OP_CHECKSIG is an opcode that verifies an ECDSA signature. It takes two inputs from the stack, a public key (on top of the stack) and an ECDSA signature in its DER_CANONISED format concatenated with sighash flags. It outputs true or false on the stack based on whether the signature check passes or fails.


In addition to the stack parameters, OP_CHECKSIG needs to have

  1. the current transaction {\displaystyle TX_{current}},
  2. the index of the transaction input in which the signature is checked {\displaystyle i},
  3. the scriptPubKey in which this OP_CHECKSIG belongs {\displaystyle previousScriptPubKey}, and
  4. the value in satoshi that the outpoint represents {\displaystyle amount}.

Note that {\displaystyle previousScriptPubKey} is from previous transaction, in which the output is spent in current transaction.

How it works

In short, OP_CHECKSIG calls a function called “sighash” which produces a hash value of the serialised transaction. (For legacy sighash algorithm, please click here.) The hash value is the message on which the signature is verified. The signature and the public key involved in the verification are obtained from the stack.

In detail,

  1. Check the stack size is not less than 2.
  2. the public key and the signature are popped as the top 2 items of the stack.
  3. Check the signature encoding is of the correct format [<DER signature><hashtype>]. An example: 47304402205a2b556c71ee1c12d8e0b460c3446aeca0e3ee71b7bc11c6ddd3da8beeec99c60220783a1f0c0158674df8904022ec30fab5154c4fc4c7e8467086f0204cc8e16cbb01, where 47 indicates number of bytes in hex (71 in decimal) of the signature including 1 byte of sighash flag at the end, the next 46 bytes (70 in decimal) are the ECDSA signature (r,s), the last byte is the sighash flag “ALL”.
  4. Check the public key encoding is of the correct format. Both compressed public key and uncompressed public key can be acceptable. An example: 210220798b9772a8ae06d13027e6f501d09ea07f6dfc4b7afc3db3a6d6c57bf24239, where 21 indicates the number of bytes in hex of the public key, 02 indicates this is a compressed public and the y-coordinate is an even number, the rest is the value of the x-coordinate of the public key. Note that if the second byte is 04, then it indicates that the public key is given in its uncompressed form.
  5. A new subScript is created from the {\displaystyle previousScriptPubKey}. The subScript starts from the most recent OP_CODESEPARATOR (the one just before the OP_CHECKSIG that is executed here) to the end of the {\displaystyle previousScriptPubKey}. If there is no OP_CODESEPARATOR, the entire {\displaystyle previousScriptPubKey} becomes the subScript.
  6. Any remaining OP_CODESEPARATORS are removed from the subScript.
  7. A serialisation algorithm (sighash) is called to produce an input to double SHA256 depending on sighash type:
    1. nVersion in {\displaystyle TX_{current}} (4-byte little endian)
    2. double SHA256 of the serialisation of all input outpoints (32-byte hash)
      1. if ANYONECANPAY flag is set, then this should be a 32-byte zero.
    3. double SHA256 of the serialisation of nSequence of all inputs (32-byte hash)
      1. if ANYONECANPAY flag is set, then this should be a 32-byte zero.
    4. the outpoint being spent (32-byte for transaction ID + 4-byte little endian for index)
    5. length in bytes of the subScript (big endian)
    6. the subScript
    7. {\displaystyle amount} (8-byte little endian)
    8. nSequence of this outpoint (4-byte little endian)
    9. double SHA256 of the serialization of all output amount (8-byte little endian) with scriptPubKey (These are the outputs in {\displaystyle TX_{current}}.)
      1. If SINGLE flag is set and the input index is smaller than the number of outputs, then this should be the double SHA256 of the output with scriptPubKey of the same index as the input
      2. If NONE flag is set, then this should be a 32-byte zero.
    10. nLocktime of the transaction {\displaystyle TX_{current}} (4-byte little endian)
    11. sighash type of the signature (4-byte little endian)
  8. The serialisation in bytes from the step above will be fed to double SHA256 to produce the 32-byte message. This message is used to check the ECDSA signature, together with the public key and the signature obtained from the stack. Note that the secp256k1 elliptic curve is used for the verification with the given public key.

Return values

OP_CHECKSIG will push true to the stack if the check passed, false otherwise. OP_CHECKSIGVERIFY leaves nothing on the stack but will cause the script validation to fail immediately if the check does not pass.



See SIGHASH flags for more detail on the effect of combinations of flags.


This content is based on content sourced from https://en.bitcoin.it/wiki/OP_CHECKSIG under Creative Commons Attribution 3.0. Although it may have been extensively revised and updated we acknowledge the original authors.

« Back to Glossary Index

Written by Ramon Quesada

Passionate about Blockchain & Bitcoin technology since 2013, Co- Founder of https://avalbit.org, Team Manager in the CoinTelegraph Spain franchise (2016-2017 years) Co. Organizer of the Blockchain Boot camp Valencia 2018, Co. Organizer of the mini Hackathon BitcoinSV Barcelona, in August 2019, current coordinator of the BSV Valencia Meetup. https://telegra.ph/Ramon-Quesada---Links-01-10