONECANPAY then apply the SIGHASH_ANYONECANPAY-procedure

Hence, hashtype SIGHASH_ANYONECANPAY may be applied also after any other hashtype-procedure<ref>file src/src/script.cpp in bitcoin-0.7.1</ref>. Besides the four listed hashtypes only a hashtype of value 0 appears a few times in the (main) block chain (and is handled like SIGHASH_ALL).

Hashtype SIGHASH_ALL (default)

No special further handling occurs in the default case. Think of this as "sign all of the outputs." Which is already done by the default procedure.

Procedure for Hashtype SIGHASH_NONE

1. The output of txCopy is set to a vector of zero size.
2. All other inputs aside from the current input in txCopy have their nSequence index set to zero

Think of this as "sign none of the outputs-- I don't care where the bitcoins go."

Procedure for Hashtype SIGHASH_SINGLE

1. The output of txCopy is resized to the size of the current input index+1.
2. All other txCopy outputs aside from the output that is the same as the current input index are set to a blank script and a value of (long) -1.
3. All other txCopy inputs aside from the current input are set to have an nSequence index of zero.

Think of this as "sign one of the outputs-- I don't care where the other outputs go".

Note: The transaction that uses SIGHASH_SINGLE type of signature should not have more inputs than outputs. However if it does (because of the pre-existing implementation), it shall not be rejected, but instead for every "illegal" input (meaning: an input that has an index bigger than the maximum output index) the node should still verify it, though assuming the hash of 0000000000000000000000000000000000000000000000000000000000000001 [1]

Procedure for Hashtype SIGHASH_ANYONECANPAY

1. The txCopy input vector is resized to a length of one.
2. The current transaction input (with scriptPubKey modified to subScript) is set as the first and only member of this vector.

Think of this as "Let other people add inputs to this transaction, I don't care where the rest of the bitcoins come from."

Final signature check

An array of bytes is constructed from the serialized txCopy appended by four bytes for the hash type. This array is sha256 hashed twice, then the public key is used to check the supplied signature against the hash. The secp256k1 elliptic curve is used for the verification with the given public key.

Return values

OP_CHECKSIG will push true to the stack if the check passed, false otherwise. OP_CHECKSIG_VERIFY leaves nothing on the stack but will cause the script eval to fail immediately if the check does not pass.

References

<references/>