READ THE CODE

Inside Bitcoin

The code behind the network, with room to understand it.

Stable release v32.1bitcoin/bitcoin · f0de87f04062 ↗3,020 source files · 47.5 MB stored on the server340 file guides

Release published 2026-10-28 · Snapshot fetched 2026-11-01. Latest stable release at fetch time; development branches and Git history are excluded. Only the selected code window and visible folders load here.

48,650 bytes · SHA-256 3fb88acb3da03ce9… · View upstream ↗

1// Copyright (c) 2009-2010 Satoshi Nakamoto
2// Copyright (c) 2009-present The Bitcoin Core developers
3// Distributed under the MIT software license, see the accompanying
4// file COPYING or http://www.opensource.org/licenses/mit-license.php.
5
6#include <script/sign.h>
7
8#include <addresstype.h>
9#include <coins.h>
10#include <consensus/amount.h>
11#include <hash.h>
12#include <key.h>
13#include <musig.h>
14#include <policy/policy.h>
15#include <prevector.h>
16#include <primitives/transaction.h>
17#include <script/keyorigin.h>
18#include <script/miniscript.h>
19#include <script/script.h>
20#include <script/script_error.h>
21#include <script/signingprovider.h>
22#include <script/solver.h>
23#include <script/verify_flags.h>
24#include <serialize.h>
25#include <uint256.h>
26#include <util/check.h>
27#include <util/translation.h>
28#include <util/vector.h>
29
30#include <algorithm>
31#include <array>
32#include <cstddef>
33#include <functional>
34#include <iterator>
35#include <span>
36#include <string>
37
38typedef std::vector<unsigned char> valtype;
39
40MutableTransactionSignatureCreator::MutableTransactionSignatureCreator(const CMutableTransaction& tx, unsigned int input_idx, const CAmount& amount, const SignOptions& options)
41    : m_txto{tx}, nIn{input_idx}, m_options{options}, amount{amount}, checker{&m_txto, nIn, amount, MissingDataBehavior::FAIL},
42      m_txdata(nullptr)
43{
44}
45
46MutableTransactionSignatureCreator::MutableTransactionSignatureCreator(const CMutableTransaction& tx, unsigned int input_idx, const CAmount& amount, const PrecomputedTransactionData* txdata, const SignOptions& options)
47    : m_txto{tx}, nIn{input_idx}, m_options{options}, amount{amount},
48      checker{txdata ? MutableTransactionSignatureChecker{&m_txto, nIn, amount, *txdata, MissingDataBehavior::FAIL} :
49                       MutableTransactionSignatureChecker{&m_txto, nIn, amount, MissingDataBehavior::FAIL}},
50      m_txdata(txdata)
51{
52}
53
54bool MutableTransactionSignatureCreator::CreateSig(const SigningProvider& provider, std::vector<unsigned char>& vchSig, const CKeyID& address, const CScript& scriptCode, SigVersion sigversion) const
55{
56    assert(sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0);
57
58    CKey key;
59    if (!provider.GetKey(address, key))
60        return false;
61
62    // Signing with uncompressed keys is disabled in witness scripts
63    if (sigversion == SigVersion::WITNESS_V0 && !key.IsCompressed())
64        return false;
65
66    // Signing without known amount does not work in witness scripts.
67    if (sigversion == SigVersion::WITNESS_V0 && !MoneyRange(amount)) return false;
68
69    // BASE/WITNESS_V0 signatures don't support explicit SIGHASH_DEFAULT, use SIGHASH_ALL instead.
70    const int hashtype = m_options.sighash_type == SIGHASH_DEFAULT ? SIGHASH_ALL : m_options.sighash_type;
71
72    uint256 hash = SignatureHash(scriptCode, m_txto, nIn, hashtype, amount, sigversion, m_txdata);
73    if (!key.Sign(hash, vchSig))
74        return false;
75    vchSig.push_back((unsigned char)hashtype);
76    return true;
77}
78
79std::optional<uint256> MutableTransactionSignatureCreator::ComputeSchnorrSignatureHash(const uint256* leaf_hash, SigVersion sigversion) const
80{
81    assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
82
83    // BIP341/BIP342 signing needs lots of precomputed transaction data. While some
84    // (non-SIGHASH_DEFAULT) sighash modes exist that can work with just some subset
85    // of data present, for now, only support signing when everything is provided.
86    if (!m_txdata || !m_txdata->m_bip341_taproot_ready || !m_txdata->m_spent_outputs_ready) return std::nullopt;
87
88    ScriptExecutionData execdata;
89    execdata.m_annex_init = true;
90    execdata.m_annex_present = false; // Only support annex-less signing for now.
91    if (sigversion == SigVersion::TAPSCRIPT) {
92        execdata.m_codeseparator_pos_init = true;
93        execdata.m_codeseparator_pos = 0xFFFFFFFF; // Only support non-OP_CODESEPARATOR BIP342 signing for now.
94        if (!leaf_hash) return std::nullopt; // BIP342 signing needs leaf hash.
