> For the complete documentation index, see [llms.txt](https://hub.bsvblockchain.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hub.bsvblockchain.org/bitcoin-protocol-documentation/specification/signature-hashing.md).

# Signature Hashing

When `OP_CHECKSIG` (or `OP_CHECKMULTISIG`) verifies a signature, it does not sign the whole transaction verbatim. It signs a **signature hash** (the *sighash* or *digest*): a 32-byte double-SHA-256 over a specific serialization of the spending transaction, determined by a one-byte **sighash type** appended to the signature. This page specifies the sighash type byte and the digest algorithms exactly, so a signer and a verifier compute the identical preimage.

**Ground truth.** Flag values derive from [`src/script/sighashtype.h`](https://github.com/bitcoin-sv/bitcoin-sv/blob/879fc8b42168dd0e608dafd51b39c6dabad37d4d/src/script/sighashtype.h); the digest algorithms and gating from `SignatureHash`, `SignatureHashBIP143`, and `SignatureHashOriginal` in [`src/script/interpreter.cpp`](https://github.com/bitcoin-sv/bitcoin-sv/blob/879fc8b42168dd0e608dafd51b39c6dabad37d4d/src/script/interpreter.cpp). Citations pin to release **v1.2.2** (commit `879fc8b`).

## The sighash type byte

The sighash type is the **last byte** of an ECDSA signature as it appears on the stack. It packs a base type (low bits) with independent modifier flags ([`sighashtype.h`](https://github.com/bitcoin-sv/bitcoin-sv/blob/879fc8b42168dd0e608dafd51b39c6dabad37d4d/src/script/sighashtype.h#L16-L21)):

| Flag                   | Value  | Meaning                                                                               |
| ---------------------- | ------ | ------------------------------------------------------------------------------------- |
| `SIGHASH_ALL`          | `0x01` | Sign all outputs (default base type).                                                 |
| `SIGHASH_NONE`         | `0x02` | Sign no outputs (they are not committed).                                             |
| `SIGHASH_SINGLE`       | `0x03` | Sign only the output at the same index as this input.                                 |
| `SIGHASH_CHRONICLE`    | `0x20` | Use the Original Transaction Digest Algorithm (OTDA) for this signature (Chronicle).  |
| `SIGHASH_FORKID`       | `0x40` | Use the BSV/BIP143-style digest with the fork id mixed in (mandatory since the UAHF). |
| `SIGHASH_ANYONECANPAY` | `0x80` | Sign only this input; other inputs are not committed.                                 |

The **base type** is the low 5 bits: `baseType = sigHash & 0x1F` (`BASE_SIGHASH_MASK`). The **fork value** is the high bytes: `forkValue = sigHash >> 8`. `SIGHASH_CHRONICLE`, `SIGHASH_FORKID`, and `SIGHASH_ANYONECANPAY` are independent bits combined with the base type — e.g. `SIGHASH_ALL | SIGHASH_FORKID = 0x41`.

## Digest algorithm selection

`SignatureHash` ([`interpreter.cpp` L2112](https://github.com/bitcoin-sv/bitcoin-sv/blob/879fc8b42168dd0e608dafd51b39c6dabad37d4d/src/script/interpreter.cpp#L2112)) picks the algorithm from the flags:

* If `SIGHASH_FORKID` is set (and fork id is enabled), it uses the **BIP143-style BSV digest** (`SignatureHashBIP143`). This has been the mandatory form since the UAHF replay-protection upgrade.
* From **Chronicle**, if `SIGHASH_CHRONICLE` (`0x20`) is set the signature instead uses the **Original (legacy) Transaction Digest Algorithm** (`SignatureHashOriginal`).
* The choice is **per signature**: within one transaction, signatures on different inputs — or multiple signatures on one input — may independently use BIP143 or OTDA. A signer who does nothing keeps the current BIP143 behaviour.

| Signature configuration          | `CHRONICLE` bit | Digest used           |
| -------------------------------- | --------------- | --------------------- |
| any signature                    | 0               | BIP143 (BSV)          |
| any signature                    | 1               | OTDA (original)       |
| several signatures across inputs | mixed           | each uses its own bit |

