> For the complete documentation index, see [llms.txt](https://protocol.bsvblockchain.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://protocol.bsvblockchain.org/specification/signature-hashing.md).

# Signature Hashing

Sighash flags and the transaction signature-hash (digest) algorithms

When `OP_CHECKSIG` (or `OP_CHECKMULTISIG`) verifies a signature, it does not sign the whole transaction verbatim. It signs a **signature hash** (the *sighash* or *digest*): a 32-byte double-SHA-256 over a specific serialization of the spending transaction, determined by a one-byte **sighash type** appended to the signature. This page specifies the sighash type byte and the digest algorithms exactly, so a signer and a verifier compute the identical preimage.

**Ground truth.** Flag values derive from [`src/script/sighashtype.h`](https://github.com/bitcoin-sv/bitcoin-sv/blob/879fc8b42168dd0e608dafd51b39c6dabad37d4d/src/script/sighashtype.h); the digest algorithms and gating from `SignatureHash`, `SignatureHashBIP143`, and `SignatureHashOriginal` in [`src/script/interpreter.cpp`](https://github.com/bitcoin-sv/bitcoin-sv/blob/879fc8b42168dd0e608dafd51b39c6dabad37d4d/src/script/interpreter.cpp). Citations pin to release **v1.2.2** (commit `879fc8b`).

## The sighash type byte

The sighash type is the **last byte** of an ECDSA signature as it appears on the stack. It packs a base type (low bits) with independent modifier flags ([`sighashtype.h`](https://github.com/bitcoin-sv/bitcoin-sv/blob/879fc8b42168dd0e608dafd51b39c6dabad37d4d/src/script/sighashtype.h#L16-L21)):

| Flag                   | Value  | Meaning                                                                               |
| ---------------------- | ------ | ------------------------------------------------------------------------------------- |
| `SIGHASH_ALL`          | `0x01` | Sign all outputs (default base type).                                                 |
| `SIGHASH_NONE`         | `0x02` | Sign no outputs (they are not committed).                                             |
| `SIGHASH_SINGLE`       | `0x03` | Sign only the output at the same index as this input.                                 |
| `SIGHASH_CHRONICLE`    | `0x20` | Use the Original Transaction Digest Algorithm (OTDA) for this signature (Chronicle).  |
| `SIGHASH_FORKID`       | `0x40` | Use the BSV/BIP143-style digest with the fork id mixed in (mandatory since the UAHF). |
| `SIGHASH_ANYONECANPAY` | `0x80` | Sign only this input; other inputs are not committed.                                 |

The **base type** is the low 5 bits: `baseType = sigHash & 0x1F` (`BASE_SIGHASH_MASK`). The **fork value** is the high bytes: `forkValue = sigHash >> 8`. `SIGHASH_CHRONICLE`, `SIGHASH_FORKID`, and `SIGHASH_ANYONECANPAY` are independent bits combined with the base type — e.g. `SIGHASH_ALL | SIGHASH_FORKID = 0x41`.

## Digest algorithm selection

`SignatureHash` ([`interpreter.cpp` L2112](https://github.com/bitcoin-sv/bitcoin-sv/blob/879fc8b42168dd0e608dafd51b39c6dabad37d4d/src/script/interpreter.cpp#L2112)) picks the algorithm from the flags:

* If `SIGHASH_FORKID` is set (and fork id is enabled), it uses the **BIP143-style BSV digest** (`SignatureHashBIP143`). This has been the mandatory form since the UAHF replay-protection upgrade.
* From **Chronicle**, if `SIGHASH_CHRONICLE` (`0x20`) is set the signature instead uses the **Original (legacy) Transaction Digest Algorithm** (`SignatureHashOriginal`).
* The choice is **per signature**: within one transaction, signatures on different inputs — or multiple signatures on one input — may independently use BIP143 or OTDA. A signer who does nothing keeps the current BIP143 behaviour.

| Signature configuration          | `CHRONICLE` bit | Digest used           |
| -------------------------------- | --------------- | --------------------- |
| any signature                    | 0               | BIP143 (BSV)          |
| any signature                    | 1               | OTDA (original)       |
| several signatures across inputs | mixed           | each uses its own bit |

