Signing data with ECDSA

I was reading about the math behind bitcoins in this article, and one thing I can't seem to wrap my head around is how the said algorithm is used to sign "data". What exactly is this "data"? Is it my bitcoin? If so, how exactly is a bitcoin represented in terms of data? Say I have 5 bitcoins in my Coinbase wallet that I want to send my friend. How would that translate to the whole "gaining the private key and signing your data with it" process as described in the article?

Sorry if this is too novice a question, I'm new to cryptography concepts. Thanks in advance!

Prithaj Nath

Posted 2016-05-12T06:21:26.803

Reputation: 11

Answers

Every Bitcoin in existence today exists as an unspent transaction output (UTXO) on the Bitcoin blockchain. That is, the output of an existing confirmed transaction that has not yet been consumed as the input of some other transaction.

Coinbase has a collection of UTXOs that represent the Bitcoins that they hold. When you tell Coinbase to make a Bitcoin payment to someone from your wallet, they choose one or more of those UTXOs to make the payment with.

They then form a chunk of data that claims those UTXOs and creates a new UTXO giving the Bitcoins to the recipient and one giving any change back to them. It's that chunk of data that they sign with the key for each UTXO they are spending with that payment.

Once the transaction is confirmed, the new UTXO for the recipient is the Bitcoins you sent them. When they see that UTXO appear on the blockchain, they know you paid them. They can then form a transaction that spends that UTXO to transfer those Bitcoins to someone else.

David Schwartz

Posted 2016-05-12T06:21:26.803

Reputation: 46 931

A coin is described by 3 things.

The outpoint: the txid and output index in the creating transaction. Explicitly identifies coins being spent
The amount
The scriptPubKey

To spend a coin, you create a transaction specifying the outpoint as an input. You specify some destinations (known as outputs). The scriptPubKey often requires you to provide a signature authenticating the spend.

ECDSA specifies to take h = H(m) mod n, where H(m) is a hashing algorithm, and use this data to calculate a signature by a private key. Your question is, what is m?

m (the data being signed) is a transaction serialized according to SIGHASH flags which determine what parts are committed to in the signature.

SIGHASH_ALL commits the entire transaction as 'data', so if any of that data changes (someone adds an input, or changes a destination), the signature is rendered invalid.
SIGHASH_NONE captures everything but the outputs (the output index is resized to zero). This ensures the signature is valid so long as the inputs remain the same. The outputs can be changed at will.
SIGHASH_SINGLE captures an input and an output. Anything else can change without rendering the signature invalid.
SIGHASH_ANYONECANPAY can be applied on top of the other sighash types. Only one input is signed (yours), and the outputs.

The SIGHASH flags are appended to the signature, which allows others to repeat the procedure done while signing.

There are some other modifications: - input scripts are set to zero, since signatures can't sign themselves. - the txout.scriptPubKey is added as the txin.scriptSig for this vin (the part since the last OP_CODESEPARATOR) - at the very end, the hashTypeCode (4-byte sighash flag) is appended

For more detail on this process, read over this page and the image: https://en.bitcoin.it/wiki/OP_CHECKSIG

Segregated witness includes a modification to how m is derived. See BIP 143: https://github.com/bitcoin/bips/blob/master/bip-0143.mediawiki

karimkorun

Posted 2016-05-12T06:21:26.803

Reputation: 763