BIP 0118 - Revision history

934: Update BIP text with latest version from https://github.com/bitcoin/bips/blob/40aef277672e28af/bip-0118.mediawiki

2022-09-29T23:13:49Z

Update BIP text with latest version from https://github.com/bitcoin/bips/blob/40aef277672e28af/bip-0118.mediawiki

← Older revision		Revision as of 23:13, 29 September 2022
Line 77:		Line 77:
	==== Signature message ====		==== Signature message ====

	~~The function ''SigMsg118(hash_type, ext_flag)'' computes~~ the ~~message being signed as a byte array, analogously to~~ ''~~SigMsg~~(hash_type~~, ext_flag~~)'' ~~defined in [[bip-0341.mediawiki\|BIP 341]],~~ ''~~SigExt118~~(hash_type~~,key_version~~)'' ~~computes~~ the ~~extension, similarly to [[bip-0342.mediawiki\|BIP 342]]~~.		We define the functions ''Msg118(hash_type)'' and ''Ext118(hash_type)'' which compute the message being signed as a byte array.

	The parameter ''hash_type'' is an 8-bit unsigned value, reusing values defined in [[bip-0341.mediawiki\|BIP 341]], with the addition that the values <code>0x41</code>, <code>0x42</code>, <code>0x43</code>, <code>0xc1</code>, <code>0xc2</code>, and <code>0xc3</code> are also valid for BIP 118 public keys.		The parameter ''hash_type'' is an 8-bit unsigned value, reusing values defined in [[bip-0341.mediawiki\|BIP 341]], with the addition that the values <code>0x41</code>, <code>0x42</code>, <code>0x43</code>, <code>0xc1</code>, <code>0xc2</code>, and <code>0xc3</code> are also valid for BIP 118 public keys.
Line 85:		Line 85:
	* <code>SIGHASH_ANYPREVOUT = 0x40</code>		* <code>SIGHASH_ANYPREVOUT = 0x40</code>
	* <code>SIGHASH_ANYPREVOUTANYSCRIPT = 0xc0</code>		* <code>SIGHASH_ANYPREVOUTANYSCRIPT = 0xc0</code>

	As per [[bip-0341.mediawiki\|BIP 341]], the parameter ''ext_flag'' is an integer in the range 0-127, used for indicating that extensions are added at the end of the message. The parameter ''key_version'' is an 8-bit unsigned value (an integer in the range 0-255) used for committing to the public key version.

	The following restrictions apply and cause validation failure if violated:		The following restrictions apply and cause validation failure if violated:
Line 92:		Line 90:
	* Using <code>SIGHASH_SINGLE</code> without a "corresponding output" (an output with the same index as the input being verified).		* Using <code>SIGHASH_SINGLE</code> without a "corresponding output" (an output with the same index as the input being verified).

	If these restrictions ~~aren~~'~~t violated~~, ''~~SigMsg118~~(hash_type,~~ext_flag~~)'' ~~evaluates to~~ the concatenation of the following data, in order (with byte size of each item listed in parentheses). Numerical values in 2, 4, or 8-byte items are encoded in little-endian.		If these restrictions are not violated, ''Msg118(hash_type)'' evaluates as follows.

			If ''hash_type & 0x40 == 0'', then ''Msg118(hash_type) = SigMsg(hash_type, 1)'', where ''SigMsg'' is as defined in [[bip-0341.mediawiki\|BIP 341]].

			If ''hash_type & 0x40 != 0'', then ''Msg118(hash_type)'' is the concatenation of the following data, in order (with byte size of each item listed in parentheses). Numerical values in 2, 4, or 8-byte items are encoded in little-endian.

