<p>The signature you produced is correct but for a wrong "message", which is the only mistake that I could find. This is what you sign:  </p>

<pre><code>f64b6480a2888596636d4995153e990ce95582a1308c9c568d2698e6dc1f7893
</code></pre>

<p>Which is wrong (since you reversed the has result). Instead you should have signed the actual result you get from your <code>SHA256(SHA256(&lt;bytes&gt;))</code> to your signing function, meaning this instead:  </p>

<pre><code>93781fdce698268d569c8c30a18255e90c993e1595496d63968588a280644bf6
</code></pre>

<p>There are a couple of places where we reverse the hash result and this is not one of them. Here you are simply hashing the serialized transaction to turn the size of it from an arbitrary length to a fixed 32 byte size so that you can sign it using ECDSA scheme.  </p>

<p>There is an additional possible problem with directly using BouncyCastle or any similar library that are designed for cryptography in general not for bitcoin, where the signature they return may have an <code>s</code> value (the second <code>BigInteger</code> in your signature) that is bigger than curve <code>N/2</code>. In which case you will have to change it to <code>s'</code> by calculating <code>s' = N - s</code>.</p>

CC BY-SA 4.0
2019-04-17T07:39:56.063Z
2019-04-17T07:39:56.063Z
Coding Enthusiast
<p>Why don't you use <a href="https://github.com/MetacoSA/NBitcoin" rel="nofollow noreferrer">NBitcoin</a> library to create a raw transaction and post it to blockr.io or whatever API provider you're using? NBitcoin is a great library for C# cryptocurrency developers. </p>

CC BY-SA 4.0
2018-10-04T14:53:02.150Z
2018-10-04T14:53:02.150Z
Hao Nguyen
<p>First time on stackexchange to ask for help, sorry if i make mistakes (english is not my native language).</p>

<p>I try to create a valid raw transaction on C# with bouncycastle and i seems stuck, not able to find where is my mistake.
I test on the testnet network and have used many sources to help myself, <a href="https://bitcoin.stackexchange.com/questions/32628/redeeming-a-raw-transaction-step-by-step-example-required">mainly this one</a>.
For start, i have the next address and private key</p>

<pre><code>Address: mjhcWg5SvS96kk85R8G1wp7mru55UCNGY5
Public Key Hex: 0482052EF9560585ED62F046EE45C1B5F85448BCF1BD5CE36A7D35EB00C8A146C14BF99223907F9A8688E6F84B54FD747A637BB82F02E296203E735E7A6B40059F
Wif: 93U5P1qHPXAhXhiw1T15z3f1cBqFw9fWrd3Yzz1nDk8b2aRbrrM 
Private Key Hex: F7DBD21285F621F1C7A47AE7F63D06C276FE49839F4842DDEF805477936812A5
</code></pre>

<p>i want to use the 6.49689241 btc from the previous (testnet) transaction </p>

<pre><code>912a2c3d84c8572b39c173b2bcde950cfe4ae07756bac189ace98f198d5ccb7d
</code></pre>

<p>and send (as test) some back to the faucet mwCwTceJvYV27KXBc3NJZys6CjsgsoeHmf</p>

<p>First, to build the unsigned raw transaction, i add these bytes:</p>

<pre><code>01000000 (version number)
01 (number of inputs)
7dcb5c8d198fe9ac89c1ba5677e04afe0c95debcb273c1392b57c8843d2c2a91 (reversed previous tx hash)
01000000 (output index)
1976a9142de490b09ef14673af2bb4998fcb9f6b8446a84e88ac (previous tx script with its length at start) 
ffffffff (sequence)
02 (number of outputs)
496ff50200000000 (first output little endian amount. The faucet)
1976a914ac19d3fd17710e6b9a331022fe92c693fdf6659588ac (first output script with its length at start)
0046c32300000000 (second output little endian amount. My address, for change)
1976a9142de490b09ef14673af2bb4998fcb9f6b8446a84e88ac  (second script with its length at start)
00000000 (locktime)
01000000 (hash code type)
</code></pre>

<p>The result is</p>

<pre><code>01000000017dcb5c8d198fe9ac89c1ba5677e04afe0c95debcb273c1392b57c8843d2c2a91010000001976a9142de490b09ef14673af2bb4998fcb9f6b8446a84e88acffffffff02496ff502000000001976a914ac19d3fd17710e6b9a331022fe92c693fdf6659588ac0046c323000000001976a9142de490b09ef14673af2bb4998fcb9f6b8446a84e88ac0000000001000000
</code></pre>

<p>I then retrieve the transaction hash by pushing the raw transaction in a double SHA256 function that return me</p>

