3
Suppose I have two inputs belonging to the same address.
2
Do I need to provide a signature script for each input that proves that I own it?
Only signing and checking signatures once for each public key, assuming signed with SIGHASH_ALL, seems like it would be safe, but I don't think there's any such optimization in the bitcoin code. If something was signed with SIGHASH_SINGLE, though, then it wouldn't be okay to assume that the owner of the key approves of all other outputs too.
Wouldn't that waste space?
Yes, and signatures are the largest single component of a bitcoin transaction, so it's a non-negligible space too. At the same time, though, spending from two UTXOs that were sent to the same address probably isn't the most common type of transaction.
Also, in the standard client, are the signatures exactly the same, or are they two different but valid signatures?
Looking at the SignatureHash code, the input scripSigs are all emptied and then only the one corresponding to the input that is being signed is filled with the previous scriptPubKey (for somewhat strange reasons).
// Blank out other inputs' signatures
for (unsigned int i = 0; i < txTmp.vin.size(); i++)
txTmp.vin[i].scriptSig = CScript();
txTmp.vin[nIn].scriptSig = scriptCode;
This makes it so that the hash that needs to be signed (the result of SignatureHash) is different for each input. Thus, since different data is being signed, the signatures will most definitely be different. Even if the data being signed were the same, ECC signatures are non-deterministic (involving a random number) and so will not be the same from signing to signing.
EDIT: The long and short of it is that the double hash that needs to be signed is different for each input in the new transaction, so even if the same key pair is being used, a new signature must be calculated.
hash that needs to be signed ... is different for each inputSeriously? Does that mean that later signatures depend on previous signatures? – Nick ODell – 2014-11-07T06:00:47.667P.S. The code you quoted appears to no longer be used.
– Nick ODell – 2014-11-07T06:01:38.773The signatures don't depend on other signatures, the hashes that need to be signed can all be calculated ahead of time, and will be different just because the index of the spending from them is different. Where is the code that is used now to get the SignatureHash? – morsecoder – 2014-11-07T06:05:51.083
CTransactionSignatureSerializer::Serialize called by CHashWriter::operator<<. I think. – Nick ODell – 2014-11-07T06:13:00.807
That looks right. It's now encapsulated in a fancy Serialization object in Interpreter.cpp (https://github.com/bitcoin/bitcoin/blob/73b82a30892224b17aa1b9db9b6de4eeeb903b7f/src/script/interpreter.cpp).
– morsecoder – 2014-11-07T06:13:24.500