## BIP143-style BSV digest

`SignatureHashBIP143` builds a preimage and returns its double-SHA-256. The preimage fields, in exact order ([`interpreter.cpp` L2063–L2083](https://github.com/bitcoin-sv/bitcoin-sv/blob/879fc8b42168dd0e608dafd51b39c6dabad37d4d/src/script/interpreter.cpp#L2063-L2083)):

| #  | Field          | Size (bytes) | Notes                                                                  |
| -- | -------------- | ------------ | ---------------------------------------------------------------------- |
| 1  | `nVersion`     | 4            | Transaction version, little-endian.                                    |
| 2  | `hashPrevouts` | 32           | See midstates below.                                                   |
| 3  | `hashSequence` | 32           | See midstates below.                                                   |
| 4  | `outpoint`     | 36           | The `prevout` (txid 32 + index 4) of the input being signed.           |
| 5  | `scriptCode`   | var          | The script being executed for this input (CompactSize length + bytes). |
| 6  | `amount`       | 8            | Satoshi value of the output being spent, little-endian.                |
| 7  | `nSequence`    | 4            | `nSequence` of the input being signed, little-endian.                  |
| 8  | `hashOutputs`  | 32           | See midstates below.                                                   |
| 9  | `nLockTime`    | 4            | Transaction locktime, little-endian.                                   |
| 10 | `sighashType`  | 4            | The sighash type, as a 4-byte little-endian value.                     |

The three midstates depend on the flags ([`interpreter.cpp` L2043–L2061](https://github.com/bitcoin-sv/bitcoin-sv/blob/879fc8b42168dd0e608dafd51b39c6dabad37d4d/src/script/interpreter.cpp#L2043-L2061)):

* **`hashPrevouts`** = double-SHA-256 of every input's `outpoint` concatenated — **unless** `ANYONECANPAY` is set, in which case it is 32 zero bytes.
* **`hashSequence`** = double-SHA-256 of every input's `nSequence` concatenated — unless `ANYONECANPAY` is set, or the base type is `SINGLE` or `NONE`, in which case it is 32 zero bytes.
* **`hashOutputs`** = double-SHA-256 of every output serialized — unless the base type is `SINGLE` or `NONE`. For `SINGLE`, if an output exists at this input's index, `hashOutputs` is the double-SHA-256 of *that one output*; otherwise (and for `NONE`) it is 32 zero bytes.

## Original (legacy) digest

The Original Transaction Digest Algorithm (`SignatureHashOriginal`) is the pre-UAHF algorithm: it builds a modified copy of the transaction (clearing other inputs' scriptSigs, setting the signed input's scriptSig to `scriptCode`, and adjusting outputs/sequences according to the base type and `ANYONECANPAY`), appends the 4-byte sighash type, and double-SHA-256 hashes the result. Chronicle reinstates it as an opt-in via the `SIGHASH_CHRONICLE` bit; it is otherwise not used post-UAHF.

## Sighash-type validity gating

Under strict encoding, the sighash type is validated before the digest is computed ([`interpreter.cpp` L291–L307](https://github.com/bitcoin-sv/bitcoin-sv/blob/879fc8b42168dd0e608dafd51b39c6dabad37d4d/src/script/interpreter.cpp#L291-L307)):

| Error                          | Raised when                                                                                 |
| ------------------------------ | ------------------------------------------------------------------------------------------- |
| `SCRIPT_ERR_SIG_HASHTYPE`      | the sighash type is not a defined combination.                                              |
| `SCRIPT_ERR_ILLEGAL_FORKID`    | `SIGHASH_FORKID` is set but fork-id digests are not enabled in this context.                |
| `SCRIPT_ERR_MUST_USE_FORKID`   | fork-id digests are required (post-UAHF) but the signature does not set `SIGHASH_FORKID`.   |
| `SCRIPT_ERR_ILLEGAL_CHRONICLE` | `SIGHASH_CHRONICLE` is set but the Chronicle digest is not enabled (i.e. before Chronicle). |

See [Opcodes](/specification/opcodes.md) for `OP_CHECKSIG`/`OP_CHECKMULTISIG` and the Protocol Upgrade History page for the UAHF and Chronicle activation heights.