Transaction Signature Verification for Version 0 Witness Program

Summary

Defines a new transaction digest algorithm — the signature hash — used for version 0 witness programs under SegWit. It states two goals: to minimise redundant data hashing during verification, and to cover the value of the input being spent. The original algorithm rehashed the whole transaction for every input, so the amount of data hashed grew with transaction size; because the number of inputs and the cost of each hashing pass grow together, total work scaled with the square of the size, and a single oversized transaction could take longer to verify than an entire ordinary block. BIP143 introduces values that are hashed once in advance and reused across inputs — hashPrevouts, hashSequence and hashOutputs — which brings the growth back to linear. It also folds the amount of the output being spent into the digest, so an offline signer can compute the fee correctly without fetching the previous transactions and cannot be lied to about input values.

Why it matters

It closed a denial-of-service avenue in which a deliberately large transaction imposed disproportionate verification cost, doing so on the new SegWit side rather than by changing legacy rules, and it is what lets hardware wallets verify the fee they are signing. BIP341 extends the same approach for Taproot, committing to the amounts and scripts of every input being spent.

Related BIPs

• BIP 141 — Segregated Witness (Consensus layer)
• BIP 144 — Segregated Witness (Peer Services)
• BIP 341 — Taproot: SegWit version 1 spending rules

Related articles

• Transactions Deep Dive
• Bitcoin Vulnerabilities — Attack Vectors and Real Bugs