95        execdata.m_tapleaf_hash_init = true;
96        execdata.m_tapleaf_hash = *leaf_hash;
97    }
98    uint256 hash;
99    if (!SignatureHashSchnorr(hash, execdata, m_txto, nIn, m_options.sighash_type, sigversion, *m_txdata, MissingDataBehavior::FAIL)) return std::nullopt;
100    return hash;
101}
102
103bool MutableTransactionSignatureCreator::CreateSchnorrSig(const SigningProvider& provider, std::vector<unsigned char>& sig, const XOnlyPubKey& pubkey, const uint256* leaf_hash, const uint256* merkle_root, SigVersion sigversion) const
104{
105    CKey key;
106    if (!provider.GetKeyByXOnly(pubkey, key)) return false;
107
108    std::optional<uint256> hash = ComputeSchnorrSignatureHash(leaf_hash, sigversion);
109    if (!hash.has_value()) return false;
110
111    sig.resize(64);
112    // Use uint256{} as aux_rnd for now.
113    if (!key.SignSchnorr(*hash, sig, merkle_root, {})) return false;
114    if (m_options.sighash_type) sig.push_back(m_options.sighash_type);
115    return true;
116}
117
118std::vector<uint8_t> MutableTransactionSignatureCreator::CreateMuSig2Nonce(const SigningProvider& provider, const CPubKey& aggregate_pubkey, const CPubKey& script_pubkey, const CPubKey& part_pubkey, const uint256* leaf_hash, const uint256* merkle_root, SigVersion sigversion, const SignatureData& sigdata) const
119{
120    assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
121
122    // Retrieve the private key
123    CKey key;
124    if (!provider.GetKey(part_pubkey.GetID(), key)) return {};
125
126    // Retrieve participant pubkeys
127    auto it = sigdata.musig2_pubkeys.find(aggregate_pubkey);
128    if (it == sigdata.musig2_pubkeys.end()) return {};
129    const std::vector<CPubKey>& pubkeys = it->second;
130    if (std::find(pubkeys.begin(), pubkeys.end(), part_pubkey) == pubkeys.end()) return {};
131
132    // Compute sighash
133    std::optional<uint256> sighash = ComputeSchnorrSignatureHash(leaf_hash, sigversion);
134    if (!sighash.has_value()) return {};
135
136    MuSig2SecNonce secnonce;
137    std::vector<uint8_t> out = ::CreateMuSig2Nonce(secnonce, *sighash, key, aggregate_pubkey, pubkeys);
138    if (out.empty()) return {};
139
140    // Store the secnonce in the SigningProvider
141    provider.SetMuSig2SecNonce(MuSig2SessionID(script_pubkey, part_pubkey, *sighash, out), std::move(secnonce));
142
143    return out;
144}
145
146bool MutableTransactionSignatureCreator::CreateMuSig2PartialSig(const SigningProvider& provider, uint256& partial_sig, const CPubKey& aggregate_pubkey, const CPubKey& script_pubkey, const CPubKey& part_pubkey, const uint256* leaf_hash, const std::vector<std::pair<uint256, bool>>& tweaks, SigVersion sigversion, const SignatureData& sigdata) const
147{
148    assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
149
150    // Retrieve private key
151    CKey key;
152    if (!provider.GetKey(part_pubkey.GetID(), key)) return false;
153
154    // Retrieve participant pubkeys
155    auto it = sigdata.musig2_pubkeys.find(aggregate_pubkey);
156    if (it == sigdata.musig2_pubkeys.end()) return false;
157    const std::vector<CPubKey>& pubkeys = it->second;
158    if (std::find(pubkeys.begin(), pubkeys.end(), part_pubkey) == pubkeys.end()) return {};
159
160    // Retrieve pubnonces
161    auto this_leaf_aggkey = std::make_pair(script_pubkey, leaf_hash ? *leaf_hash : uint256());
162    auto pubnonce_it = sigdata.musig2_pubnonces.find(this_leaf_aggkey);
163    if (pubnonce_it == sigdata.musig2_pubnonces.end()) return false;
164    const std::map<CPubKey, std::vector<uint8_t>>& pubnonces = pubnonce_it->second;
165
166    // Check if enough pubnonces
167    if (pubnonces.size() != pubkeys.size()) return false;
168
169    // Compute sighash
170    std::optional<uint256> sighash = ComputeSchnorrSignatureHash(leaf_hash, sigversion);
171    if (!sighash.has_value()) return false;
172
173    // Retrieve the secnonce
174    auto part_pubnonce_it = pubnonces.find(part_pubkey);
175    if (part_pubnonce_it == pubnonces.end()) return false;
176    uint256 session_id = MuSig2SessionID(script_pubkey, part_pubkey, *sighash, part_pubnonce_it->second);
177    std::optional<std::reference_wrapper<MuSig2SecNonce>> secnonce = provider.GetMuSig2SecNonce(session_id);
178    if (!secnonce || !secnonce->get().IsValid()) return false;
179
180    // Compute the sig
181    std::optional<uint256> sig = ::CreateMuSig2PartialSig(*sighash, key, aggregate_pubkey, pubkeys, pubnonces, *secnonce, tweaks);
182    if (!sig) return false;
183    partial_sig = std::move(*sig);
184
