CRYPTO DEEP TECH

 

In this article, we will look at the cryptographic attack of digital signature forgery (Digital Signature Forgery Attack), its consequences pose a threat to the security of transactions in the Bitcoin network, since digital signatures confirm the ownership and authorization of cryptocurrency transfers. We will consider examples of the impact of such attacks on Bitcoin based on modern research and identified vulnerabilities.

A Digital Signature Forgery Attack is an attempt by an attacker to create a fake ECDSA digital signature that will be recognized as valid by the Bitcoin network. This attack allows transactions to be authorized without knowing the owner’s private key, which puts the security of funds in the BTC coin holder’s crypto wallet at risk.

In cryptography, a digital signature provides confirmation of the authenticity of a message or transaction. Signature forgery means that it is possible to create a “RawTX” pair that will be accepted by the system as valid, although in fact it was not created by the owner of the private key. This opens the way for fraud, theft of funds and violation of the integrity of the blockchain. Digital Signature Forgery Attack (DSFA) as a cryptographic attack is implemented in software components that use the xml-crypto library to verify signatures of XML documents on the Node.js platform.

---

 

 

 

---

First of all, this concerns enterprise integration solutions, cloud services and single sign-on systems, such as IBM App Connect Enterprise Certified Container and other applications that depend on xml-crypto for SAML authentication and authorization. Hardware vulnerabilities are not associated with specific physical devices, but are implemented in software products using the vulnerable library.

The vulnerabilities CVE-2025-29774 and CVE-2025-29775, known as the Digital Signature Forgery Attack, are implemented in the  xml-crypto software library  , a library for digitally signing and encrypting XML documents on the Node.js platform.

---

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to bypass signature validation in XML data [CVE-2025-29774] [CVE-2025-29775]

• IBM App Connect Enterprise Certified Container  is a data integration and processing software that uses xml-crypto to verify XML document signatures. The vulnerabilities allow digital signature verification to be bypassed, which leads to the possibility of forging and modifying signed messages, including SAML responses for authentication and authorization.
• Systems and applications that use Node.js with the xml-crypto library  to verify signed XML messages, especially in the context of SAML authentication (e.g., enterprise portals, single sign-on systems, cloud services). The vulnerability allows an attacker to modify valid signed XML messages so that they pass signature verification, leading to authentication and authorization bypass, privilege escalation, and credential spoofing.

---

Disclosure for CVE-2025-29774 and CVE-2025-29775 (SAMLStorm).

• The vulnerabilities are related to improper cryptographic signature verification in xml-crypto , specifically the handling of the DigestValue node, where an attacker can insert XML comments without breaking signature verification.
• This allows critical identification and access control attributes in signed XML documents to be modified, resulting in the ability to bypass security without requiring credentials or access rights.

---

Thus, this code implements cryptographic signature and signature verification algorithms for various schemes (RSA with different SHA hashes and HMAC-SHA1), which allows them to be integrated into systems that require digital signature of data.

---

Critical vulnerability in signature-algorithms.ts code

The signature-algorithms.ts code is used to securely create and verify digital signatures, ensuring authenticity and integrity of data. ECDSA signatures provide authorship verification using a private key, and HMAC – integrity and authenticity verification using a secret key. The algorithms used comply with XML Digital Signature standards (the URIs of the algorithms point to W3C specifications).

---

Thus, the signature-algorithms.ts code implements cryptographic signature and signature verification algorithms for various schemes (ECDSA, RSA with different SHA hashes and HMAC-SHA1), which allows them to be integrated into systems that require digital data signature.

---

Basic functionality

• Each class implements an interface  SignatureAlgorithm and provides methods for:
  • Create Signature  ( getSignature): takes signature data and a private key, returns a digital signature in base64 format.
  • Signature checks  ( verifySignature): takes the input, public key and signature, returns a boolean value indicating whether the signature is correct.
  • GetAlgorithmName  ( getAlgorithmName): Returns a URI identifying the signature algorithm used.

