Digital signatures

A digital signature is a short pair of numbers that proves you hold a private key, without revealing that key. It is made from the private key and the details of one transaction. Anyone can check it with the public key, but nobody can forge it or reuse it for a different transaction.

Why does a spend need a signature?

To spend an output, you must unlock it. The lock on an output is tied to a public key, or to the address made from it, so you must show you hold the matching private key. The locks page explains this in more detail. An address is only a short encoding of a public key, so paying an address is the same as locking coins to that public key.

The simplest method would be to place the private key directly into the transaction. That is a poor idea. Anyone who reads the transaction could see the key, and then use it to spend every other output locked to the same address.

How is a signature made?

Signing takes two inputs. The first is your private key. The second is a fingerprint of the transaction data, which is a hash of the parts being signed. Because the fingerprint covers those specific parts, the signature is tied to one exact transaction.

Signing also needs a random number. It makes each signature unique, so the same key never produces the same signature twice. That random number must never repeat. If it did, the private key could be recovered from the two signatures.

The maths combines these inputs and produces a signature made of two numbers, called r and s. The signature goes into the input that it unlocks. For older address types, it sits in the unlocking script. For newer address types, it sits in the witness.

How is a signature checked?

Checking a signature uses only public data: the signature, the fingerprint and the public key. The checker uses them to work out a point on the curve. If the x value of that point matches r, the signature is valid. The check never needs the private key.

Most payments use a signature scheme called ECDSA. Taproot outputs use Schnorr signatures instead. The idea is the same, but the maths is different.

Why can't someone reuse a signature?

Every signature is tied to one transaction through its fingerprint. If someone places the signature into a different transaction, the fingerprint no longer matches. The signature fails, and nodes reject the transaction.

The same thing happens when someone edits a transaction after it has been signed. By default, a signature covers the whole transaction, so changing an amount or a payee also changes the fingerprint. The old signature no longer fits the data.

What does a signature prove?

When you sign, you prove that you control the public key that the output is locked to. You never reveal the private key, and the signature works for only one transaction. That combination is what makes Bitcoin's locks safe to use.

Next, SegWit explains a 2017 upgrade that moved signatures out of the transaction ID, and why that mattered.