<ol>
<li><p><a href="https://bitcoin.stackexchange.com/questions/3374/how-to-redeem-a-basic-tx">How to redeem a basic Tx?</a></p></li>
<li><p>The question is not clear to me. Do you want to send your transaction after signing? Or do you want to hold the signature for later use?</p></li>
</ol>

CC BY-SA 3.0
2015-03-30T14:00:38.277Z
2015-03-30T14:00:38.277Z
2017-04-13T12:47:33.583Z
amaclin
<p>First question has a long answer, because it depends on the scriptPubKey, but also of the sigHash flag, I assume you are speaking about classic P2PKH transactions. (ScriptPubKey expose the condition for &quot;unlocking&quot;, while ScriptSig satisfies them for &quot;unlocking&quot;. It can use signature... or not, but will assume you are using P2PKH scriptPubKey, so it does)</p>
<p>So the scriptPubKey is</p>
<pre><code>OP_DUP OP_HASH160 &lt;PubkeyHash&gt; OP_EQUALVERIFY OP_CHECKSIG
</code></pre>
<p>Where PubkeyHash is given by your bitcoin address.</p>
<p>The scriptSig should be</p>
<pre><code>&lt;Sig&gt; &lt;PubKey&gt;
</code></pre>
<p>The PubKey is simple. From your Private key, you can get the public key (curve secp256k1)</p>
<pre><code>Q = dG
</code></pre>
<p>where d private key : int, Q public key : EC Point, G : ECPoint given by curve.</p>
<pre><code>&lt;sig&gt;
</code></pre>
<p>is composed of 2 components</p>
<pre><code>&lt;ecdsaSig&gt; &lt;sigHash&gt;
</code></pre>
<p>ECDA Sig is the signature of a hash of the transaction in DER encoding. sigHash is a byte that specifies how to generate this hash (ie: what is actually signed).</p>
<p>sigHash itself contains 2 informations.</p>
<pre><code>&lt;AnyoneCanPay&gt;&lt;All|None|Single&gt;
</code></pre>
<p>So what is signed is a calculated hash of your transaction depending on the sigHash. The human friendly explanation is <a href="https://en.bitcoin.it/wiki/OP_CHECKSIG" rel="nofollow noreferrer">here</a>, and the most readable code doing that is <a href="https://github.com/NicolasDorier/NBitcoin/blob/master/NBitcoin/Script.cs#L459" rel="nofollow noreferrer">here</a>.</p>
<p>Once you calculated the hash, you need to sign it according to <a href="https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm" rel="nofollow noreferrer">this math</a> on elliptic curves.
Due to the need in the algorithm of a random K value, it supposes a fair RNG.
So <a href="https://www.rfc-editor.org/rfc/rfc6979" rel="nofollow noreferrer">RFC6979</a> describes a way for finding a K value that is not random but secure to use.  (implementation <a href="https://github.com/NicolasDorier/NBitcoin/blob/master/NBitcoin/Crypto/DeterministicECDSA.cs" rel="nofollow noreferrer">here</a>)</p>
<p>So here is what is signed, depending on the sigHash you choose:</p>
<p>AnyoneCanPay : You allow someone to modify any input in the transaction. (don't sign inputs, except yours)</p>
<p>All : You deny modification of outputs in the transaction. (sign outputs)</p>
<p>Single : You deny modification of the output having the same index as you input (sign one output)</p>
<p>None : You allow modification of any output in the transaction. (sign no output)</p>
<p>Second question :
No, whatever the sigHash you use, part of your signature contains the previous output reference you are spending. Since you can't double spend, you can't reuse the signature.
However, if you really want to do that, then use the same K value for signing 2 different hashes, then you basically leaked your private key. So anyone would be able to &quot;unlock&quot; a future transaction made to your bitcoin address by knowing the two signatures.</p>

CC BY-SA 3.0
2015-08-05T20:55:33.150Z
If I sign sigHash=None then anyone can change the transaction to receive the bitcoin ?
Haddar Macdasi
CC BY-SA 3.0
2015-08-07T00:00:29.433Z
Yes, if sigHash = None (with AnyoneCanPay), then basically anyone can take the input you sign and put it in whatever transaction they like.