---

Supported algorithms

• RsaSha1  – signature using RSA and the SHA-1 hash function.
• RsaSha256  – signature using RSA and SHA-256.
• RsaSha512  – signature using RSA and SHA-512.
• HmacSha1  – signature using HMAC based on SHA-1.

---

Technical details

• For RSA signatures, the class  crypto.createSign and  crypto.createVerify with the corresponding algorithms are used (“RSA-SHA1”, “RSA-SHA256”, “RSA-SHA512”).
• For HMAC signatures, it is used  crypto.createHmac with the “SHA1” algorithm.
• Signatures are encoded in base64 for ease of transmission and storage.
• The methods are wrapped in a function  createOptionalCallbackFunction, which probably allows them to be used with both callbacks and promises (details not in the code).

---

The use of the RSA-SHA1 algorithm in cryptographic signatures contains a vulnerability related to SHA-1 hash collisions. This allows an attacker to create two different messages with the same signature if he controls part of the data being signed.

---

Specifically, the problem is in the class RsaSha1:

const signer = crypto.createSign("RSA-SHA1");  // Vulnerable line

---

signature-algorithms.ts#L7

Also the second vulnerability is in the class RsaSha1:

const verifier = crypto.createVerify("RSA-SHA1");  // Vulnerable line

---

signature-algorithms.ts#L17

Why does this critical collision attack allow creating different data with the same hash?

1. SHA-1 Collisions : The SHA-1 algorithm is no longer considered secure.
2. RSA Context : When combined with RSA, this can lead to forged signatures on untrusted data (e.g. certificates or documents).
3. Recommendations : NIST and the security community recommend using SHA-256/SHA-512 over SHA-1.

---

Additional notes:

• The (HMAC-SHA1) class HmacSha1is less vulnerable, but also obsolete. HMAC is more collision-resistant than “naked” SHA-1, but switching to SHA-256 is preferable.
• The code contains modern implementations (RsaSha256/RsaSha512) that should be used instead of RsaSha1.

---

CVE-2025-29774 and CVE-2025-29775 are critical vulnerabilities in the xml-crypto library for Node.js related to improper verification of digital signatures in XML documents. Both vulnerabilities allow an attacker to modify signed XML messages in a way that goes unnoticed by signature verification.

---

Digital Signature Forgery Attack Mechanism

1. Vulnerabilities in RSA-SHA1 algorithms

In the provided code, the classes RsaSha1 use the legacy RSA-SHA1 algorithm for signing and verification:

const signer = crypto.createSign("RSA-SHA1");  // Vulnerable line №7
const verifier = crypto.createVerify("RSA-SHA1");  // Vulnerable line №17

SHA1 is considered cryptographically insecure, the main problem lies in the logic of the library’s processing of XML structures :

• When creating a signature, the XML document goes through a canonicalization step (bringing it to a standard form, for example, removing spaces and comments).
• When verifying a signature, the library does not take into account the difference between canonicalized and non-canonicalized versions of a document . This allows an attacker to modify the document (e.g. add comments or change the structure) without breaking the signature.

---

2. Example of operation

1. SignedInfo modification :
   • The attacker adds additional nodes <SignedInfo>  to the XML document , which results in an incorrect hash calculation during verification.
   xml<Signature> <SignedInfo>...</SignedInfo> <!-- Original knot --> <SignedInfo>...</SignedInfo> <!-- Added by an attacker --> </Signature>
2. Using a weak algorithm :
   • The SHA1 algorithm is vulnerable to collisions, making it easy to create fake signatures for modified documents.

---

3. Consequences

• Bypass authentication : Modifying attributes in SAML tokens or other access-related XML documents.
• Privilege Escalation : Substituting a user ID for an administrator in the authorization system.
• Mass Attacks : The vulnerability can be exploited remotely without user interaction (CVSS 9.3).

