<p>From what I gather you sign both the input and the output of the transaction, meaning that nobody can alter the content of the transaction without invalidating your signature. I also had some problems with this part of the algorithm, and even asked <a href="https://bitcoin.stackexchange.com/q/3374/323">a similar question earlier</a>, but this one deals with more of the low-level bit operations rather than the high-level concept.</p>

CC BY-SA 3.0
2013-01-24T12:14:07.370Z
What is being signed is indeed (a modified version of) the entire transaction. The details are complex (see the question linked to be the answer), but most importantly, the transaction inputs are stripped before signing (as otherwise, the signature would need to sign itself before signing, which is computationally infeasible).
Pieter Wuille
CC BY-SA 3.0
2013-01-24T13:08:36.303Z
Thanks, that makes sense. So if there are 3 inputs in a transaction, each input will contain a signature (they may be 3 different signatures) of the whole transaction (minus the inputs), correct?
Flavien
CC BY-SA 3.0
2013-01-24T10:49:06.910Z
2013-01-24T10:49:06.910Z
2017-04-13T12:47:36.707Z
ThePiachu
<p>There is a part of the Bitcoin protocol that I don't quite understand.</p>

<p>When you make a transaction, and spend the output of a previous transaction for say 1 BTC, you provide a signature using the private key matching the public key (or address) that appears in the output of the previous transaction. My first question here is what exactly is signed?</p>

<p>Second, when the transaction is broadcast, what prevents a malicious peer to take the input of my transaction with signature, for 1 BTC, and forge a new transaction using that same input going to their own address? To avoid that, the full transaction (including outputs) would need to be signed, I couldn't find a document indicating the whole transaction is signed.</p>

CC BY-SA 3.0
2013-01-25T23:33:30.850Z
Yeah great question, I asked myself the same question but I found the answer looking all the transcations wiki.
Gopoi
CC BY-SA 3.0
2017-09-26T23:33:05.667Z
That is good question, I'm asking the same and can't understand how outputs list is protected, it looks like outputs signed with public key, but public keys are not secure.
Vedmant
CC BY-SA 4.0
2022-10-12T08:54:39.657Z
good question. It is really hard to find a documentation of what exactly is signed in bitcoin transactions!
mhrsalehi
<security><protocol><signature>
Signing Bitcoin transactions
Flavien
# Signing Bitcoin transactions

(Asked by: username_0 on 2013-01-24)

There is a part of the Bitcoin protocol that I don't quite understand.

When you make a transaction, and spend the output of a previous transaction for say 1 BTC, you provide a signature using the private key matching the public key (or address) that appears in the output of the previous transaction. My first question here is what exactly is signed?

Second, when the transaction is broadcast, what prevents a malicious peer to take the input of my transaction with signature, for 1 BTC, and forge a new transaction using that same input going to their own address? To avoid that, the full transaction (including outputs) would need to be signed, I couldn't find a document indicating the whole transaction is signed.

**Tags:** security, protocol, signature

> **Comments:**
> **username_1**: Yeah great question, I asked myself the same question but I found the answer looking all the transcations wiki.  
> **username_2**: That is good question, I'm asking the same and can't understand how outputs list is protected, it looks like outputs signed with public key, but public keys are not secure.  
> **username_3**: good question. It is really hard to find a documentation of what exactly is signed in bitcoin transactions!  

---

## 1 answers

### Answer by username_4 on 2013-01-24. Score: 16 | Accepted answer

From what I gather you sign both the input and the output of the transaction, meaning that nobody can alter the content of the transaction without invalidating your signature. I also had some problems with this part of the algorithm, and even asked [a similar question earlier](https://bitcoin.stackexchange.com/q/3374/323), but this one deals with more of the low-level bit operations rather than the high-level concept.

> **Comments:**
> **username_5**: What is being signed is indeed (a modified version of) the entire transaction. The details are complex (see the question linked to be the answer), but most importantly, the transaction inputs are stripped before signing (as otherwise, the signature would need to sign itself before signing, which is computationally infeasible).  
> **username_0**: Thanks, that makes sense. So if there are 3 inputs in a transaction, each input will contain a signature (they may be 3 different signatures) of the whole transaction (minus the inputs), correct?  

---

