<blockquote>
<p>Since we have the ephemeral private key which has to be random how can I sign two times the same transaction and get the same signature as Bitcoin RPC does.</p>
</blockquote>
<p>This &quot;ephemeral private key&quot; is known as a <strong>nonce</strong>. Bitcoin Core, and most other wallet software, use a technique called Deterministic Nonces. Specifically, they use the algorithm defined in <a href="https://www.rfc-editor.org/rfc/rfc6979" rel="nofollow noreferrer">RFC 6979</a> to produce the nonce deterministically. It essentially hashes together the message and the private key being used and uses that hash as the nonce. If you sign the same message with the same private key multiple times, the same nonce will be used and thus you always get the same signature.</p>
<blockquote>
<p>What is the hash that should be signed, the whole transaction without the signature, do I have to exclude any fields?</p>
</blockquote>
<p>For non-segwit inputs, the message that is signed is the entire transaction with all other input scripts empty. For the particular input being signed, the scriptPubKey or the redeemScript if there is one, is put in the input script. Then the sighash type is appended to the end. This is hashed twice and that hash is then signed.</p>
<p>For segwit, the message is a bit more complicated and described in <a href="https://github.com/bitcoin/bips/blob/master/bip-0143.mediawiki" rel="nofollow noreferrer">BIP 143</a>.</p>

CC BY-SA 4.0
2020-03-17T20:39:06.147Z
If I have more than 1 input I have to sign more than one time?
Also, If I use a different nonce, it will generate a diff R and S, will it still be valid?
Allan Romanato
CC BY-SA 4.0
2020-03-17T21:01:43.643Z
Yes. Each input will have its own message and require its own signatures. An input can have multiple signatures, in which case you will have the same message signed by multiple keys. With the nonces, any nonce can be used to produce a valid signature. It's why it can also be random. There is no single "correct" nonce or signature for a given message and private key.
Ava Chow
CC BY-SA 4.0
2020-03-17T21:18:50.940Z
So if each input needs a signature, i will have to use the scriptPubKey for each in each signing iteration, and the others inputs empty, after all I insert each signature in the right place correct? Also if I have for example 3 inputs and 2 outputs or 1 input and 3 outputs, which scriptPubKey should I use?
Allan Romanato
CC BY-SA 4.0
2020-03-17T21:40:26.347Z
Please don’t write software handling money if this is the sum total of your understanding of the cryptography.
Claris
CC BY-SA 4.0
2020-03-17T22:04:22.827Z
You use the `scriptPubKey` of the output that is being spent. Each input refers to a specific output, you use the `scriptPubKey` of that output. Not the `scriptPubkey`s of the outputs that are created by the transaction.
Ava Chow
CC BY-SA 4.0
2020-03-17T20:28:04.820Z
2020-03-17T20:28:04.820Z
2021-10-07T07:34:52.683Z
Ava Chow
<p>I wrote a couple of algorithms that perform the ECDSA and also the verification. So I used my algorithm and the RPC call for signing and I got a couple of questions.</p>

<ol>
<li><p>Since we have the ephemeral private key which has to be random how can I sign two times the same transaction and get the same signature as Bitcoin RPC does.</p></li>
<li><p>What is the hash that should be signed, the whole transaction without the signature, do I have to exclude any fields?</p></li>
</ol>

<bitcoin-core><ecdsa>
Bitcoin Transaction Signing
Allan Romanato
# Bitcoin Transaction Signing

(Asked by: username_0 on 2020-03-17)

I wrote a couple of algorithms that perform the ECDSA and also the verification. So I used my algorithm and the RPC call for signing and I got a couple of questions.

1. Since we have the ephemeral private key which has to be random how can I sign two times the same transaction and get the same signature as Bitcoin RPC does.
2. What is the hash that should be signed, the whole transaction without the signature, do I have to exclude any fields?

**Tags:** bitcoin-core, ecdsa


---

## 1 answers

### Answer by username_1 on 2020-03-17. Score: 2 | Accepted answer

> Since we have the ephemeral private key which has to be random how can I sign two times the same transaction and get the same signature as Bitcoin RPC does.

This "ephemeral private key" is known as a **nonce**. Bitcoin Core, and most other wallet software, use a technique called Deterministic Nonces. Specifically, they use the algorithm defined in [RFC 6979](https://www.rfc-editor.org/rfc/rfc6979) to produce the nonce deterministically. It essentially hashes together the message and the private key being used and uses that hash as the nonce. If you sign the same message with the same private key multiple times, the same nonce will be used and thus you always get the same signature.

> What is the hash that should be signed, the whole transaction without the signature, do I have to exclude any fields?

For non-segwit inputs, the message that is signed is the entire transaction with all other input scripts empty. For the particular input being signed, the scriptPubKey or the redeemScript if there is one, is put in the input script. Then the sighash type is appended to the end. This is hashed twice and that hash is then signed.

For segwit, the message is a bit more complicated and described in [BIP 143](https://github.com/bitcoin/bips/blob/master/bip-0143.mediawiki).

> **Comments:**
> **username_0**: If I have more than 1 input I have to sign more than one time? Also, If I use a different nonce, it will generate a diff R and S, will it still be valid?  
> **username_1**: Yes. Each input will have its own message and require its own signatures. An input can have multiple signatures, in which case you will have the same message signed by multiple keys. With the nonces, any nonce can be used to produce a valid signature. It's why it can also be random. There is no single "correct" nonce or signature for a given message and private key.  
> **username_0**: So if each input needs a signature, i will have to use the scriptPubKey for each in each signing iteration, and the others inputs empty, after all I insert each signature in the right place correct? Also if I have for example 3 inputs and 2 outputs or 1 input and 3 outputs, which scriptPubKey should I use?  
> **username_2**: Please don’t write software handling money if this is the sum total of your understanding of the cryptography.  
> **username_1**: You use the `scriptPubKey` of the output that is being spent. Each input refers to a specific output, you use the `scriptPubKey` of that output. Not the `scriptPubkey`s of the outputs that are created by the transaction.  

---

