<blockquote>
  <p>Do I need to provide a signature script for each input that proves that I own it? </p>
</blockquote>

<p>Only signing and checking signatures once for each public key, assuming signed with SIGHASH_ALL, seems like it would be safe, but I don't think there's any such optimization in the bitcoin code. If something was signed with SIGHASH_SINGLE, though, then it wouldn't be okay to assume that the owner of the key approves of all other outputs too.</p>

<blockquote>
  <p>Wouldn't that waste space?</p>
</blockquote>

<p>Yes, and signatures are the largest single component of a bitcoin transaction, so it's a non-negligible space too. At the same time, though, spending from two UTXOs that were sent to the same address probably isn't the most common type of transaction.</p>

<blockquote>
  <p>Also, in the standard client, are the signatures exactly the same, or are they two different but valid signatures?</p>
</blockquote>

<p>Looking at the <code>SignatureHash</code> code, the input <code>scripSig</code>s are all emptied and then only the one corresponding to the input that is being signed is filled with the previous scriptPubKey (for somewhat strange reasons). </p>

<pre><code>// Blank out other inputs' signatures
for (unsigned int i = 0; i &lt; txTmp.vin.size(); i++)
    txTmp.vin[i].scriptSig = CScript();
txTmp.vin[nIn].scriptSig = scriptCode;
</code></pre>

<p>This makes it so that the hash that needs to be signed (the result of <code>SignatureHash</code>) is different for each input. Thus, since different data is being signed, the signatures will most definitely be different. Even if the data being signed were the same, ECC signatures are non-deterministic (involving a random number) and so will not be the same from signing to signing. </p>

<hr>

<p>EDIT: The long and short of it is that the double hash that needs to be signed is different for each input in the new transaction, so even if the same key pair is being used, a new signature must be calculated. </p>

CC BY-SA 3.0
2014-11-07T06:00:47.667Z
`hash that needs to be signed ... is different for each input` Seriously? Does that mean that later signatures depend on previous signatures?
Nick ODell
CC BY-SA 3.0
2014-11-07T06:01:38.773Z
P.S. The code you quoted [appears to no longer be used.](https://github.com/bitcoin/bitcoin/blob/eecd3c0fb0625b036f68a7830dda8edde21fcb90/src/test/sighash_tests.cpp#L38)
Nick ODell
CC BY-SA 3.0
2014-11-07T06:05:51.083Z
The signatures don't depend on other signatures, the hashes that need to be signed can all be calculated ahead of time, and will be different just because the index of the spending from them is different. Where is the code that is used now to get the SignatureHash?
morsecoder
CC BY-SA 3.0
2014-11-07T06:13:00.807Z
[CTransactionSignatureSerializer::Serialize](https://github.com/bitcoin/bitcoin/blob/73b82a30892224b17aa1b9db9b6de4eeeb903b7f/src/script/interpreter.cpp#L941) called by [CHashWriter::operator<<](https://github.com/bitcoin/bitcoin/blob/be32b5212b6ab4460080ec5ff55e2bf882259e5e/src/hash.h#L146). I think.
Nick ODell
CC BY-SA 3.0
2014-11-07T06:13:24.500Z
That looks right. It's now encapsulated in a fancy Serialization object in Interpreter.cpp (https://github.com/bitcoin/bitcoin/blob/73b82a30892224b17aa1b9db9b6de4eeeb903b7f/src/script/interpreter.cpp).
morsecoder
CC BY-SA 3.0
2014-11-07T05:41:12.203Z
2014-11-10T15:26:45.900Z
2014-11-10T15:26:45.900Z
morsecoder
<p>Suppose I have two inputs belonging to the same address. </p>

<ul>
<li>Do I need to provide a signature script for each input that proves that I own it? Wouldn't that waste space? Also, in the standard client, are the signatures exactly the same, or are they two different but valid signatures?</li>
<li>Or can I prove that I own that address just once?</li>
</ul>

<transactions><signature>
If I am spending multiple inputs from the same address, must I provide a signature for each input?
Nick ODell
# If I am spending multiple inputs from the same address, must I provide a signature for each input?

(Asked by: username_0 on 2014-11-07)

Suppose I have two inputs belonging to the same address.

* Do I need to provide a signature script for each input that proves that I own it? Wouldn't that waste space? Also, in the standard client, are the signatures exactly the same, or are they two different but valid signatures?
* Or can I prove that I own that address just once?

**Tags:** transactions, signature


---

## 1 answers

### Answer by username_1 on 2014-11-07. Score: 2 | Accepted answer

> Do I need to provide a signature script for each input that proves that I own it?

Only signing and checking signatures once for each public key, assuming signed with SIGHASH\_ALL, seems like it would be safe, but I don't think there's any such optimization in the bitcoin code. If something was signed with SIGHASH\_SINGLE, though, then it wouldn't be okay to assume that the owner of the key approves of all other outputs too.

> Wouldn't that waste space?

Yes, and signatures are the largest single component of a bitcoin transaction, so it's a non-negligible space too. At the same time, though, spending from two UTXOs that were sent to the same address probably isn't the most common type of transaction.

> Also, in the standard client, are the signatures exactly the same, or are they two different but valid signatures?

Looking at the `SignatureHash` code, the input `scripSig`s are all emptied and then only the one corresponding to the input that is being signed is filled with the previous scriptPubKey (for somewhat strange reasons).

```
// Blank out other inputs' signatures
for (unsigned int i = 0; i < txTmp.vin.size(); i++)
    txTmp.vin[i].scriptSig = CScript();
txTmp.vin[nIn].scriptSig = scriptCode;

```

This makes it so that the hash that needs to be signed (the result of `SignatureHash`) is different for each input. Thus, since different data is being signed, the signatures will most definitely be different. Even if the data being signed were the same, ECC signatures are non-deterministic (involving a random number) and so will not be the same from signing to signing.

---

EDIT: The long and short of it is that the double hash that needs to be signed is different for each input in the new transaction, so even if the same key pair is being used, a new signature must be calculated.

> **Comments:**
> **username_0**: `hash that needs to be signed ... is different for each input` Seriously? Does that mean that later signatures depend on previous signatures?  
> **username_0**: P.S. The code you quoted [appears to no longer be used.](https://github.com/bitcoin/bitcoin/blob/eecd3c0fb0625b036f68a7830dda8edde21fcb90/src/test/sighash_tests.cpp#L38)  
> **username_1**: The signatures don't depend on other signatures, the hashes that need to be signed can all be calculated ahead of time, and will be different just because the index of the spending from them is different. Where is the code that is used now to get the SignatureHash?  
> **username_0**: [CTransactionSignatureSerializer::Serialize](https://github.com/bitcoin/bitcoin/blob/73b82a30892224b17aa1b9db9b6de4eeeb903b7f/src/script/interpreter.cpp#L941) called by [CHashWriter::operator<<](https://github.com/bitcoin/bitcoin/blob/be32b5212b6ab4460080ec5ff55e2bf882259e5e/src/hash.h#L146). I think.  
> **username_1**: That looks right. It's now encapsulated in a fancy Serialization object in Interpreter.cpp (https://github.com/bitcoin/bitcoin/blob/73b82a30892224b17aa1b9db9b6de4eeeb903b7f/src/script/interpreter.cpp).  

---

