<p>Segregated Witness was already a large collection of changes that impacted several parts of Bitcoin (P2P, validation, fee estimation, sighashing, script execution, ...).</p>

<p>Many small improvements could easily have been added to the proposal (including the signature encoding, the superfluous stack pop in OP_CHECKMULTISIG, the signature algorithm, various script extensions, new sighash flags, ...). However, we wanted to avoid letting the scope grow too large, to avoid bikeshedding and review burden. Instead, a script versioning system was introduced that would make it possible to later pretty much enable adding in any other change as a softfork).</p>

<p>So the answer is that DER is still in use in P2WPKH simply because it was in use in P2PKH and it didn't change. However, I expect that future proposals will come soon enough to change it to pure 64-byte signatures.</p>

CC BY-SA 3.0
2018-01-04T20:48:17.460Z
2018-01-04T20:48:17.460Z
Pieter Wuille
<p>If we simply assumed 32 bytes of r and s each, then signatures can be 64 bytes. Now they are on average 71 bytes in DER plus an additional byte to declare their size, effectively making them use 72 bytes of space. Similarly, if we assume public key is always compressed then we can simply keep 2 stack items of 64+32 bytes. I guess it is to do with the way OP_CheckSig is implemented. </p>

<segregated-witness><signature><encoding>
Why does P2SH-P2WPKH use DER encoded signatures?
Jus12
# Why does P2SH-P2WPKH use DER encoded signatures?

(Asked by: username_0 on 2018-01-04)

If we simply assumed 32 bytes of r and s each, then signatures can be 64 bytes. Now they are on average 71 bytes in DER plus an additional byte to declare their size, effectively making them use 72 bytes of space. Similarly, if we assume public key is always compressed then we can simply keep 2 stack items of 64+32 bytes. I guess it is to do with the way OP\_CheckSig is implemented.

**Tags:** segregated-witness, signature, encoding


---

## 1 answers

### Answer by username_1 on 2018-01-04. Score: 4 | Accepted answer

Segregated Witness was already a large collection of changes that impacted several parts of Bitcoin (P2P, validation, fee estimation, sighashing, script execution, ...).

Many small improvements could easily have been added to the proposal (including the signature encoding, the superfluous stack pop in OP\_CHECKMULTISIG, the signature algorithm, various script extensions, new sighash flags, ...). However, we wanted to avoid letting the scope grow too large, to avoid bikeshedding and review burden. Instead, a script versioning system was introduced that would make it possible to later pretty much enable adding in any other change as a softfork).

So the answer is that DER is still in use in P2WPKH simply because it was in use in P2PKH and it didn't change. However, I expect that future proposals will come soon enough to change it to pure 64-byte signatures.


---

