10 Segregated witness

Segregated Witness (segwit) is presented as a comprehensive, backward- and forward‑compatible upgrade that tackles several long‑standing issues in Bitcoin: transaction malleability, inefficient signature verification, wasted bandwidth for lightweight clients, and the difficulty of extending Script. The core idea is to separate signature data (the “witness”) from the base transaction so that transaction IDs no longer commit to signatures. This simple relocation unlocks a soft‑fork pathway to fix malleability, streamline verification, improve network efficiency, and create a clean versioning mechanism for future Script upgrades—while keeping legacy nodes operational.

In practice, segwit introduces outputs that carry a version byte and a “witness program,” enabling modern forms of payment such as p2wpkh and p2wsh and new Bech32 addresses. Signatures move from the legacy signature script into a witness attached to each input, and miners commit to all witnesses via a witness commitment placed in the coinbase transaction, using a wtxid-based merkle root. Upgraded nodes validate witnesses according to the indicated version and program, while old nodes still accept these transactions because they appear as anyone‑can‑spend (yet are economically enforced invalid without the correct witness). For broad wallet compatibility, segwit can be nested in p2sh, allowing legacy senders to pay segwit recipients seamlessly.

Segwit also modernizes performance and scaling. A new signature hashing method (BIP143) reuses an intermediate hash so verification grows roughly linearly with input count, and signatures now commit to the spent amounts, protecting offline and hardware wallets from fee‑mismatch attacks. On the block level, “weight” discounts witness bytes, effectively raising throughput as segwit usage increases and lifting the practical ceiling on signature operations by counting segwit checks more cheaply. Together with reduced bandwidth for SPV clients (who can omit witnesses) and a witness versioning scheme that enables robust future Script enhancements, segwit strengthens Bitcoin’s integrity, efficiency, and upgradability without breaking existing software.

1  You spend one of the outputs that the previous time locked transaction spends and create a new time locked transaction that you give to your daughter.

  . Inheritance fails because your daughter’s time locked transaction is forever invalid due to transaction malleability.

  Sign the first input. Prepare by copying the pubkey script to the signature script.

  Sign the second input.

  Total time for hashing during signature verification. Time roughly quadruples when number of inputs double.

  Without the signature scripts, a lightweight wallet will not be able to verify that a transaction is included in the block.

  Using  OP_CHECKLOCKTIMEVERIFY to lock an output until May 1.

  The txid is calculated from the whole transaction, including signature scripts.

  A segwit transaction contains no signature data. The signatures are attached instead. The txid does not commit to the signatures.

  Amy decodes the segwit address to get the witness version and the witness program.

  Amy sends 0.1 BTC to your segwit address. Pubkey script doesn’t contain any script operators, just data.

  You create and broadcast a payment to the popcorn machine owner.

  A full node verifies the witness of your transaction. The pattern 00 followed by exactly 20 bytes gets special treatment.

  An old node will just see two data items in the pubkey script and an empty signature script.

  Your segwit transaction gets included in a block. The block commits to the witnesses by putting the witness commitment into an output of the coinbase transaction.

  The coinbase transaction’s witness contains the witness reserved value and an OP_RETURN output contains the witness commitment.

  An old node verifies the block with your transaction. It will not verify the signatures or the witness commitment.

  John and Faiza spends an output from their multisig wallet.

  The witness script is hashed into a witness script hash

  The popcorn guy sends the money to the charity’s p2wsh address.

  The charity pays 0.07 BTC to the shelter’s address. The witness is the signatures followed by a data item that contains the actual witness script.

  Preparing to verify the p2wsh input

  Verifying the witness of a p2wsh payment.

  Hashing is done in two steps. The intermediate hash is reused for each input.

  An off-line wallet cannot know the fee of a transaction.

  Nina sends 0.1 BTC to your segwit wallet using a p2wpkh inside a p2sh address.

  You spend the money you got from Nina by setting the version byte and witness program in the redeem script in your signature script of your input.

p2pkh. Address format 1<some base58 characters>`

p2sh. Address format 3<some base58 characters>`

p2wpkh. Address format bc1q<38 base32 characters>`

p2wsh. Address format bc1q<58 base32 characters>`

p2wpkh nested in p2sh. Address format 3<some base58 characters>`

p2wsh nested in p2sh. Address format 3<some base58 characters>`

  . Witness bytes and non-witness bytes are counted differently. Witness bytes contribute less to the block weight and not at all to the traditional block size, the base block size.

 Signatures are not part of the transaction id, because they are moved out from the base transaction.

  The old style signature hashing algorithm will hash the whole transaction for each signature

  With segwit, the whole transaction is only hashed once, and that hash is reused for each signature.

• Segwit moves signature script data out of transactions to solve transaction malleability issues.
• A new signature hashing algorithm is used by segwit that makes transaction verification faster. Helps nodes staying up to date with less resources.
• Lightweight wallets get better privacy with preserved data traffic by not downloading witness data.
• The witness version byte of the pubkey script makes upgrading the script language easier.
• The block size can be somewhat increased by counting witness bytes with a discount.
• A new address format is introduced to help wallets distinguish between legacy payments and segwit payments.
• Segwit can be "embedded" in old style p2sh addresses to allow old wallets to send money to segwit wallets.

FAQ