---

Technical details of the vulnerabilities:

CVE-2025-29774

• Problem : Insufficient validation of XML document structure during signature verification.
• Exploitation : Adding extra nodes or attributes to the signed part of the document.

---

CVE-2025-29775

• Issue : Incorrect use of canonicalization context when computing a hash.
• Exploitation : Modification of a document in non-canonicalized form after signing.

---

Recommendations for troubleshooting

1. Library update :
   • For versions 2.x → 2.1.6, 3.x → 3.2.1, 6.x → 6.0.1.
2. Algorithm Replacement : typescript // Usage SHA-256 / SHA-1 const signer = crypto.createSign("RSA-SHA256");
3. Validating XML structure :
   • Check if there is exactly one node <SignedInfo> in the signature.

Addressing these vulnerabilities is critical for systems that use XML signatures for authentication (e.g. SAML, SOAP).

---

The xml-crypto library is widely used to verify digital signatures in XML messages, including protocols such as SAML, SOAP, and others. It follows that the vulnerability potentially affects:

• Software and services that use xml-crypto for XML signatures , including enterprise integration platforms and middleware (such as IBM App Connect Enterprise, where these vulnerabilities were reported).
• Devices and systems that use XML signatures for authentication and authorization, including servers and gateways that support SAML.

---

• Vulnerabilities CVE-2025-29774 and CVE-2025-29775 primarily affect software components and platforms that use the xml-crypto library to process XML signatures.
• Known victims include IBM App Connect Enterprise and likely other Node.js-based enterprise solutions using xml-crypto .
• There is currently no public data on specific brands of hardware devices affected by these attacks.

---

To assess the risk on specific devices, it is recommended to check whether they use vulnerable versions of xml-crypto or depend on similar XML signature mechanisms. For working with cryptocurrency wallets based on Node.js, IBM offers separate solutions, such as  IBM Secure Bitcoin Wallet  , an application based on Electrum Bitcoin Client that uses Node.js to interact with the Bitcoin network and manage the wallet.

In this solution, private keys and wallet can be stored and encrypted using IBM Cloud Hyper Protect Crypto Services (zHSM), which provides hardware-based secure storage of keys. Generation of private keys for Bitcoin wallets is usually implemented in specialized cryptographic libraries such as Electrum, bitcoinjs-lib, etc., which can be integrated into Node.js applications. IBM Secure Bitcoin Wallet uses a modified Electrum backend on Node.js for key and transaction management, through integration with IBM Cloud Hyper Protect Crypto Services, which provides hardware encryption and secure storage of private keys.

---

Practical part

From the theory of vulnerability  CVE-2025-29775  it is known that an attacker can process an unupdated xml-crypto library for incorrect transaction values. Let’s move on to the practical part of the article and consider an example using a Bitcoin wallet:  32GkPB9XjMAELR4Q2Hr31Jdz2tntY18zCe , where there were lost coins in the amount of:  0.059672 BTC  as of July 2025 this amount is:  7, 052 USD

---

791fe035d312dcf9196b48649a5c9a027198f623c0a5f5bd4cc311b8864dd0cf

Let’s consider the format: Raw transaction binary and hex data that contain all the information about the transaction . It is needed to transmit, verify or create transactions at a low level and is the basis for the operation of the entire Bitcoin network. Regular users rarely encounter Raw transactions directly, but for developers and crypto enthusiasts, this is the main tool for full control over all transactions of the Bitcoin network.

---

Raw Transaction

To fully return UTXO objects in the Bitcoin network, we will use the Dark AI tool . UTXO is the main part of the data structure in the blockchain and represents the amount of BTC coins of the cryptocurrency that can be spent by the holder of the private key (controlling this Bitcoin address). Each UTXO is the output of a specific past transaction, which has never been used as an input in subsequent transactions.

