<p>I think <a href="https://bitcoin.stackexchange.com/questions/21994/what-is-transaction-malleability">What is transaction malleability</a> will answer most of it. But to summarize it in terms of your actual questions:</p>

<blockquote>
  <ol>
  <li>the reasons why transaction ID can be changed?</li>
  </ol>
</blockquote>

<p>Because someone can create another transaction (= different transaction message) that accomplishes the same thing as yours, while reusing your signatures.</p>

<p>The reason the signatures can be reused in a different message is because the signatures don't sign themselves. They don't sign themselves because that would require a dependency loop (the transaction message depends on the signature, and the signature signs the transaction message), which would be impossible to sign for.</p>

<p>The question is then what can be changed in a signature that doesn't invalidate it. The known ways for doing so are listed in <a href="https://github.com/bitcoin/bips/blob/master/bip-0062.mediawiki" rel="nofollow noreferrer">BIP62</a> (which aimed to prevent some of them, but was retracted - it still gives a good overview).</p>

<blockquote>
  <ol start="2">
  <li>Who can change this ID (I assume a miner who mined a block)?</li>
  </ol>
</blockquote>

<p>Anyone who relays your transaction (including miners), as they see your transaction but have the ability to produce a modified version and relay that one faster than someone else.</p>

<blockquote>
  <ol start="3">
  <li>What field in the transaction message can be changed to warrant the change of txId?</li>
  </ol>
</blockquote>

<p>The <code>scriptSig</code> field in the transactions' inputs. It contains the ECDSA signatures, but also redeemscripts, public keys, and various other information needed to prove a spend was authorized.</p>

<p>With <a href="https://github.com/bitcoin/bips/blob/master/bip-0141.mediawiki" rel="nofollow noreferrer">BIP141</a> (Segregated Witness), these issues are avoided by making the signatures not affect the txid anymore. Instead, they are stored in a separate field (called the witness) which is only necessary to prove a transaction's validity, and does not contribute to its effect.</p>

CC BY-SA 3.0
2017-09-03T12:01:48.437Z
Thank you very much. It is still kind of hard for me to understand how you can reuse the signature. I thought that the main point of the signature is to be non-reusable (you create a signature using your private key so no one can reuse it). Will read the BIP you linked and hopefully will get it.
Salvador Dali
CC BY-SA 3.0
2017-09-03T15:39:02.297Z
A signature signs a message. That message is not the full transaction itself, as that would include the signature itself. So, it signs a modified version of the transaction _which does not include the scriptSig field_. As a result, things you change in the scriptSig do not invalidate the signatures.
Pieter Wuille
CC BY-SA 3.0
2017-09-03T00:35:31.800Z
2017-09-03T00:35:31.800Z
Pieter Wuille
<p>I always thought that when my wallet create a transaction, it's transaction id is fixed (it is the SHA256 of the transaction message). Yes, the transaction might not be included in the next block (and can even be dropped completely) but if it will be included the transaction ID is fixed. Apparently <a href="http://chimera.labs.oreilly.com/books/1234000001802/ch03.html#_exploring_and_decoding_transactions" rel="nofollow noreferrer">this is not correct</a>:</p>

<blockquote>
  <p>Transaction IDs are not authoritative until a transaction has been
  confirmed. Absence of a transaction hash in the blockchain does not
  mean the transaction was not processed. This is known as "transaction
  malleability," because transaction hashes can be modified prior to
  confirmation in a block. After confirmation, the txid is immutable and
  authoritative.</p>
</blockquote>

<p>Can anyone explain </p>

<ol>
<li>the reasons why transaction ID can be changed?</li>
<li>Who can change this ID (I assume a miner who mined a block)?</li>
<li>What field in the transaction message can be changed to warrant the change of txId?</li>
</ol>

CC BY-SA 3.0
2017-09-02T21:59:21.087Z
Possible duplicate of [What is Transaction Malleability?](https://bitcoin.stackexchange.com/questions/21994/what-is-transaction-malleability)
Nate Eldredge
CC BY-SA 3.0
2017-09-02T22:04:05.870Z
@NateEldredge thank you for a link, but I do not think that this is a duplicate. I know that transaction malleability is the change of transaction id (which is what that question asks). I want to know some details what exactly can be changed and for what reason.
Salvador Dali
<transactions><transaction-malleability>
What can be the reason to change transaction ID?
Salvador Dali
# What can be the reason to change transaction ID?