	* Control:		* Control:
Line 99:		Line 101:
	** ''nVersion'' (4): the ''nVersion'' of the transaction.		** ''nVersion'' (4): the ''nVersion'' of the transaction.
	** ''nLockTime'' (4): the ''nLockTime'' of the transaction.		** ''nLockTime'' (4): the ''nLockTime'' of the transaction.
	** If ''hash_type & 0xc0'' is zero:
	*** ''sha_prevouts'' (32): the SHA256 of the serialization of all input outpoints.
	*** ''sha_amounts'' (32): the SHA256 of the serialization of all spent output amounts.
	*** ''sha_scriptpubkeys'' (32): the SHA256 of the serialization of all spent output ''scriptPubKey''s.
	*** ''sha_sequences'' (32): the SHA256 of the serialization of all input ''nSequence''.
	** If ''hash_type & 3'' does not equal <code>SIGHASH_NONE</code> or <code>SIGHASH_SINGLE</code>:		** If ''hash_type & 3'' does not equal <code>SIGHASH_NONE</code> or <code>SIGHASH_SINGLE</code>:
	*** ''sha_outputs'' (32): the SHA256 of the serialization of all outputs in <code>CTxOut</code> format.		*** ''sha_outputs'' (32): the SHA256 of the serialization of all outputs in <code>CTxOut</code> format.
	* Data about this input:		* Data about this input:
	** ''spend_type'' (1): equal to ''(ext_flag * 2~~) + annex_present'', where ''annex_present'' is 0~~ if no annex is present, or 1 otherwise (the original witness stack has two or more witness elements, and the first byte of the last element is ''0x50'')		** ''spend_type'' (1): equal to 2 if no annex is present, or 3 otherwise (the original witness stack has two or more witness elements, and the first byte of the last element is ''0x50'')
	** If ''hash_type & 0xc0'' is ~~non-zero:~~		** If ''hash_type & 0xc0'' is <code>SIGHASH_ANYPREVOUT</code>:
	*** If ''hash_type & 0xc0'' is <code>SIGHASH_ANYONECANPAY</code>:		*** ''amount'' (8): value of the previous output spent by this input.
	**** ''outpoint'' (36): the <code>COutPoint</code> of this input (32-byte hash + 4-byte little-endian).		*** ''scriptPubKey'' (35): ''scriptPubKey'' of the previous output spent by this input, serialized as script inside <code>CTxOut</code>. Its size is always 35 bytes.
	*** If ''hash_type & 0xc0'' is <code>SIGHASH_ANYONECANPAY</code> or <code>SIGHASH_ANYPREVOUT</code>:		** ''nSequence'' (4): ''nSequence'' of this input.
	**** ''amount'' (8): value of the previous output spent by this input.
	**** ''scriptPubKey'' (35): ''scriptPubKey'' of the previous output spent by this input, serialized as script inside <code>CTxOut</code>. Its size is always 35 bytes.
	*** ''nSequence'' (4): ''nSequence'' of this input.
	** If ''hash_type & 0xc0'' is zero:
	*** ''input_index'' (4): index of this input in the transaction input vector. Index of the first input is 0.
	** If an annex is present (the lowest bit of ''spend_type'' is set):		** If an annex is present (the lowest bit of ''spend_type'' is set):
	*** ''sha_annex'' (32): the SHA256 of ''(compact_size(size of annex) \|\| annex)'', where ''annex'' includes the mandatory ''0x50'' prefix.		*** ''sha_annex'' (32): the SHA256 of ''(compact_size(size of annex) \|\| annex)'', where ''annex'' includes the mandatory ''0x50'' prefix.
Line 123:		Line 115:
	*** ''sha_single_output'' (32): the SHA256 of the corresponding output in <code>CTxOut</code> format.		*** ''sha_single_output'' (32): the SHA256 of the corresponding output in <code>CTxOut</code> format.

