Why does pay to pubkey hash contain OP_CHECKSIG at the end instead of beginning?

Couldn't we check the signature even before doing the hash?

We certainly could, but that would be silly. The hash is about 1000x faster than checking a signature. Doing the signature check when the hash fails would be a waste of time

More precisely, couldn't it instead do:

scriptPubKey: OP_CHECKSIGVERIFY OP_DUP OP_HASH160 OP_EQUAL

No, that certainly wouldn't work. The OP_CHECKSIGVERIFY would remove the public key from the stack, so there is nothing to compare it with. The OP_DUP would always fail, as there is nothing to duplicate anymore.

Pieter Wuille

Posted 2017-10-08T06:16:04.443

Reputation: 54 032

aha i see. thanks for the answer. Just to make sure i understood completely, so if we do scriptPubKey: OP_DUP OP_CHECKSIGVERIFY OP_HASH160 <pubKeyHash> OP_EQUAL and scriptSig: <sig> <pubKey>, this would: 1. work; 2. but not efficient therefore not used because hashing is much faster than checksig? – Vlad – 2017-10-08T07:08:15.877

Not quite. After OP_DUP, your stack will be <sig> <pubkey> <pubkey>. Invoking OP_CHECKSIGVERIFY at that point will do a verification with <pubkey> as signature. – Pieter Wuille – 2017-10-08T07:50:43.907

1What would work (but be inefficient): scriptSig={<pubkey> <sig>}, scriptPubKey={OP_OVER OP_CHECKSIGVERIFY OP_HASH160 <pubkeyhash> OP_EQUAL}. – Pieter Wuille – 2017-10-08T08:07:49.223

Actually, the scriptSig would be "<sig> <pubkey>" to use OP_OVER. If it was already "<pubkey> <sig>" the suggestion in the first comment would work, but it would require a change in the scriptSig, not only the scriptPubKey. – diego nunes – 2018-04-23T16:39:59.367

Why does pay to pubkey hash contain OP_CHECKSIG at the end instead of beginning?

Answers