(Asked by: username_0 on 2017-09-02)

I always thought that when my wallet create a transaction, it's transaction id is fixed (it is the SHA256 of the transaction message). Yes, the transaction might not be included in the next block (and can even be dropped completely) but if it will be included the transaction ID is fixed. Apparently [this is not correct](http://chimera.labs.oreilly.com/books/1234000001802/ch03.html#_exploring_and_decoding_transactions):

> Transaction IDs are not authoritative until a transaction has been
> confirmed. Absence of a transaction hash in the blockchain does not
> mean the transaction was not processed. This is known as "transaction
> malleability," because transaction hashes can be modified prior to
> confirmation in a block. After confirmation, the txid is immutable and
> authoritative.

Can anyone explain

1. the reasons why transaction ID can be changed?
2. Who can change this ID (I assume a miner who mined a block)?
3. What field in the transaction message can be changed to warrant the change of txId?

**Tags:** transactions, transaction-malleability

> **Comments:**
> **username_1**: Possible duplicate of [What is Transaction Malleability?](https://bitcoin.stackexchange.com/questions/21994/what-is-transaction-malleability)  
> **username_0**: @username_1 thank you for a link, but I do not think that this is a duplicate. I know that transaction malleability is the change of transaction id (which is what that question asks). I want to know some details what exactly can be changed and for what reason.  

---

## 1 answers

### Answer by username_2 on 2017-09-03. Score: 1 | Accepted answer

I think [What is transaction malleability](https://bitcoin.stackexchange.com/questions/21994/what-is-transaction-malleability) will answer most of it. But to summarize it in terms of your actual questions:

> 1. the reasons why transaction ID can be changed?

Because someone can create another transaction (= different transaction message) that accomplishes the same thing as yours, while reusing your signatures.

The reason the signatures can be reused in a different message is because the signatures don't sign themselves. They don't sign themselves because that would require a dependency loop (the transaction message depends on the signature, and the signature signs the transaction message), which would be impossible to sign for.

The question is then what can be changed in a signature that doesn't invalidate it. The known ways for doing so are listed in [BIP62](https://github.com/bitcoin/bips/blob/master/bip-0062.mediawiki) (which aimed to prevent some of them, but was retracted - it still gives a good overview).

> 2. Who can change this ID (I assume a miner who mined a block)?

Anyone who relays your transaction (including miners), as they see your transaction but have the ability to produce a modified version and relay that one faster than someone else.

> 3. What field in the transaction message can be changed to warrant the change of txId?

The `scriptSig` field in the transactions' inputs. It contains the ECDSA signatures, but also redeemscripts, public keys, and various other information needed to prove a spend was authorized.

With [BIP141](https://github.com/bitcoin/bips/blob/master/bip-0141.mediawiki) (Segregated Witness), these issues are avoided by making the signatures not affect the txid anymore. Instead, they are stored in a separate field (called the witness) which is only necessary to prove a transaction's validity, and does not contribute to its effect.

> **Comments:**
> **username_0**: Thank you very much. It is still kind of hard for me to understand how you can reuse the signature. I thought that the main point of the signature is to be non-reusable (you create a signature using your private key so no one can reuse it). Will read the BIP you linked and hopefully will get it.  
> **username_2**: A signature signs a message. That message is not the full transaction itself, as that would include the signature itself. So, it signs a modified version of the transaction _which does not include the scriptSig field_. As a result, things you change in the scriptSig do not invalidate the signatures.  

---