	Similarly, ''~~SigExt118~~(hash_type~~,key_version~~)'' evaluates to the concatenation of:		Similarly, ''Ext118(hash_type)'' evaluates to the concatenation of the following data, in order:

	* Extension:		* Extension:
	** If ''hash_type & 0xc0'' is not <code>SIGHASH_ANYPREVOUTANYSCRIPT</codE>:		** If ''hash_type & 0xc0'' is not <code>SIGHASH_ANYPREVOUTANYSCRIPT</codE>:
	*** ''tapleaf_hash'' (32): the tapleaf hash as defined in [[bip-0341.mediawiki\|BIP 341]]		*** ''tapleaf_hash'' (32): the tapleaf hash as defined in [[bip-0341.mediawiki\|BIP 341]]
	** ''key_version'' (1).		** ''key_version'' (1): a constant value ''0x01'' representing that this is a signature for a BIP 118 public key.
	** ''codesep_pos'' (4): the opcode position of the last executed <code>OP_CODESEPARATOR</code> before the currently executed signature opcode, with the value in little endian (or ''0xffffffff'' if none executed). The first opcode in a script has a position of 0. A multi-byte push opcode is counted as one opcode, regardless of the size of data being pushed.		** ''codesep_pos'' (4): the opcode position of the last executed <code>OP_CODESEPARATOR</code> before the currently executed signature opcode, with the value in little endian (or ''0xffffffff'' if none executed). The first opcode in a script has a position of 0. A multi-byte push opcode is counted as one opcode, regardless of the size of data being pushed.

	Note that if ''hash_type & 0x40'' is zero, ''SigMsg118(hash_type,ext_flag) == SigMsg(hash_type,ext_flag)'', and ''SigExt118(hash_type,0x00) == ext'' (where ''ext'' is the message extension as defined in [[bip-0342.mediawiki\|BIP 342]]).

	To verify a signature ''sig'' for a BIP 118 public key ''p'':		To verify a signature ''sig'' for a BIP 118 public key ''p'':

	* If the ''sig'' is 64 bytes long, return ''Verify(p, hash<sub>TapSigHash</sub>(0x00 \|\| ~~SigMsg118~~(0x00~~, 1~~) \|\| ~~SigExt118~~(0x00~~, 0x01~~), sig)''~~, where ''Verify'' is defined in [[bip-0340.mediawiki\|BIP 340]].~~		* If the ''sig'' is 64 bytes long, return ''Verify(p, hash<sub>TapSigHash</sub>(0x00 \|\| Msg118(0x00) \|\| Ext118(0x00)), sig)''
	* If the ''sig'' is 65 bytes long, return ''sig[64] ≠ 0x00 and Verify(p, hash<sub>TapSighash</sub>(0x00 \|\| ~~SigMsg118~~(sig[64]~~, 1~~) \|\| ~~SigExt118~~(sig[64]~~, 0x01~~), sig[0:64])''.		* If the ''sig'' is 65 bytes long, return ''sig[64] ≠ 0x00 and Verify(p, hash<sub>TapSighash</sub>(0x00 \|\| Msg118(sig[64]) \|\| Ext118(sig[64])), sig[0:64])''.
	* Otherwise, fail.		* Otherwise, fail.

			''Verify'' is as defined in [[bip-0340.mediawiki\|BIP 340]].

