<p>Remember that 'scriptPubKey' and 'scriptSig' are scripts.  They are intended to be executed by an interpreter.  The reason your naive attempt didn't work, is because these values are <em>not</em> simple numbers, but are executable lines of code.</p>

<p>What happens, is that <code>scriptSig</code> is executed first, leaving values on the stack.  Then <code>scriptPubKey</code> is executed to check if the values left by <code>scriptSig</code> are valid.  Because <code>scriptPubKey</code> is the script specified by the output being spent, it <em>encumbers</em> the bitcoins, and is also called the <em>encumbrance script</em>.  So whoever last spent the bitcoins, gets to decide the terms by which the bitcoins are encumbered.  Usually it says something like "pay this output to whosoever has the private key that matches this public key"...but it doesn't have to.  This is how the system can handle multisig transaction, storing data, smart contracts, and multiple types of payments.  It's actually fairly complicated, which is why there is a <a href="https://en.bitcoin.it/wiki/Script" rel="nofollow">programming language</a> used rather than static keys and signatures.</p>

<p>Unfortunately, the best reference on how this code executes would be the <a href="https://github.com/bitcoin/bitcoin/blob/master/src/script/interpreter.cpp" rel="nofollow"><code>interpreter.cpp</code></a> file of the <a href="https://github.com/bitcoin/bitcoin" rel="nofollow">reference client</a> (<a href="https://bitcoin.org/en/bitcoin-core/" rel="nofollow">Bitcoin Core</a>).  I know that's probably not the answer you were looking for, but this is really at the heart of what makes Bitcoin so flexible.</p>

CC BY-SA 3.0
2016-10-11T17:52:25.900Z
2016-10-11T17:52:25.900Z
Jestin
<p>Point is, that the TX is not "the input to spend that output ...". amaclin has provided correct link, the hash is calculated over un unsigned transaction, which follows specific rules. If you have more than one input (as in this case), the logic is well explained by Nathan:
<a href="https://bitcoin.stackexchange.com/questions/41209/how-to-sign-a-transaction-with-multiple-inputs">How to sign a transaction with multiple inputs?</a>
So you would have to deconstruct the TX, create the hash over it, and then run your code...</p>

CC BY-SA 3.0
2016-11-17T23:01:00.937Z
2016-11-24T15:27:57.610Z
2017-04-13T12:47:33.283Z
pebwindkraft
<h2>First transaction</h2>

<p>Given a transaction on the blockchain: 
<code>3a1b9e330d32fef1ee42f8e86420d2be978bbe0dc5862f17da9027cf9e11f8c4</code></p>

<p>One of the outputs transfers 424,242.42424242 BTC to <code>1eHhgW6vquBYhwMPhQ668HPjxTtpvZGPC</code></p>

<p><strong>scriptPubKey:</strong> </p>

<pre><code>OP_DUP OP_HASH160 070d550bc5bc843149410b8863b5b72857d91439 OP_EQUALVERIFY OP_CHECKSIG 
</code></pre>

<h2>Second transaction</h2>

<p>And the input to spend that output is in this transaction: <code>7a2a6f66e87ed4e72d85ba7a82eda1572605c3330c461e171f58d7ff2763ac63</code></p>

<p><strong>scriptSig:</strong></p>

<pre><code>30450221009c45573098c41e5ebd1e41fea5f6d0f96c7833a631c7ae890de328ca7e643a79022037cb1736d6aeeed517b234a16d731072cddf1917947dab25776a0f6dff9d741f01 
041b4c38a55f7d3de915a0732c2237e13349c17250c05b4803e147fcee08ebad75fa76cfcde6aa5f45cde1201f63920c3625c6cba17c42ce052c07cdea0607f488
</code></pre>

<h2>Question</h2>

<p>How does one go about manually verifying the signature with ECDSA given the signature, public key, and the two transactions?</p>

<p>My naive attempt using pybitcointools:</p>

<pre><code>&gt;&gt;&gt; from bitcoin import *
&gt;&gt;&gt; public_key = '041b4c38a55f7d3de915a0732c2237e13349c17250c05b4803e147fcee08ebad75fa76cfcde6aa5f45cde1201f63920c3625c6cba17c42ce052c07cdea0607f488'
&gt;&gt;&gt; sig = '30450221009c45573098c41e5ebd1e41fea5f6d0f96c7833a631c7ae890de328ca7e643a79022037cb1736d6aeeed517b234a16d731072cddf1917947dab25776a0f6dff9d741f01'
&gt;&gt;&gt; tx = '7a2a6f66e87ed4e72d85ba7a82eda1572605c3330c461e171f58d7ff2763ac63'
&gt;&gt;&gt; print ecdsa_verify(tx, sig, public_key)
False
</code></pre>

<p>It might be that I have to go through this diagram to construct the "message" to use in verification: <a href="https://dl.dropboxusercontent.com/u/1139081/BitcoinImg/OpCheckSigDiagram.png" rel="nofollow">https://dl.dropboxusercontent.com/u/1139081/BitcoinImg/OpCheckSigDiagram.png</a></p>

<p>Thanks in advance for any help on this!</p>

CC BY-SA 3.0
2016-10-12T09:21:38.517Z
have a look: http://bitcoin.stackexchange.com/questions/32305
amaclin
<script><signature>
How to manually verify a signature given scriptSig and scriptPubKey?
Justin O'Brien
# How to manually verify a signature given scriptSig and scriptPubKey?

