0

As I could understand, we can recover the R and the S values from any transaction following the ScriptSig where we have DER serialization.

  1. Segwit transactions, where the signature will be in the witness section, recovering R and S follow the same steps?
  2. If I use the compressed public key (starting with 0x02 or 0x03) how can I verify the signature, since I don't have the Y coordinate of the public key?
  3. For multi-sig transactions using P2SH as I understand we need to sign with the first key, then get the output transaction with the first signature and sign it with the other key, but using the signature math we use the hash of the message which is the txId, but on segwit the txid will not change after signing since the witness is not counting as part of the hash for txid?

Any other thing that I should look when signing a transaction?

Allan Romanato
  • 332
  • 1
  • 14

2 Answers2

1

  1. Yes

  2. Most of crypto-libraries have the verify method. You can pass the compressed public key as an input. BTW, it is possible to recover Y part from compressed public key

  3. No. For multisig P2SH (and any other type) we (a)calculate the digest, (b)sign this digest with private keys and (c)create the final transaction from all parts. We do not need to use any signatures on step (b) as a source for calculations

Any other thing that I should look when signing a transaction?

How to redeem a basic Tx?

amaclin
  • 6,760
  • 1
  • 21
  • 32
  • On 2. I am not using any libraries, how can I recover the Y part using just the compressed key? On 3, what would be this digest? – Allan Romanato Feb 19 '20 at 17:48
1
  1. In any transaction you'll have the signature inside scriptsig using a push OP to indicate its length and in a SegWit tx you'll have it as a witness item with a CompactInt to indicate its length. After extracting the signature it is only a matter of decoding DER.
  2. To get the full (x,y) coordinates you have to use the elliptic curve equation (y^2 = x^3 + ax + b) to compute y by only having x. ECDSA x,y coordinate validity verification doesn't seem to work
  3. To sign a transaction, a modified serialization is always used as the data to be hashed and then signed not the original transaction (in other words the resulting hash will be different from txid). This is true for all standard scripts such as P2PK, P2PKH, P2SH, P2WPKH, P2WSH,... The only difference is the modification and serialization. In legacy ones (the first 3) the procedure is described in OP_CheckSig on bitcoin wiki and the SegWit ones are defined in BIP-143.
Coding Enthusiast
  • 1,438
  • 5
  • 23