## BIP143-style BSV digest

`SignatureHashBIP143` builds a preimage and returns its double-SHA-256. The preimage fields, in exact order ([`interpreter.cpp` L2063–L2083](https://github.com/bitcoin-sv/bitcoin-sv/blob/879fc8b42168dd0e608dafd51b39c6dabad37d4d/src/script/interpreter.cpp#L2063-L2083)):

| #  | Field          | Size (bytes) | Notes                                                                  |
| -- | -------------- | ------------ | ---------------------------------------------------------------------- |
| 1  | `nVersion`     | 4            | Transaction version, little-endian.                                    |
| 2  | `hashPrevouts` | 32           | See midstates below.                                                   |
| 3  | `hashSequence` | 32           | See midstates below.                                                   |
| 4  | `outpoint`     | 36           | The `prevout` (txid 32 + index 4) of the input being signed.           |
| 5  | `scriptCode`   | var          | The script being executed for this input (CompactSize length + bytes). |
| 6  | `amount`       | 8            | Satoshi value of the output being spent, little-endian.                |
| 7  | `nSequence`    | 4            | `nSequence` of the input being signed, little-endian.                  |
| 8  | `hashOutputs`  | 32           | See midstates below.                                                   |
| 9  | `nLockTime`    | 4            | Transaction locktime, little-endian.                                   |
| 10 | `sighashType`  | 4            | The sighash type, as a 4-byte little-endian value.                     |

The three midstates depend on the flags ([`interpreter.cpp` L2043–L2061](https://github.com/bitcoin-sv/bitcoin-sv/blob/879fc8b42168dd0e608dafd51b39c6dabad37d4d/src/script/interpreter.cpp#L2043-L2061)):

* **`hashPrevouts`** = double-SHA-256 of every input's `outpoint` concatenated — **unless** `ANYONECANPAY` is set, in which case it is 32 zero bytes.
* **`hashSequence`** = double-SHA-256 of every input's `nSequence` concatenated — unless `ANYONECANPAY` is set, or the base type is `SINGLE` or `NONE`, in which case it is 32 zero bytes.
* **`hashOutputs`** = double-SHA-256 of every output serialized — unless the base type is `SINGLE` or `NONE`. For `SINGLE`, if an output exists at this input's index, `hashOutputs` is the double-SHA-256 of *that one output*; otherwise (and for `NONE`) it is 32 zero bytes.

## Original (legacy) digest

The Original Transaction Digest Algorithm (`SignatureHashOriginal`) is the pre-UAHF algorithm: it builds a modified copy of the transaction (clearing other inputs' scriptSigs, setting the signed input's scriptSig to `scriptCode`, and adjusting outputs/sequences according to the base type and `ANYONECANPAY`), appends the 4-byte sighash type, and double-SHA-256 hashes the result. Chronicle reinstates it as an opt-in via the `SIGHASH_CHRONICLE` bit; it is otherwise not used post-UAHF.

## Sighash-type validity gating

Under strict encoding, the sighash type is validated before the digest is computed ([`interpreter.cpp` L291–L307](https://github.com/bitcoin-sv/bitcoin-sv/blob/879fc8b42168dd0e608dafd51b39c6dabad37d4d/src/script/interpreter.cpp#L291-L307)):

| Error                          | Raised when                                                                                 |
| ------------------------------ | ------------------------------------------------------------------------------------------- |
| `SCRIPT_ERR_SIG_HASHTYPE`      | the sighash type is not a defined combination.                                              |
| `SCRIPT_ERR_ILLEGAL_FORKID`    | `SIGHASH_FORKID` is set but fork-id digests are not enabled in this context.                |
| `SCRIPT_ERR_MUST_USE_FORKID`   | fork-id digests are required (post-UAHF) but the signature does not set `SIGHASH_FORKID`.   |
| `SCRIPT_ERR_ILLEGAL_CHRONICLE` | `SIGHASH_CHRONICLE` is set but the Chronicle digest is not enabled (i.e. before Chronicle). |

See [Opcodes](/bitcoin-protocol-documentation/specification/opcodes.md) for `OP_CHECKSIG`/`OP_CHECKMULTISIG` and the Protocol Upgrade History page for the UAHF and Chronicle activation heights.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hub.bsvblockchain.org/bitcoin-protocol-documentation/specification/signature-hashing.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.