<pre><code>f64b6480a2888596636d4995153e990ce95582a1308c9c568d2698e6dc1f7893
</code></pre>

<p>Then, i sign with the private key hex (prvkeyHex) the transaction hash (txHash) with this function:</p>

<pre><code>X9ECParameters curve = SecNamedCurves.GetByName("secp256k1");
ECDomainParameters dom = new ECDomainParameters(curve.Curve, curve.G, curve.N, curve.H)
ECKeyParameters params = new ECPrivateKeyParameters(new BigInteger(1, prvkeyHex), dom);
ECDsaSigner signer = new ECDsaSigner();
signer.Init(true, params);
BigInteger[] sig = signer.GenerateSignature(txHash);
MemoryStream ms = new MemoryStream(72);
DerSequenceGenerator seq = new DerSequenceGenerator(ms);
seq.AddObject(new DerInteger(sig[0]));
seq.AddObject(new DerInteger(sig[1]));
seq.Close();
byte[] signature = ms.ToArray();
</code></pre>

<p>Which return me a byte array of max 72 bytes length starting by 30. In my last test:</p>

<pre><code>3045022100abceff62d3192b686c405d10516ff0e6f9ff221c00284d766200a6abb42361be02202972970369d6b9308467e15ebafd3f6b9faf111886071e3c429b34e9407e8d23
</code></pre>

<p>I then construct my final scriptSig with the public key hex and their lengths who result as</p>

<pre><code>483045022100abceff62d3192b686c405d10516ff0e6f9ff221c00284d766200a6abb42361be02202972970369d6b9308467e15ebafd3f6b9faf111886071e3c429b34e9407e8d2301410482052ef9560585ed62f046ee45c1b5f85448bcf1bd5ce36a7d35eb00c8a146c14bf99223907f9a8688e6f84b54fd747a637bb82f02e296203e735e7a6b40059f
</code></pre>

<p>I finally built my signed raw transaction:</p>

<pre><code>01000000 (version number)
01 (number of inputs)
7dcb5c8d198fe9ac89c1ba5677e04afe0c95debcb273c1392b57c8843d2c2a91 (reversed previous tx hash)
01000000 (output index)
8b (scriptSig length)
483045022100abceff62d3192b686c405d10516ff0e6f9ff221c00284d766200a6abb42361be02202972970369d6b9308467e15ebafd3f6b9faf111886071e3c429b34e9407e8d2301410482052ef9560585ed62f046ee45c1b5f85448bcf1bd5ce36a7d35eb00c8a146c14bf99223907f9a8688e6f84b54fd747a637bb82f02e296203e735e7a6b40059f (scriptSig)
ffffffff (sequence)
02 (number of outputs)
496ff50200000000 (first output little endian amount. The faucet)
1976a914ac19d3fd17710e6b9a331022fe92c693fdf6659588ac (first output script with its length at start)
0046c32300000000 (second output little endian amount. My address, for change)
1976a9142de490b09ef14673af2bb4998fcb9f6b8446a84e88ac  (second script with its length at start)
00000000 (locktime)
</code></pre>

<p>The final result give me that signed raw transaction</p>

<pre><code>01000000017dcb5c8d198fe9ac89c1ba5677e04afe0c95debcb273c1392b57c8843d2c2a91010000008b483045022100abceff62d3192b686c405d10516ff0e6f9ff221c00284d766200a6abb42361be02202972970369d6b9308467e15ebafd3f6b9faf111886071e3c429b34e9407e8d2301410482052ef9560585ed62f046ee45c1b5f85448bcf1bd5ce36a7d35eb00c8a146c14bf99223907f9a8688e6f84b54fd747a637bb82f02e296203e735e7a6b40059fffffffff02496ff502000000001976a914ac19d3fd17710e6b9a331022fe92c693fdf6659588ac0046c323000000001976a9142de490b09ef14673af2bb4998fcb9f6b8446a84e88ac00000000
</code></pre>

<p>But now, when i try to send that signed raw transaction on the testnet network by a web service, everytime i get an error.
sandbox.smartbit.com.au/txs/pushtx return me </p>

<pre><code>"PUSH TRANSACTION ERROR: 16: MANDATORY-SCRIPT-VERIFY-FLAG-FAILED (SCRIPT EVALUATED WITHOUT ERROR BUT FINISHED WITH A FALSE/EMPTY TOP STACK ELEMENT)"
</code></pre>

<p>live.blockcypher.com/btc-testnet/pushtx/ return me </p>

<pre><code>"Error sending transaction: Error running script for input 0 referencing 912a2c3d84c8572b39c173b2bcde950cfe4ae07756bac189ace98f198d5ccb7d at 1: Script was NOT verified successfully.."
</code></pre>

<p>same with tbtc.blockr.io/tx/push </p>

<p>I'm far from mastering bitcoin or c#, i am learning (and want to learn how that work). Is anyone see where is my mistake ? 
Thanks</p>

<transactions><c#><raw>
C# BC, successfully creating and signing raw transaction
greedomyhero
# C# BC, successfully creating and signing raw transaction

(Asked by: username_0 on 2016-08-20)

First time on stackexchange to ask for help, sorry if i make mistakes (english is not my native language).