Google Colab

https://colab.research.google.com/drive/1TKrJ0bKsNgc72H9UvzpCnh2YPmRsyPdW

---

1. Download and install the Dark AI tool

Detailed description of all terminal commands and actions

Teams:

!wget https://darkai.ru/repositories/neuralnet_tools.zip

• wget— a command line utility for downloading files from the network via HTTP, HTTPS and FTP protocols.
• We download  the archive by specifying the URL .neuralnet_tools.zip
• unzip— command to extract ZIP archives in the current directory.

This command extracts all files from neuralnet_tools.zip

!unzip neuralnet_tools.zip

---

Let’s run the command ls for quick and easy viewing

ls

---

2. Launch the Dark AI tool

!./darkai

Let’s run the command to get information about the so-called unspent transaction outputs ( UTXO , decoding: Unspent Transaction Output ) for the specified Bitcoin address. This information is important for assessing the balance of the address and the possibility of conducting new transactions.

!./darkai -bitcoinaddress 32GkPB9XjMAELR4Q2Hr31Jdz2tntY18zCe

---

As a result, two UTXO objects were returned:

[
  {'output': '8602122a7044b8795b5829b6b48fb1960a124f42ab1c003e769bbaad31cb2afd:0', 'value': 677200},
  {'output': 'bd992789fd8cff1a2e515ce2c3473f510df933e1f44b3da6a8737630b82d0786:0', 'value': 5000000}
]

---

Each UTXO contains:

• output — output identifier. Format: <txid>:<n>, where <txid>is a unique transaction hash, and <n> is the output number in the list of outputs for this transaction.
• value — amount in satoshis (1 bitcoin = 100,000,000 satoshis).

---

Data decoding:

1. First UTXO
   • Exit: 8602122a7044b8795b5829b6b48fb1960a124f42ab1c003e769bbaad31cb2afd:0
   • Amount: 677,200 satoshis
2. Second UTXO
   • Exit: bd992789fd8cff1a2e515ce2c3473f510df933e1f44b3da6a8737630b82d0786:0
   • Amount: 5,000,000 satoshis

---

Overall balance

The total available balance of an address is equal to the sum of all found UTXOs:

• 677 200 + 5 000 000 = 5 677 200 satoshis
• In terms of bitcoins: 5,677,200/100,000,000 = 0.05677200 BTC

Technical Interpretation with Dark AI

We use the interpretation process to process the unupdated xml-crypto library to create invalid transaction values and send a large amount, the Dark AI algorithm will choose which UTXO to use (or combine both).

• Sending funds: All specified UTXOs can be used as inputs when forming a new transaction, which will allow you to spend all or part of your balance.
• Transparency: This report confirms that the address contains real Bitcoin funds and can be used to verify authenticity and solvency.

The Bitcoin address 32GkPB9XjMAELR4Q2Hr31Jdz2tntY18zCehas two active UTXOs totaling 0.05677200 BTC . These funds can be used to make new transactions; both outputs are considered confirmed and unspent.

---

Deserialization of Bitcoin transaction

To get fragments of information about the output of a Bitcoin transaction, use the following commands, where the first output ( outs) from the transaction has a unique identifier8602122a7044b8795b5829b6b48fb1960a124f42ab1c003e769bbaad31cb2afd

---

!./darkai -deserialize 8602122a7044b8795b5829b6b48fb1960a124f42ab1c003e769bbaad31cb2afd

---

We get the structure of the response of the deserialization result:

{'value': 677200, 'script': 'a91406612b7cb2027e80ec340f9e02ffe4a9a59ba76287'}

• value: 677200 — the amount of this output is expressed in satoshi (1 BTC = 100,000,000 satoshi).
• script: a91406612b7cb2027e80ec340f9e02ffe4a9a59ba76287 — a script that defines the conditions for spending this output.

---

Detailed explanation of elements: Value field

• Value: 677,200 satoshi.
• This amount can be spent when creating the corresponding transaction if the conditions of the script are met.
• Equivalent: 677,200/100,000,000 = 0.00677200 BTC.

