Bitcoin Script & UTXO Signature Verification

Bitcoin uses Unspent Transaction Outputs (UTXOs). Each UTXO is a coin with a locking script (scriptPubKey). To spend it, the spender provides an unlocking script (scriptSig) that satisfies the locking script. UTXOs are atomic — spent or unspent, never partial.

Bitcoin Script is a stack-based, non-Turing-complete language. Scripts execute by pushing data and running opcodes. No loops, no recursion — scripts always terminate. This intentional limitation prevents denial-of-service and makes script verification O(n) in script length.

Most common output type. scriptPubKey: OP_DUP OP_HASH160 OP_EQUALVERIFY OP_CHECKSIG. scriptSig: . Execution: push sig+pubkey, dup pubkey, hash160, compare to embedded hash, verify ECDSA sig. If all pass: coin is spendable.

Stack trace for P2PKH: push ; push ; OP_DUP → push copy; OP_HASH160 → hash160(top); push ; OP_EQUALVERIFY → pop two, fail if not equal; OP_CHECKSIG → pop sig+pubKey, verify ECDSA, push TRUE/FALSE. Script succeeds if TRUE.

Bitcoin uses ECDSA over secp256k1 (Koblitz curve, y^2 = x^3 + 7 mod p). Private key d ∈ [1, n-1]. Public key Q = d*G. Sign(m): k random; r = (k*G).x mod n; s = k^{-1}(H(m)+r*d) mod n. Signature = (r, s). DER-encoded in scriptSig.

Bitcoin signatures commit to specific parts of the transaction: SIGHASH_ALL (default): sign all inputs+outputs. SIGHASH_SINGLE: sign only the corresponding output. SIGHASH_NONE: sign no outputs (dangerous). SIGHASH_ANYONECANPAY: sign only own input — allows collaborative transactions.

P2SH allows complex spending conditions hidden behind a hash. scriptPubKey: OP_HASH160 OP_EQUAL. scriptSig: . Execution: evaluate that hash(redeemScript) == scriptHash, then execute redeemScript. Enables multisig without revealing conditions until spend time.

redeemScript: OP_2 OP_3 OP_CHECKMULTISIG. scriptSig: OP_0 . OP_0 works around a bug in OP_CHECKMULTISIG that pops one extra stack item. 2-of-3 multisig requires any 2 of 3 signatures.

Segregated Witness (SegWit, BIP-141) moves signatures out of scriptSig into a separate witness field. Fixes transaction malleability (ID changes if scriptSig changes). P2WPKH scriptPubKey: OP_0 <20-byte pubKeyHash>. Witness: [ ].

Taproot (BIP-340/341/342) uses Schnorr signatures and Merkleized Abstract Syntax Trees (MAST). Default spend: single Schnorr signature (indistinguishable from keypath spend). Complex conditions hidden in a Merkle tree, revealed only if used. Privacy + efficiency.

Bitcoin Core validates scripts in a stack interpreter. CheckSig calls VerifyScript which runs the combined scriptSig+scriptPubKey. For each CHECKSIG opcode, it calls CheckECDSASignature which verifies the DER-encoded (r,s) against the transaction hash using secp256k1.

What does OP_CHECKSIG verify in a P2PKH script?

UTXOs use stack-based Bitcoin Script. P2PKH: the most common spending pattern — hash-verify a public key then check ECDSA signature. SegWit fixes malleability; Taproot adds Schnorr and MAST. Next: differential cryptanalysis.