<p>Because they can't be.</p>
<p>The <code>scriptSig</code> values <em>contain</em> the signatures. If they were included in the message being signed, you'd need signatures that sign themselves. That's not possible.</p>

CC BY-SA 4.0
2023-05-11T14:48:37.967Z
I can't understand it. The signature in the `scriptSig` is completely independent of the transaction, is it right? Why is it impossible?
Amir reza Riahi
CC BY-SA 4.0
2023-05-11T15:14:27.697Z
In other words, from what I understand, by signing the input, I just unlocked it, and the unlocked `utxo` can be spent in any transaction to any address. So after one make up a transaction by putting together signed inputs and desired outputs it should re-sign this whole new structure. Now the signature of each input differs from signature of the whole transaction. Although the signature of transaction is dependent to the input (because transaction contains inputs) but the opposite is not true. Are my assumptions correct?
Amir reza Riahi
CC BY-SA 4.0
2023-05-11T16:18:51.770Z
The message being signed by every signature includes (effectively) the entire transaction, except the signatures themselves.
Pieter Wuille
CC BY-SA 4.0
2023-05-12T18:35:31.257Z
Sorry but I have difficulty understanding it. Any input must have a `scriptSig` that when we put it alongside the pointed output's `scriptPubKey` it pops non zero on the stack at the end of the execution. So the `scriptSig` of every input is exclusively for unlocking that specific input, and has nothing to do with other inputs and outputs in the current transaction. So I can't understand how it is possible that a signature of an input signs other parts of the transaction. If you think it's a totally different question, I can ask it on another thread.
Amir reza Riahi
CC BY-SA 4.0
2023-05-12T20:15:11.623Z
@AmirrezaRiahi It's not correct that the signature in a transaction input has nothing to do with the other parts of the transaction. **Each** signature (so one in every input) signs the **entire transaction** (including all other inputs and all outputs). Each is a signature with the public key of the output being spent, but they all sign off on the entirety of the transaction.
Pieter Wuille
CC BY-SA 4.0
2023-05-12T20:22:29.810Z
Digital signatures are created by signing a message with a private key. That signature is then valid when verified against the same message and the corresponding public key. But if you change the message, the signature is not valid anymore. In the context of Bitcoin transaction input signing, that message is **the entire spending transaction** (except, as pointed out in my answer and your question, the signatures themselves, because that would be circular).
Pieter Wuille
CC BY-SA 4.0
2023-05-11T14:08:07.390Z
2023-05-11T14:08:07.390Z
Pieter Wuille
<p>In this <a href="https://www.youtube.com/watch?v=7o5shPC0R2k" rel="nofollow noreferrer">video</a>, the lecturer explains that before the whole transaction get signed, the <code>scriptSig</code> part of inputs are removed, and this causes the ability to perform transaction malleability attacks. My question is that, why are <code>scriptSig</code>s are removed? Why are they not as a part of the message to be signed?</p>

<transactions><signature><input-script>
Why inputs' scriptSig are stripped before the whole transaction being signed?
Amir reza Riahi
# Why inputs' scriptSig are stripped before the whole transaction being signed?

(Asked by: username_0 on 2023-05-11)

In this [video](https://www.youtube.com/watch?v=7o5shPC0R2k), the lecturer explains that before the whole transaction get signed, the `scriptSig` part of inputs are removed, and this causes the ability to perform transaction malleability attacks. My question is that, why are `scriptSig`s are removed? Why are they not as a part of the message to be signed?

**Tags:** transactions, signature, input-script


---

## 1 answers

### Answer by username_1 on 2023-05-11. Score: 7 | Accepted answer

Because they can't be.

The `scriptSig` values *contain* the signatures. If they were included in the message being signed, you'd need signatures that sign themselves. That's not possible.

> **Comments:**
> **username_0**: I can't understand it. The signature in the `scriptSig` is completely independent of the transaction, is it right? Why is it impossible?  
> **username_0**: In other words, from what I understand, by signing the input, I just unlocked it, and the unlocked `utxo` can be spent in any transaction to any address. So after one make up a transaction by putting together signed inputs and desired outputs it should re-sign this whole new structure. Now the signature of each input differs from signature of the whole transaction. Although the signature of transaction is dependent to the input (because transaction contains inputs) but the opposite is not true. Are my assumptions correct?  
> **username_1**: The message being signed by every signature includes (effectively) the entire transaction, except the signatures themselves.  
> **username_0**: Sorry but I have difficulty understanding it. Any input must have a `scriptSig` that when we put it alongside the pointed output's `scriptPubKey` it pops non zero on the stack at the end of the execution. So the `scriptSig` of every input is exclusively for unlocking that specific input, and has nothing to do with other inputs and outputs in the current transaction. So I can't understand how it is possible that a signature of an input signs other parts of the transaction. If you think it's a totally different question, I can ask it on another thread.  
> **username_1**: @username_0 It's not correct that the signature in a transaction input has nothing to do with the other parts of the transaction. **Each** signature (so one in every input) signs the **entire transaction** (including all other inputs and all outputs). Each is a signature with the public key of the output being spent, but they all sign off on the entirety of the transaction.  
> **username_1**: Digital signatures are created by signing a message with a private key. That signature is then valid when verified against the same message and the corresponding public key. But if you change the message, the signature is not valid anymore. In the context of Bitcoin transaction input signing, that message is **the entire spending transaction** (except, as pointed out in my answer and your question, the signatures themselves, because that would be circular).  

---

