You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: bip-0322.mediawiki
+50-78Lines changed: 50 additions & 78 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -49,7 +49,7 @@ Full signatures follow an analogous specification to the BIP-325 challenges and
49
49
50
50
Let there be two virtual transactions <code>to_spend</code> and <code>to_sign</code>.
51
51
52
-
The "to_spend" transaction is:
52
+
The <code>to_spend</code> transaction is:
53
53
54
54
nVersion = 0
55
55
nLockTime = 0
@@ -61,10 +61,9 @@ The "to_spend" transaction is:
61
61
vout[0].nValue = 0
62
62
vout[0].scriptPubKey = message_challenge
63
63
64
-
where message_hash is a BIP340-tagged hash of the message, i.e. sha256_tag(m), where tag = "BIP0322-signed-message", and message_challenge is the to be proven (public) key script.
65
-
For proving funds, message_challenge shall be simply OP_TRUE.
64
+
where <code>message_hash</code> is a BIP340-tagged hash of the message, i.e. sha256_tag(m), where tag = <code>BIP0322-signed-message</code>, and <code>message_challenge</code> is the to be proven (public) key script.
66
65
67
-
The "to_sign" transaction is:
66
+
The <code>to_sign</code> transaction is:
68
67
69
68
nVersion = 0 or as appropriate (e.g. 2, for time locks)
70
69
nLockTime = 0 or as appropriate (for time locks)
@@ -75,13 +74,7 @@ The "to_sign" transaction is:
75
74
vout[0].nValue = 0
76
75
vout[0].scriptPubKey = OP_RETURN
77
76
78
-
When a proof of funds is being created, additional inputs should be included for virtually spending transaction outputs of desired value.
79
-
80
-
* All signatures must use the SIGHASH_ALL flag.
81
-
* The proof is considered valid, inconclusive, or invalid based on whether the to_sign transaction is a valid spend of the to_spend transaction or not, according to the rules specified in the "Consensus and standard flags" section below.
82
-
* Proofs of funds may be encumbered with the in_future flag, according to the rules specified in the "Locktime and Sequence" section below, in which case we refer to the result in text form as "valid_in_future", "inconclusive_in_future", etc.
83
-
84
-
Proofs of funds are the base64-encoding of the to_spend and to_sign transactions concatenated in standard network serialisation, and proofs without additional inputs or time locks (simple proofs) are the base64-encoding of the to_sign script witness.
77
+
A full signature consists of the base64-encoding of the <code>to_spend</code> and <code>to_sign</code> transactions concatenated in standard network serialisation.
85
78
86
79
=== Full (Proof of Funds) ===
87
80
@@ -93,47 +86,58 @@ A signer may construct a proof of funds, demonstrating control of a set of UTXOs
93
86
94
87
Unlike an ordinary signature, validators of a proof of funds need access to the current UTXO set, to learn that the claimed inputs exist on the blockchain, and to learn their scriptPubKeys.
95
88
96
-
A validator must verify it is valid and meets the description of virtual transactions as specified above. See "Validation" below.
97
-
98
-
=== Validation ===
99
-
100
-
To validate a simple proof, the following steps must be taken:
101
-
102
-
# construct the to_spend and to_sign transactions, based on the specification above
103
-
# check the signature using consensus rules, then upgradable rules
104
-
105
-
To validate a proof of funds, the following steps must be taken:
106
-
107
-
# deserialize the to_spend and to_sign transactions from the proof, and fail if the proof contains extraneous bytes
108
-
# verify that the to_sign transaction uses all inputs covered by the proof of funds, exactly once
109
-
# reconstruct the to_spend' and to_sign' transactions, based on the specification above, copying the version, lock time, and sequence values
110
-
# verify that to_spend = to_spend', that to_sign has at least 1 input, has exactly 1 output, and that to_sign.vin[0] = to_sign'.vin[0]
111
-
# set the "in_future" flag if the transaction's lock time is in the future according to consensus rules
112
-
# establish a "coins map", a mapping of outpoints (hash, vout) to coins (scriptPubKey, amount), initialized to coins_map(to_spend.txid, 0) = (to_spend.vout[0], 0)
113
-
# for each proof of fund input, set the corresponding values in the coins map; abort if the input cannot be found
114
-
# check the signature of each input using consensus rules, then upgradable rules
89
+
== Detailed Specification ==
90
+
91
+
For all signature types, except legacy, the <code>to_spend</code> and <code>to_sign</code> transactions must be valid transactions which pass all consensus checks, except of course that the output with prevout <code>000...000:FFFFFFFF</code> does not exist.
92
+
93
+
=== Verification ===
94
+
95
+
A validator is given as input an address ''A'' (which may be omitted in a proof-of-funds), signature ''s'' and message ''m'', and outputs one of three states
96
+
* ''valid at time T and age S'' indicates that the signature has set timelocks but is otherwise valid
97
+
* ''inconclusive'' means the validator was unable to check the scripts
98
+
* ''invalid'' means that some check failed
99
+
100
+
==== Verification Process ====
101
+
102
+
Validation consists of the following steps:
103
+
104
+
# Basic validation
105
+
## Decode ''s'' as the transactions <code>to_sign</code> and <code>to_spend</code>
106
+
## Confirm that <code>message_hash</code> is the correct hash of ''m''
107
+
## Confirm that <code>message_challenge</code> is the scriptPubKey corresponding to ''A'' if ''A'' is present, and otherwise must be <code>OP_TRUE</code>
108
+
## Confirm that all other fields are set as specified above; in particular that
109
+
##* <code>to_spend</code> has exactly one input and one output
110
+
##* <code>to_sign</code> has at least one input and its first input spends the output of </code>to_spend</code>
111
+
##* <code>to_sign</code> has exactly one output, as specified above
112
+
## Confirm that the two transactions together satisfy all consensus rules, except for <code>to_spend</code>'s missing input, and except that ''nSequence'' of <code>to_sign</code>'s first input and ''nLockTime'' of <code>to_sign</code> are not checked.