185    // Delete the secnonce now that we're done with it
186    assert(!secnonce->get().IsValid());
187    provider.DeleteMuSig2Session(session_id);
188
189    return true;
190}
191
192bool MutableTransactionSignatureCreator::CreateMuSig2AggregateSig(const std::vector<CPubKey>& participants, std::vector<uint8_t>& sig, const CPubKey& aggregate_pubkey, const CPubKey& script_pubkey, const uint256* leaf_hash, const std::vector<std::pair<uint256, bool>>& tweaks, SigVersion sigversion, const SignatureData& sigdata) const
193{
194    assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
195    if (!participants.size()) return false;
196
197    // Retrieve pubnonces and partial sigs
198    auto this_leaf_aggkey = std::make_pair(script_pubkey, leaf_hash ? *leaf_hash : uint256());
199    auto pubnonce_it = sigdata.musig2_pubnonces.find(this_leaf_aggkey);
200    if (pubnonce_it == sigdata.musig2_pubnonces.end()) return false;
201    const std::map<CPubKey, std::vector<uint8_t>>& pubnonces = pubnonce_it->second;
202    auto partial_sigs_it = sigdata.musig2_partial_sigs.find(this_leaf_aggkey);
203    if (partial_sigs_it == sigdata.musig2_partial_sigs.end()) return false;
204    const std::map<CPubKey, uint256>& partial_sigs = partial_sigs_it->second;
205
206    // Check if enough pubnonces and partial sigs
207    if (pubnonces.size() != participants.size()) return false;
208    if (partial_sigs.size() != participants.size()) return false;
209
210    // Compute sighash
211    std::optional<uint256> sighash = ComputeSchnorrSignatureHash(leaf_hash, sigversion);
212    if (!sighash.has_value()) return false;
213
214    std::optional<std::vector<uint8_t>> res = ::CreateMuSig2AggregateSig(participants, aggregate_pubkey, tweaks, *sighash, pubnonces, partial_sigs);
215    if (!res) return false;
216    sig = res.value();
217    if (m_options.sighash_type) sig.push_back(m_options.sighash_type);
218
219    return true;
220}
221
222static bool GetCScript(const SigningProvider& provider, const SignatureData& sigdata, const CScriptID& scriptid, CScript& script)
223{
224    if (provider.GetCScript(scriptid, script)) {
225        return true;
226    }
227    // Look for scripts in SignatureData
228    if (CScriptID(sigdata.redeem_script) == scriptid) {
229        script = sigdata.redeem_script;
230        return true;
231    } else if (CScriptID(sigdata.witness_script) == scriptid) {
232        script = sigdata.witness_script;
233        return true;
234    }
235    return false;
236}
237
238static bool GetPubKey(const SigningProvider& provider, const SignatureData& sigdata, const CKeyID& address, CPubKey& pubkey)
239{
240    // Look for pubkey in all partial sigs
241    const auto it = sigdata.signatures.find(address);
242    if (it != sigdata.signatures.end()) {
243        pubkey = it->second.first;
244        return true;
245    }
246    // Look for pubkey in pubkey lists
247    const auto& pk_it = sigdata.misc_pubkeys.find(address);
248    if (pk_it != sigdata.misc_pubkeys.end()) {
249        pubkey = pk_it->second.first;
250        return true;

FILE GUIDE · KEY SECTIONS

Constructing spending signatures

This file uses signing providers and transaction context to produce signature data for several output types. Creating a signature is separate from broadcasting a transaction.

Line 54 ↗

Create an ECDSA signature

The creator obtains key material through the signing provider and signs the appropriate transaction digest. Knowledge of an address alone cannot produce the signature: the provider must supply the required signing capability.

Line 103 ↗

Create a Schnorr signature

This path handles Schnorr signing with the relevant key and Taproot context. The digest depends on the spend path and hash type; an arbitrary message signature cannot be substituted for it.

Line 745 ↗

Assemble the unlocking data

ProduceSignature works from a locking script and the available provider data. It can collect scriptSig or witness material and track missing information. Partial signing data is not necessarily a complete spend.

Line 918 ↗

Put signature data into an input

UpdateInput copies the assembled scriptSig and witness into a transaction input. It changes the transaction representation; it does not send the transaction to peers or guarantee confirmation.

Independent explanations by MyBitcoinExplorer. Not affiliated with or endorsed by Bitcoin Core. Guides are educational and do not replace the source or its tests.

Bitcoin Core source © its contributors, distributed under the MIT license. Original notices and bundled third-party licenses are retained in the source tree.