(Asked by: username_0 on 2016-10-11)

## First transaction

Given a transaction on the blockchain:
`3a1b9e330d32fef1ee42f8e86420d2be978bbe0dc5862f17da9027cf9e11f8c4`

One of the outputs transfers 424,242.42424242 BTC to `1eHhgW6vquBYhwMPhQ668HPjxTtpvZGPC`

**scriptPubKey:**

```
OP_DUP OP_HASH160 070d550bc5bc843149410b8863b5b72857d91439 OP_EQUALVERIFY OP_CHECKSIG 

```

## Second transaction

And the input to spend that output is in this transaction: `7a2a6f66e87ed4e72d85ba7a82eda1572605c3330c461e171f58d7ff2763ac63`

**scriptSig:**

```
30450221009c45573098c41e5ebd1e41fea5f6d0f96c7833a631c7ae890de328ca7e643a79022037cb1736d6aeeed517b234a16d731072cddf1917947dab25776a0f6dff9d741f01 
041b4c38a55f7d3de915a0732c2237e13349c17250c05b4803e147fcee08ebad75fa76cfcde6aa5f45cde1201f63920c3625c6cba17c42ce052c07cdea0607f488

```

## Question

How does one go about manually verifying the signature with ECDSA given the signature, public key, and the two transactions?

My naive attempt using pybitcointools:

```
>>> from bitcoin import *
>>> public_key = '041b4c38a55f7d3de915a0732c2237e13349c17250c05b4803e147fcee08ebad75fa76cfcde6aa5f45cde1201f63920c3625c6cba17c42ce052c07cdea0607f488'
>>> sig = '30450221009c45573098c41e5ebd1e41fea5f6d0f96c7833a631c7ae890de328ca7e643a79022037cb1736d6aeeed517b234a16d731072cddf1917947dab25776a0f6dff9d741f01'
>>> tx = '7a2a6f66e87ed4e72d85ba7a82eda1572605c3330c461e171f58d7ff2763ac63'
>>> print ecdsa_verify(tx, sig, public_key)
False

```

It might be that I have to go through this diagram to construct the "message" to use in verification: <https://dl.dropboxusercontent.com/u/1139081/BitcoinImg/OpCheckSigDiagram.png>

Thanks in advance for any help on this!

**Tags:** script, signature

> **Comments:**
> **username_1**: have a look: http://bitcoin.stackexchange.com/questions/32305  

---

## 2 answers

### Answer by username_2 on 2016-10-11. Score: 3

Remember that 'scriptPubKey' and 'scriptSig' are scripts. They are intended to be executed by an interpreter. The reason your naive attempt didn't work, is because these values are *not* simple numbers, but are executable lines of code.

What happens, is that `scriptSig` is executed first, leaving values on the stack. Then `scriptPubKey` is executed to check if the values left by `scriptSig` are valid. Because `scriptPubKey` is the script specified by the output being spent, it *encumbers* the bitcoins, and is also called the *encumbrance script*. So whoever last spent the bitcoins, gets to decide the terms by which the bitcoins are encumbered. Usually it says something like "pay this output to whosoever has the private key that matches this public key"...but it doesn't have to. This is how the system can handle multisig transaction, storing data, smart contracts, and multiple types of payments. It's actually fairly complicated, which is why there is a [programming language](https://en.bitcoin.it/wiki/Script) used rather than static keys and signatures.

Unfortunately, the best reference on how this code executes would be the [`interpreter.cpp`](https://github.com/bitcoin/bitcoin/blob/master/src/script/interpreter.cpp) file of the [reference client](https://github.com/bitcoin/bitcoin) ([Bitcoin Core](https://bitcoin.org/en/bitcoin-core/)). I know that's probably not the answer you were looking for, but this is really at the heart of what makes Bitcoin so flexible.


---

### Answer by username_3 on 2016-11-17. Score: 0

Point is, that the TX is not "the input to spend that output ...". username_1 has provided correct link, the hash is calculated over un unsigned transaction, which follows specific rules. If you have more than one input (as in this case), the logic is well explained by Nathan:
[How to sign a transaction with multiple inputs?](https://bitcoin.stackexchange.com/questions/41209/how-to-sign-a-transaction-with-multiple-inputs)
So you would have to deconstruct the TX, create the hash over it, and then run your code...


---

