ScriptSig

A ScriptSig is the unlocking code in a legacy transaction input. It holds the data that proves you may spend an earlier output: usually a signature and a public key, written as Script data pushes. The output it unlocks has a ScriptPubKey, the lock. The ScriptSig is the key, and the two must match for the output to be spent.

Segwit moved the unlocking data for newer locks out of the ScriptSig and into the witness. Today, the ScriptSig is used for legacy locks and for the outer layer of P2SH.

Which locks use a ScriptSig?

Legacy locking scripts are unlocked by the ScriptSig:

• P2PK, a lock to a public key, unlocked with one signature.
• P2PKH, a lock to a public key hash, unlocked with a signature and the public key.
• P2MS, a bare multisig lock, unlocked with the required number of signatures.
• P2SH, a lock to a hash of a script, unlocked with the script's inputs and then the script itself.

Newer locks, such as P2WPKH and P2WSH, are unlocked by the witness instead. A native segwit input that unlocks one of those leaves its ScriptSig empty, so the size field is 00.

What does a P2PKH ScriptSig look like?

A P2PKH ScriptSig has two pushes: the signature and the public key. Here is the ScriptSig from transaction 40e331b67c0fe7750bb3b1943b378bf702dce86124dc12fa5980f975db7ec930, input 0:

483045022100c233c3a8a510e03ad18b0a24694ef00c78101bfd5ac075b8c1037952ce26e91e02205aa5f8f88f29bb4ad5808ebc12abfd26bd791256f367b04c6d955f01f28a772401 2103f0609c81a45f8cab67fc2d050c21b1acd3d37c7acfd54041be6601ab4cef4f31

Read it in parts:

• 48 is a push of 72 bytes, then the signature itself. The last byte, 01, is the sighash type, which says the signature covers all outputs.
• 21 is a push of 33 bytes, the compressed public key 03f0609c…4cef4f31.

The total is 107 bytes, which is the 6b size that comes before it in the input. The lock on the output holds the hash of this public key. The script first checks that the key matches that hash. Then it checks that the signature is valid for the key. The signature page explains that second check.

What does a P2SH ScriptSig contain?

A P2SH ScriptSig holds more than one kind of data. Its last push is the full script, called the redeem script. Every push before it is the unlocking data that satisfies that script. The output holds only the hash of the redeem script, so the full script is revealed here, when the output is spent.

Many P2SH outputs wrap a multisig script, so the ScriptSig often starts with an OP_0. That is a known quirk of the original multisig opcode, which pops one extra item from the stack. It is harmless, and it is the reason multisig ScriptSigs start with a zero.

What goes in a coinbase ScriptSig?

The coinbase transaction, the first one in each block, does not spend an earlier output. Its ScriptSig is free data that the miner chooses. The only rule is a length of 2 to 100 bytes. Miners use it to place a message, to identify their pool, or to carry extra nonce data.

From block 227,931, BIP 34 requires the coinbase ScriptSig to begin with the block height. The genesis block's coinbase is the classic example of free data: its ScriptSig carries a newspaper headline from 3 January 2009. You can see the same kind of text in many later coinbases.

Why is it called a ScriptSig?

The name comes from the original code, where the variable was called scriptSig. The field was meant for the signature that unlocks an output, so the name stuck even though the field now holds other data too. Think of it as the unlocking code of the input.

The next page, Sequence, covers the last field of each input: the setting that controls finality, replace-by-fee and relative locktime.

Sources

• Bitcoin Core: script, for the opcodes and the push rules
• BIP 34: Block v2, height in coinbase