Signature Hashing

Sighash flags and the transaction signature-hash (digest) algorithms

When OP_CHECKSIG (or OP_CHECKMULTISIG) verifies a signature, it does not sign the whole transaction verbatim. It signs a signature hash (the sighash or digest): a 32-byte double-SHA-256 over a specific serialization of the spending transaction, determined by a one-byte sighash type appended to the signature. This page specifies the sighash type byte and the digest algorithms exactly, so a signer and a verifier compute the identical preimage.

Ground truth. Flag values derive from src/script/sighashtype.h; the digest algorithms and gating from SignatureHash, SignatureHashBIP143, and SignatureHashOriginal in src/script/interpreter.cpp. Citations pin to release v1.2.2 (commit 879fc8b).

The sighash type byte

The sighash type is the last byte of an ECDSA signature as it appears on the stack. It packs a base type (low bits) with independent modifier flags (sighashtype.h):

Flag	Value	Meaning
SIGHASH_ALL	0x01	Sign all outputs (default base type).
SIGHASH_NONE	0x02	Sign no outputs (they are not committed).
SIGHASH_SINGLE	0x03	Sign only the output at the same index as this input.
SIGHASH_CHRONICLE	0x20	Use the Original Transaction Digest Algorithm (OTDA) for this signature (Chronicle).
SIGHASH_FORKID	0x40	Use the BSV/BIP143-style digest with the fork id mixed in (mandatory since the UAHF).
SIGHASH_ANYONECANPAY	0x80	Sign only this input; other inputs are not committed.

The base type is the low 5 bits: baseType = sigHash & 0x1F (BASE_SIGHASH_MASK). The fork value is the high bytes: forkValue = sigHash >> 8. SIGHASH_CHRONICLE, SIGHASH_FORKID, and SIGHASH_ANYONECANPAY are independent bits combined with the base type — e.g. SIGHASH_ALL | SIGHASH_FORKID = 0x41.

Digest algorithm selection

SignatureHash (interpreter.cpp L2112) picks the algorithm from the flags:

• If SIGHASH_FORKID is set (and fork id is enabled), it uses the BIP143-style BSV digest (SignatureHashBIP143). This has been the mandatory form since the UAHF replay-protection upgrade.
• From Chronicle, if SIGHASH_CHRONICLE (0x20) is set the signature instead uses the Original (legacy) Transaction Digest Algorithm (SignatureHashOriginal).
• The choice is per signature: within one transaction, signatures on different inputs — or multiple signatures on one input — may independently use BIP143 or OTDA. A signer who does nothing keeps the current BIP143 behaviour.

Signature configuration	CHRONICLE bit	Digest used
any signature	0	BIP143 (BSV)
any signature	1	OTDA (original)
several signatures across inputs	mixed	each uses its own bit

BIP143-style BSV digest

SignatureHashBIP143 builds a preimage and returns its double-SHA-256. The preimage fields, in exact order (interpreter.cpp L2063–L2083):

#	Field	Size (bytes)	Notes
1	nVersion	4	Transaction version, little-endian.
2	hashPrevouts	32	See midstates below.
3	hashSequence	32	See midstates below.
4	outpoint	36	The prevout (txid 32 + index 4) of the input being signed.
5	scriptCode	var	The script being executed for this input (CompactSize length + bytes).
6	amount	8	Satoshi value of the output being spent, little-endian.
7	nSequence	4	nSequence of the input being signed, little-endian.
8	hashOutputs	32	See midstates below.
9	nLockTime	4	Transaction locktime, little-endian.
10	sighashType	4	The sighash type, as a 4-byte little-endian value.

The three midstates depend on the flags (interpreter.cpp L2043–L2061):

• hashPrevouts = double-SHA-256 of every input's outpoint concatenated — unless ANYONECANPAY is set, in which case it is 32 zero bytes.
• hashSequence = double-SHA-256 of every input's nSequence concatenated — unless ANYONECANPAY is set, or the base type is SINGLE or NONE, in which case it is 32 zero bytes.
• hashOutputs = double-SHA-256 of every output serialized — unless the base type is SINGLE or NONE. For SINGLE, if an output exists at this input's index, hashOutputs is the double-SHA-256 of that one output; otherwise (and for NONE) it is 32 zero bytes.

Original (legacy) digest

The Original Transaction Digest Algorithm (SignatureHashOriginal) is the pre-UAHF algorithm: it builds a modified copy of the transaction (clearing other inputs' scriptSigs, setting the signed input's scriptSig to scriptCode, and adjusting outputs/sequences according to the base type and ANYONECANPAY), appends the 4-byte sighash type, and double-SHA-256 hashes the result. Chronicle reinstates it as an opt-in via the SIGHASH_CHRONICLE bit; it is otherwise not used post-UAHF.

Sighash-type validity gating

Under strict encoding, the sighash type is validated before the digest is computed (interpreter.cpp L291–L307):

Error	Raised when
SCRIPT_ERR_SIG_HASHTYPE	the sighash type is not a defined combination.
SCRIPT_ERR_ILLEGAL_FORKID	SIGHASH_FORKID is set but fork-id digests are not enabled in this context.
SCRIPT_ERR_MUST_USE_FORKID	fork-id digests are required (post-UAHF) but the signature does not set SIGHASH_FORKID.
SCRIPT_ERR_ILLEGAL_CHRONICLE	SIGHASH_CHRONICLE is set but the Chronicle digest is not enabled (i.e. before Chronicle).

See Opcodes for OP_CHECKSIG/OP_CHECKMULTISIG and the Protocol Upgrade History page for the UAHF and Chronicle activation heights.