Detailed explanation of elements: Script field

• Script meaning: a91406612b7cb2027e80ec340f9e02ffe4a9a59ba76287
• This is a script of type “scriptPubKey” – part of the transaction output structure that specifies who can spend these funds. The most important purpose is to ensure security and control over the disposal of funds.

---

Decoding the script

• The script starts with a prefix a914...87, which corresponds to the P2SH (Pay to Script Hash) format :
  • a9— OP_HASH160 (hash operator)
  • 14— length of the next value (20 bytes = 40 hex characters)
  • 06612b7cb2027e80ec340f9e02ffe4a9a59ba762— hash160 Bitcoin itself Wallet addresses where BTC coins are stored.
  • 87— OP_EQUAL (a basic Bitcoin Script command operator that implements a comparison of two pieces of data to verify their identity)
• This means that the recipient can spend the funds if they provide a script whose hash matches the value provided and provide valid signatures for that script.

---

Practical significance of the result

• This output of the specified transaction contains 677,200 satoshi (0.00677200 BTC), which is protected by a P2SH type script.
• To spend funds from such an output, you will need to know the original script and present the correct signatures – a typical situation for multi-signature wallets, smart contracts and other advanced security schemes.
• This information is important for analyzing the structure of the transaction, verifying the purpose of the funds, and understanding the requirements for their subsequent use.

---

Deserialize a transaction by identifier

As a result of deserialization of the transaction by identifier, 8602122a7044b8795b5829b6b48fb1960a124f42ab1c003e769bbaad31cb2afdthe first output was obtained, containing the amount of 677,200 satoshi (0.00677200 BTC), protected by a P2SH script . To manage these funds, it will be necessary to present the destination script and correctly sign the unlocking transaction that meets the conditions of the specified hash.

---

Deserialization of the second Bitcoin transaction

To get fragments of information about the output of the original data ( output) of a Bitcoin transaction, apply the following commands, where the first output ( outs) from the transaction with a unique identifier bd992789fd8cff1a2e515ce2c3473f510df933e1f44b3da6a8737630b82d0786

!./darkai -deserialize bd992789fd8cff1a2e515ce2c3473f510df933e1f44b3da6a8737630b82d0786

---

Using the interpretation process, with the help of Dark AI using the deserialization function, we then obtain information about the structure of the first output element ( output) for the second transaction with the identifier
bd992789fd8cff1a2e515ce2c3473f510df933e1f44b3da6a8737630b82d0786.

---

Result:

{'value': 5000000, 'script': 'a91406612b7cb2027e80ec340f9e02ffe4a9a59ba76287'}

---

1. Detailed explanation of elements:  Value field

• Content: 5000000
• This value is expressed in satoshi , the smallest indivisible unit of bitcoin; 1 BTC = 100,000,000 satoshi.
• Purpose:
  This amount is associated with a specific transaction output specified in the array elements 'outs'. It can only be spent if the conditions written in the script defined in the field are met 'script'.
• Bitcoin conversion: 5,000,000 satoshi = 0.05 BTC

2. Detailed explanation of elements:  Script field

• Content: 'a91406612b7cb2027e80ec340f9e02ffe4a9a59ba76287'
• This is the so-called locking script or, otherwise, scriptPubKey – a script that specifies the conditions under which this output can be spent.

---

Decoding the script

The specified value corresponds to the standard script type in the Bitcoin network:

• a9— operation code OP_HASH160 (produces RIPEMD-160 from SHA-256 from the next line).
• 14— length of the subsequent field: 20 bytes (40 hexadecimal characters).
• 06612b7cb2027e80ec340f9e02ffe4a9a59ba762— is a 20-byte hash that identifies either a Bitcoin wallet address or a script.
• 87— operation code OP_EQUAL.

Taken together, this entry means a P2SH address (Pay-to-Script-Hash). In this case, funds are assigned to a certain script combination, and to withdraw them, you will need to reveal the script whose hash is recorded here and present signatures (or other data) that satisfy the conditions of this script.