	The key differences from [[bip-0342.mediawiki\|BIP 342]] signature verification are:		The key differences from [[bip-0342.mediawiki\|BIP 342]] signature verification are:
Line 143:		Line 135:
	* In all cases, <code>key_version</code> is set to the constant value <code>0x01</code> instead of <code>0x00</code>.<ref>'''Why change key_version?''' Changing <code>key_version</code> ensures that if the same private key is used to generate both a [[bip-0342.mediawiki\|BIP 342]] key and a BIP 118 public key, that a signature for the [[bip-0342.mediawiki\|BIP 342]] key is not also valid for the BIP 118 public key (and vice-versa).</ref>		* In all cases, <code>key_version</code> is set to the constant value <code>0x01</code> instead of <code>0x00</code>.<ref>'''Why change key_version?''' Changing <code>key_version</code> ensures that if the same private key is used to generate both a [[bip-0342.mediawiki\|BIP 342]] key and a BIP 118 public key, that a signature for the [[bip-0342.mediawiki\|BIP 342]] key is not also valid for the BIP 118 public key (and vice-versa).</ref>
	* If <code>SIGHASH_ANYPREVOUT</code> is set, the digest is calculated as if <code>SIGHASH_ANYONECANPAY</code> was set, except <code>outpoint</code> is not included in the digest.		* If <code>SIGHASH_ANYPREVOUT</code> is set, the digest is calculated as if <code>SIGHASH_ANYONECANPAY</code> was set, except <code>outpoint</code> is not included in the digest.
	* If <code>SIGHASH_ANYPREVOUTANYSCRIPT</code> is set, the digest is calculated as if <code>SIGHASH_ANYONECANPAY</code> was set, except <code>outpoint</code>, <code>scriptPubKey</code> and <code>tapleaf_hash</code> are not included in the digest.		* If <code>SIGHASH_ANYPREVOUTANYSCRIPT</code> is set, the digest is calculated as if <code>SIGHASH_ANYONECANPAY</code> was set, except <code>outpoint</code>, <code>amount</code>, <code>scriptPubKey</code> and <code>tapleaf_hash</code> are not included in the digest.

	== Security ==		== Security ==

934: Update BIP text with latest version from https://github.com/bitcoin/bips/blob/edffe529056f6dfd/bip-0118.mediawiki

2021-12-15T16:06:13Z

Update BIP text with latest version from https://github.com/bitcoin/bips/blob/edffe529056f6dfd/bip-0118.mediawiki

Show changes

934: Update BIP text with latest version from https://github.com/bitcoin/bips/blob/b5723035e23896d0/bip-0118.mediawiki

2019-09-24T18:00:58Z

Update BIP text with latest version from https://github.com/bitcoin/bips/blob/b5723035e23896d0/bip-0118.mediawiki

New page

{{bip}}
{{BipMoved|bip-0118.mediawiki}}

<pre>
BIP: 118
Layer: Consensus (soft fork)
Title: SIGHASH_NOINPUT
Author: Christian Decker <decker.christian@gmail.com>
Comments-Summary: No comments yet.
Comments-URI: https://github.com/bitcoin/bips/wiki/Comments:BIP-0118
Status: Draft
Type: Standards Track
Created: 2017-02-28
License: BSD-3-Clause
</pre>

== Abstract ==
This BIP describes a new signature hash flag (<tt>sighash</tt>-flag) for
segwit transactions. It removes any commitment to the output being
spent from the signature verification mechanism. This enables dynamic
binding of transactions to outputs, predicated solely on the
compatibility of output scripts to input scripts.

== Motivation ==
Off-chain protocols make use of transactions that are not yet
broadcast to the Bitcoin network in order to renegotiate the final
state that should be settled on-chain.
In a number of cases it is desirable to react to a given transaction
being seen on-chain with a predetermined reaction in the form of
another transaction.
Often the reaction is identical, no matter which transaction is seen
on-chain, but the application still needs to create many identical
transactions.
This is because signatures in the input of a transaction uniquely
commit to the hash of the transaction that created the output being
spent.

This proposal introduces a new sighash flag that modifies the behavior
of the transaction digest algorithm used in the signature creation and
verification, to exclude the previous output commitment.
By removing the commitment we enable dynamic rebinding of a signed
transaction to outputs whose <tt>witnessProgram</tt> and value match the ones
in the <tt>witness</tt> of the spending transaction.

The dynamic binding is opt-in and can further be restricted by using
unique <tt>witnessProgram</tt> scripts that are specific to the application
instance, e.g., using public keys that are specific to the off-chain
protocol instance.

== Specification ==
<tt>SIGHASH_NOINPUT</tt> is a flag with value <tt>0x40</tt> appended to a signature
so that the signature does not commit to any of the inputs, and
therefore to the outputs being spent. The flag applies solely to the
verification of that single signature.

