Read a PSBT's signatures faithfully - #5
Merged
Conversation
kwsantiago
changed the title
This was referenced Sep 5, 2026
kwsantiago
changed the title
Taproot script path signatures were discarded at parse, so an input carrying only those looked exactly like an unsigned one, and they were lost on the way back out. They are kept as hex, so a combiner hands back what it was given. A partial signature is verified against the key that names it, matched by curve point, rather than against every key the caller holds: an 11 of 15 input costs 11 checks instead of 165. The named key still has to be one the caller vouches for and the signature still has to verify under it. getVerifiedPartialSignatures keeps those pairs, since a signature does not carry the key that made it and compares by hash type and by r and s alone. A public key in a PSBT is not validated at parse, so one that is not a point on the curve is refused rather than thrown past the caller.
kwsantiago
force-pushed
the
keep-tap-script-signatures
branch
from
September 6, 2026 00:50
eb526bc to
efa39ed
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A PSBT that carries taproot script path signatures and nothing else looked exactly like an unsigned one, because
PSBT_IN_TAP_SCRIPT_SIG(0x14) was discarded at parse, and those signatures were also lost on the way back out. They are kept as hex, so a combiner hands back what it was given.getVerifiedSignatureschecks a partial signature against the key that names it, matched by curve point, rather than against every key the caller holds: an 11 of 15 input costs 11 checks instead of 165. The guarantee is unchanged, because the named key still has to be one the caller vouches for and the signature still has to verify under it.getVerifiedPartialSignatureskeeps those pairs, since a signature does not carry the key that made it and compares by hash type and by r and s alone.A public key in a PSBT is not validated when it is parsed, so a key that is not a point on the curve is now refused rather than thrown past the caller: it left
verifySignaturesas anIllegalArgumentExceptionfrom a method declaringPSBTSignatureException, which the open path does not catch.Needed by privkeyio/shrike#28.