I try to create a valid raw transaction on C# with bouncycastle and i seems stuck, not able to find where is my mistake.
I test on the testnet network and have used many sources to help myself, [mainly this one](https://bitcoin.stackexchange.com/questions/32628/redeeming-a-raw-transaction-step-by-step-example-required).
For start, i have the next address and private key

```
Address: mjhcWg5SvS96kk85R8G1wp7mru55UCNGY5
Public Key Hex: 0482052EF9560585ED62F046EE45C1B5F85448BCF1BD5CE36A7D35EB00C8A146C14BF99223907F9A8688E6F84B54FD747A637BB82F02E296203E735E7A6B40059F
Wif: 93U5P1qHPXAhXhiw1T15z3f1cBqFw9fWrd3Yzz1nDk8b2aRbrrM 
Private Key Hex: F7DBD21285F621F1C7A47AE7F63D06C276FE49839F4842DDEF805477936812A5

```

i want to use the 6.49689241 btc from the previous (testnet) transaction

```
912a2c3d84c8572b39c173b2bcde950cfe4ae07756bac189ace98f198d5ccb7d

```

and send (as test) some back to the faucet mwCwTceJvYV27KXBc3NJZys6CjsgsoeHmf

First, to build the unsigned raw transaction, i add these bytes:

```
01000000 (version number)
01 (number of inputs)
7dcb5c8d198fe9ac89c1ba5677e04afe0c95debcb273c1392b57c8843d2c2a91 (reversed previous tx hash)
01000000 (output index)
1976a9142de490b09ef14673af2bb4998fcb9f6b8446a84e88ac (previous tx script with its length at start) 
ffffffff (sequence)
02 (number of outputs)
496ff50200000000 (first output little endian amount. The faucet)
1976a914ac19d3fd17710e6b9a331022fe92c693fdf6659588ac (first output script with its length at start)
0046c32300000000 (second output little endian amount. My address, for change)
1976a9142de490b09ef14673af2bb4998fcb9f6b8446a84e88ac  (second script with its length at start)
00000000 (locktime)
01000000 (hash code type)

```

The result is

```
01000000017dcb5c8d198fe9ac89c1ba5677e04afe0c95debcb273c1392b57c8843d2c2a91010000001976a9142de490b09ef14673af2bb4998fcb9f6b8446a84e88acffffffff02496ff502000000001976a914ac19d3fd17710e6b9a331022fe92c693fdf6659588ac0046c323000000001976a9142de490b09ef14673af2bb4998fcb9f6b8446a84e88ac0000000001000000

```

I then retrieve the transaction hash by pushing the raw transaction in a double SHA256 function that return me

```
f64b6480a2888596636d4995153e990ce95582a1308c9c568d2698e6dc1f7893

```

Then, i sign with the private key hex (prvkeyHex) the transaction hash (txHash) with this function:

```
X9ECParameters curve = SecNamedCurves.GetByName("secp256k1");
ECDomainParameters dom = new ECDomainParameters(curve.Curve, curve.G, curve.N, curve.H)
ECKeyParameters params = new ECPrivateKeyParameters(new BigInteger(1, prvkeyHex), dom);
ECDsaSigner signer = new ECDsaSigner();
signer.Init(true, params);
BigInteger[] sig = signer.GenerateSignature(txHash);
MemoryStream ms = new MemoryStream(72);
DerSequenceGenerator seq = new DerSequenceGenerator(ms);
seq.AddObject(new DerInteger(sig[0]));
seq.AddObject(new DerInteger(sig[1]));
seq.Close();
byte[] signature = ms.ToArray();

```

Which return me a byte array of max 72 bytes length starting by 30. In my last test:

```
3045022100abceff62d3192b686c405d10516ff0e6f9ff221c00284d766200a6abb42361be02202972970369d6b9308467e15ebafd3f6b9faf111886071e3c429b34e9407e8d23