The <tt>SIGHASH_NOINPUT</tt> flag is only active for segwit scripts with
version 1 or higher. Should the flag be used in a non-segwit script or
a segwit script of version 0, the current behavior is maintained and
the script execution MUST abort with a failure.

The transaction digest algorithm from BIP 143 is used when verifying a
<tt>SIGHASH_NOINPUT</tt> signature, with the following modifications:

2. hashPrevouts (32-byte hash) is 32 0x00 bytes
3. hashSequence (32-byte hash) is 32 0x00 bytes
4. outpoint (32-byte hash + 4-byte little endian) is
set to 36 0x00 bytes
5. scriptCode of the input is set to an empty script
0x00

The <tt>value</tt> of the previous output remains part of the transaction
digest and is therefore also committed to in the signature.

The <tt>NOINPUT</tt> flag MAY be combined with the <tt>SINGLE</tt> flag in which
case the <tt>hashOutputs</tt> is modified as per BIP
143<ref>https://github.com/bitcoin/bips/blob/master/bip-0143.mediawiki</ref>: it
only commits to the output with the matching index, if such output exists, and
is a <tt>uint256</tt> <tt>0x0000......0000</tt> otherwise.

Being a change in the digest algorithm, the <tt>NOINPUT</tt> flag applies to
all segwit signature verification opcodes, specifically it applies to:

* <tt>OP_CHECKSIG</tt>

* <tt>OP_CHECKSIGVERIFY</tt>

* <tt>OP_CHECKMULTISIG</tt>

* <tt>OP_CHECKMULTISIGVERIFY</tt>

== Binding through scripts ==
Using <tt>NOINPUT</tt> the input containing the signature no longer
references a specific output.
Any participant can take a transaction and rewrite it by changing the
hash reference to the previous output, without invalidating the
signatures.
This allows transactions to be bound to any output that matches the
value committed to in the <tt>witness</tt> and whose <tt>witnessProgram</tt>,
combined with the spending transaction's <tt>witness</tt> returns <tt>true</tt>.

Previously, all information in the transaction was committed in the
signature itself, while now the relationship between the spending
transaction and the output being spent is solely based on the
compatibility of the <tt>witnessProgram</tt> and the <tt>witness</tt>.

This also means that particular care has to be taken in order to avoid
unintentionally enabling this rebinding mechanism. <tt>NOINPUT</tt> MUST NOT
be used, unless it is explicitly needed for the application, e.g., it
MUST NOT be a default signing flag in a wallet
implementation. Rebinding is only possible when the outputs the
transaction may bind to all use the same public keys. Any public key
that is used in a <tt>NOINPUT</tt> signature MUST only be used for outputs
that the input may bind to, and they MUST NOT be used for transactions
that the input may not bind to. For example an application SHOULD
generate a new key-pair for the application instance using <tt>NOINPUT</tt>
signatures and MUST NOT reuse them afterwards.

== Deployment ==
The <tt>NOINPUT</tt> sighash flag is to be deployed during a regular segwit
script update.

== Backward compatibility ==
As a soft fork, older software will continue to operate without
modification. Non-upgraded nodes, however, will not verify the
validity of the new sighash flag and will consider the transaction
valid by default. Being only applicable to segwit transactions,
non-segwit nodes will see an anyone-can-spend script and will consider
it valid.

== Acknowledgments ==

The <tt>NOINPUT</tt> sighash flag was first proposed by Joseph Poon in
February 2016<ref>https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2016-February/012460.html</ref>, after being mentioned in the original
Lightning paper<ref>http://lightning.network/lightning-network.pdf</ref>. A formal proposal was however
deferred until after the activation of segwit. This proposal is a
continuation of this discussion and attempts to formalize it in such a
way that it can be included in the Bitcoin protocol. As such we'd like
acknowledge Joseph Poon and Thaddeus Dryja as the original inventors
of the <tt>NOINPUT</tt> sighash flag, and its uses in off-chain protocols.

== References ==

<references/>

== Copyright ==

This document is licensed under the BSD 3 Clause license.