113
+
# (Optional) If the validator does not have a full script interpreter, it should check that it understands all scripts being satisfied. If not, it should stop here and output ''inconclusive''.
114
+
# Check the **required rules**:
115
+
## All signatures must use the SIGHASH_ALL flag.
116
+
## The use of <code>CODESEPARATOR</code> or <code>FindAndDelete</code> is forbidden.
117
+
## <code>LOW_S</code>, <code>STRICTENC</code> and <code>NULLFAIL</code>: valid ECDSA signatures must be strictly DER-encoded and have a low-S value; invalid ECDSA signature must be the empty push
118
+
## <code>MINIMALDATA</code>: all pushes must be minimally encoded
119
+
## <code>CLEANSTACK</code>: require that only a single stack element remains after evaluation
120
+
## <code>MINIMALIF</code>: the argument of <code>IF</code>/<code>NOTIF</code> must be exactly 0x01 or empty push
121
+
## If any of the above steps failed, the validator should stop and output the ''invalid'' state.
122
+
# Check the **upgradeable rules**
123
+
## The use of NOPs reserved for upgrades is forbidden.
124
+
## The use of segwit versions greater than 0 are forbidden.
125
+
## If any of the above steps failed, the validator should stop and output the ''inconclusive'' state.
126
+
# Let ''T'' by the nLockTime of <code>to_sign</code> and ''S'' be the nSequence of the first input of <code>to_sign</code>. Output the state ''valid at time T and age S''.
115
127
116
128
=== Signing ===
117
129
118
-
Given the P2PKH invoice address <code>a</code> and the message <code>m</code>, and the pubkey-hash function <code>pkh(P) = ripemd160(sha256(P))</code>:
119
-
120
-
# let <code>p</code> be the pubkey-hash <code>pkh(P)</code> for the pubkey <code>P</code>, contained in <code>a</code>
121
-
# let <code>x</code> be the private key associated with <code>P</code> so that <code>pkh(xG) = p</code>
122
-
# let <code>digest</code> be <code>SHA56d(0x18||"Bitcoin Signed Message:\n"||compactint(len(m))||m)</code>
123
-
# create a compact signature <code>sig</code> (aka "recoverable ECDSA signature") using <code>x</code> on <code>digest</code>
124
-
125
-
The resulting proof is <code>sig</code>, serialized using the base64 encoding.
130
+
Signers who control an address ''A'' who wish to sign a message ''m'' act as follows:
126
131
127
-
=== Verifying ===
132
+
# They construct <code>to_spend</code> and <code>to_sign</code> as specified above, using the scriptPubKey of ''A'' for <code>message_challenge</code> and tagged hash of ''m'' as <code>message_hash</code>.
133
+
# Optionally, they may set nLockTime of <code>to_sign</code> or nSequence of its first input.
134
+
# Optionally, they may add any additional outputs to <code>to_sign</code> that they wish to prove control of.
135
+
# They satisfy <code>to_sign</code> as they would any other transaction.
128
136
129
-
Given the P2PKH invoice address <code>a</code>, the message <code>m</code>, the compact signature <code>sig</code>, and the pubkey-hash function <code>pkh(P) = ripemd160(sha256(P))</code>:
137
+
They then encode their signature, choosing either ''simple'' or ''full'' as follows:
130
138
131
-
# let <code>p</code> be the pubkey-hash <code>pkh(P)</code> for the pubkey <code>P</code>, contained in <code>a</code>
132
-
# let <code>digest</code> be <code>SHA56d(0x18||"Bitcoin Signed Message:\n"||compactint(len(m))||m)</code>
133
-
# attempt pubkey recovery for <code>digest</code> using the signature <code>sig</code> and store the resulting pubkey into <code>Q</code>
134
-
## fail verification if pubkey recovery above fails
135
-
# let <code>q</code> be the pubkey-hash <code>pkh(Q)</code> for the pubkey <code>Q</code>
136
-
# if <code>p == q</code>, the proof is valid, otherwise it is invalid
139
+
* If they added no inputs to <code>to_sign</code>, left nSequence and nLockTime at 0, and ''A'' is a Segwit address (either pure or P2SH-wrapped), then they may base64-encode <code>message_signature</code>
140
+
* Otherwise they must base64-encode the concatenation of <code>to_spend</code> followed by <code>to_sign</code>.
137
141
138
142
== Compatibility ==
139
143
@@ -155,38 +159,6 @@ Thanks to David Harding, Jim Posen, Kalle Rosenbaum, Pieter Wuille, Andrew Poels
155
159
156
160
This document is licensed under the Creative Commons CC0 1.0 Universal license.
157
161
158
-
== Consensus and standard flags ==
159
-
160
-
Each flag is associated with some type of enforced rule (most often a soft fork). There are two sets of flags: consensus flags (which result in a block being rejected, if violated), and upgradable flags (which are typically policy-rejected by nodes specifically for the purpose of future network upgrades). The upgradable flags are a super-set of the consensus flags.
161
-
162
-
This BIP specifies that a proof that validates for both rulesets is valid, a proof that validates for consensus rules, but not for upgradable rules, is "inconclusive", and a proof that does not validate for consensus rules is "invalid" (regardless of upgradable rule validation).
163
-
164
-
The ruleset sometimes changes. This BIP does not intend to be complete, nor does it indicate enforcement of rules, it simply lists the rules as they stand at the point of writing.
0 commit comments