If sigHash=None without AnyoneCanPay, then someone can only change the other inputs.
Nicolas Dorier
CC BY-SA 4.0
2015-03-30T13:56:44.540Z
2019-04-24T15:44:55.427Z
2021-10-07T07:34:52.683Z
Nicolas Dorier
<ul>
<li>I've decoderawtransaction and see in the vin part a "scriptSig" ,which
I believe to be the "unlocking script"  . Assuming I have
the private key in a paper wallet and someone send me transaction to
my bitcoin address, How do I generate the    to unlock it
?  </li>
<li>My second question is: after I generated it, can someone copy this<br>
part and use it in the future to unlock a future transaction made to 
my same bitcoin address ?</li>
</ul>

CC BY-SA 3.0
2015-03-30T12:32:44.867Z
For the 1st question I'm looking for a mathematical answer, i.e: take PK hash 160 extra. don't send me to some library.
Haddar Macdasi
<transactions><signature>
How to create the <sig> <PubK> part in "scriptSig"?
Haddar Macdasi
# How to create the <sig> <PubK> part in "scriptSig"?

(Asked by: username_0 on 2015-03-30)

* I've decoderawtransaction and see in the vin part a "scriptSig" ,which
  I believe to be the "unlocking script" . Assuming I have
  the private key in a paper wallet and someone send me transaction to
  my bitcoin address, How do I generate the to unlock it
  ?
* My second question is: after I generated it, can someone copy this  
  part and use it in the future to unlock a future transaction made to
  my same bitcoin address ?

**Tags:** transactions, signature

> **Comments:**
> **username_0**: For the 1st question I'm looking for a mathematical answer, i.e: take PK hash 160 extra. don't send me to some library.  

---

## 2 answers

### Answer by username_2 on 2015-03-30. Score: 4 | Accepted answer

First question has a long answer, because it depends on the scriptPubKey, but also of the sigHash flag, I assume you are speaking about classic P2PKH transactions. (ScriptPubKey expose the condition for "unlocking", while ScriptSig satisfies them for "unlocking". It can use signature... or not, but will assume you are using P2PKH scriptPubKey, so it does)

So the scriptPubKey is

```
OP_DUP OP_HASH160 <PubkeyHash> OP_EQUALVERIFY OP_CHECKSIG

```

Where PubkeyHash is given by your bitcoin address.

The scriptSig should be

```
<Sig> <PubKey>

```

The PubKey is simple. From your Private key, you can get the public key (curve secp256k1)

```
Q = dG

```

where d private key : int, Q public key : EC Point, G : ECPoint given by curve.

```
<sig>

```

is composed of 2 components

```
<ecdsaSig> <sigHash>

```

ECDA Sig is the signature of a hash of the transaction in DER encoding. sigHash is a byte that specifies how to generate this hash (ie: what is actually signed).

sigHash itself contains 2 informations.

```
<AnyoneCanPay><All|None|Single>

```

So what is signed is a calculated hash of your transaction depending on the sigHash. The human friendly explanation is [here](https://en.bitcoin.it/wiki/OP_CHECKSIG), and the most readable code doing that is [here](https://github.com/username_2/NBitcoin/blob/master/NBitcoin/Script.cs#L459).

Once you calculated the hash, you need to sign it according to [this math](https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm) on elliptic curves.
Due to the need in the algorithm of a random K value, it supposes a fair RNG.
So [RFC6979](https://www.rfc-editor.org/rfc/rfc6979) describes a way for finding a K value that is not random but secure to use. (implementation [here](https://github.com/username_2/NBitcoin/blob/master/NBitcoin/Crypto/DeterministicECDSA.cs))

So here is what is signed, depending on the sigHash you choose:

AnyoneCanPay : You allow someone to modify any input in the transaction. (don't sign inputs, except yours)

All : You deny modification of outputs in the transaction. (sign outputs)

Single : You deny modification of the output having the same index as you input (sign one output)

None : You allow modification of any output in the transaction. (sign no output)

Second question :
No, whatever the sigHash you use, part of your signature contains the previous output reference you are spending. Since you can't double spend, you can't reuse the signature.
However, if you really want to do that, then use the same K value for signing 2 different hashes, then you basically leaked your private key. So anyone would be able to "unlock" a future transaction made to your bitcoin address by knowing the two signatures.

> **Comments:**
> **username_0**: If I sign sigHash=None then anyone can change the transaction to receive the bitcoin ?  
> **username_2**: Yes, if sigHash = None (with AnyoneCanPay), then basically anyone can take the input you sign and put it in whatever transaction they like.   If sigHash=None without AnyoneCanPay, then someone can only change the other inputs.  

---

### Answer by username_1 on 2015-03-30. Score: 0

1. [How to redeem a basic Tx?](https://bitcoin.stackexchange.com/questions/3374/how-to-redeem-a-basic-tx)
2. The question is not clear to me. Do you want to send your transaction after signing? Or do you want to hold the signature for later use?


---