```

I then construct my final scriptSig with the public key hex and their lengths who result as

```
483045022100abceff62d3192b686c405d10516ff0e6f9ff221c00284d766200a6abb42361be02202972970369d6b9308467e15ebafd3f6b9faf111886071e3c429b34e9407e8d2301410482052ef9560585ed62f046ee45c1b5f85448bcf1bd5ce36a7d35eb00c8a146c14bf99223907f9a8688e6f84b54fd747a637bb82f02e296203e735e7a6b40059f

```

I finally built my signed raw transaction:

```
01000000 (version number)
01 (number of inputs)
7dcb5c8d198fe9ac89c1ba5677e04afe0c95debcb273c1392b57c8843d2c2a91 (reversed previous tx hash)
01000000 (output index)
8b (scriptSig length)
483045022100abceff62d3192b686c405d10516ff0e6f9ff221c00284d766200a6abb42361be02202972970369d6b9308467e15ebafd3f6b9faf111886071e3c429b34e9407e8d2301410482052ef9560585ed62f046ee45c1b5f85448bcf1bd5ce36a7d35eb00c8a146c14bf99223907f9a8688e6f84b54fd747a637bb82f02e296203e735e7a6b40059f (scriptSig)
ffffffff (sequence)
02 (number of outputs)
496ff50200000000 (first output little endian amount. The faucet)
1976a914ac19d3fd17710e6b9a331022fe92c693fdf6659588ac (first output script with its length at start)
0046c32300000000 (second output little endian amount. My address, for change)
1976a9142de490b09ef14673af2bb4998fcb9f6b8446a84e88ac  (second script with its length at start)
00000000 (locktime)

```

The final result give me that signed raw transaction

```
01000000017dcb5c8d198fe9ac89c1ba5677e04afe0c95debcb273c1392b57c8843d2c2a91010000008b483045022100abceff62d3192b686c405d10516ff0e6f9ff221c00284d766200a6abb42361be02202972970369d6b9308467e15ebafd3f6b9faf111886071e3c429b34e9407e8d2301410482052ef9560585ed62f046ee45c1b5f85448bcf1bd5ce36a7d35eb00c8a146c14bf99223907f9a8688e6f84b54fd747a637bb82f02e296203e735e7a6b40059fffffffff02496ff502000000001976a914ac19d3fd17710e6b9a331022fe92c693fdf6659588ac0046c323000000001976a9142de490b09ef14673af2bb4998fcb9f6b8446a84e88ac00000000

```

But now, when i try to send that signed raw transaction on the testnet network by a web service, everytime i get an error.
sandbox.smartbit.com.au/txs/pushtx return me

```
"PUSH TRANSACTION ERROR: 16: MANDATORY-SCRIPT-VERIFY-FLAG-FAILED (SCRIPT EVALUATED WITHOUT ERROR BUT FINISHED WITH A FALSE/EMPTY TOP STACK ELEMENT)"

```

live.blockcypher.com/btc-testnet/pushtx/ return me

```
"Error sending transaction: Error running script for input 0 referencing 912a2c3d84c8572b39c173b2bcde950cfe4ae07756bac189ace98f198d5ccb7d at 1: Script was NOT verified successfully.."

```

same with tbtc.blockr.io/tx/push

I'm far from mastering bitcoin or c#, i am learning (and want to learn how that work). Is anyone see where is my mistake ?
Thanks

**Tags:** transactions, c#, raw


---

## 2 answers

### Answer by username_1 on 2019-04-17. Score: 1

The signature you produced is correct but for a wrong "message", which is the only mistake that I could find. This is what you sign:

```
f64b6480a2888596636d4995153e990ce95582a1308c9c568d2698e6dc1f7893

```

Which is wrong (since you reversed the has result). Instead you should have signed the actual result you get from your `SHA256(SHA256(<bytes>))` to your signing function, meaning this instead:

```
93781fdce698268d569c8c30a18255e90c993e1595496d63968588a280644bf6

```

There are a couple of places where we reverse the hash result and this is not one of them. Here you are simply hashing the serialized transaction to turn the size of it from an arbitrary length to a fixed 32 byte size so that you can sign it using ECDSA scheme.

There is an additional possible problem with directly using BouncyCastle or any similar library that are designed for cryptography in general not for bitcoin, where the signature they return may have an `s` value (the second `BigInteger` in your signature) that is bigger than curve `N/2`. In which case you will have to change it to `s'` by calculating `s' = N - s`.


---

### Answer by username_2 on 2018-10-04. Score: 0

Why don't you use [NBitcoin](https://github.com/MetacoSA/NBitcoin) library to create a raw transaction and post it to blockr.io or whatever API provider you're using? NBitcoin is a great library for C# cryptocurrency developers.


---