---

The most common uses of this scheme are for multi-signatures, simple and complex smart contracts, bilateral multi-signatures, conditional security schemes, and other advanced scenarios.

---

3. The practical meaning of the result, the size and purpose of the funds.

1. The transaction in question (with hash bd992789fd8cff1a2e515ce2c3473f510df933e1f44b3da6a8737630b82d0786 ) has an output in which 0.05 BTC (5,000,000 satoshis) are “locked” in the P2SH address corresponding to the hash06612b7cb2027e80ec340f9e02ffe4a9a59ba762
2. Conditions for spending:
   To spend these funds, when forming a spending transaction, it is necessary to present not only a standard signature, as with a direct transfer, but also the script itself, the hash of which is embedded in this output, plus data (for example, a set of digital signatures) that correspond to the conditions of the script.
3. Security and flexibility:
   This method allows for more complex logic to be implemented than sending directly to a regular Bitcoin address.

---

4. Registration of the exit to the level of compatibility with various services and wallets that support P2SH.

• Transaction ID
  bd992789fd8cff1a2e515ce2c3473f510df933e1f44b3da6a8737630b82d0786
  contains an output in which
  0.05 BTC (5,000,000 satoshi)
  is secured to a P2SH script (Pay-to-Script-Hash) with a hash of
  06612b7cb2027e80ec340f9e02ffe4a9a59ba762 .
• To spend these funds, you must reveal the original script and fulfill its conditions (for example, present all signatures in a multi-signature).

---

Thus, the deserialization result reports the presence of a certain amount of bitcoins at a conditional (P2SH) address and defines strict rules for their spending, which plays a key role in the management and accounting of funds in the Bitcoin network.

---

P2SH (Pay-to-Script-Hash) locking script in Bitcoin network. What does this script mean?

The script 'a91406612b7cb2027e80ec340f9e02ffe4a9a59ba76287'is chosen and used in this transaction output because it represents a typical P2SH (Pay-to-Script-Hash) locking script in the Bitcoin network.

---

Let’s look at it piece by piece:

• a9— OP_HASH160: A hashing operation that first applies SHA-256 and then RIPEMD-160 to subsequent data.
• 14— hash length is 20 bytes (in hexadecimal format).
• 06612b7cb2027e80ec340f9e02ffe4a9a59ba762— a 20-byte hash of the script, known as the script hash .
• 87— OP_EQUAL: An operator that checks the equality of two values on the stack.

Thus, this script requires that at the time of use (spending funds) a script whose hash matches is presented 06612b7cb2027e80ec340f9e02ffe4a9a59ba762, and that the conditions of this script are met.

---

Why was this particular one chosen?

• Convenience and security: P2SH allows complex funds management logic (such as multi-signatures or conditional payments) to be hidden in a hash, simplifying the interface for the sender and receiver.
• Industry standard: P2SH has become a widely accepted standard because it simplifies the setup of complex security schemes and is compatible with most wallets and services.
• Compactness: The block stores only the hash of a complex script, not the entire script – this saves space and increases efficiency.
• Flexibility: The owner of the funds can create arbitrary conditions for spending – such as requiring multiple signatures, time delays, or other rules – and the hash of these conditions is stored here.

---

The script 'a91406612b7cb2027e80ec340f9e02ffe4a9a59ba76287'is a P2SH locking script, which says that in order to spend 0.05 BTC, you need to provide the original script with the hash 06612b7cb2027e80ec340f9e02ffe4a9a59ba762 and fulfill the conditions specified in it. This provides a balance between convenience, security and functionality – the main reason for choosing this particular script in this transaction. The hash 06612b7cb2027e80ec340f9e02ffe4a9a59ba762 in the P2SH script is the result of a specific hashing of the original script (redeem script) , which determines the conditions for spending funds from this output.

---

Why this hash and not another?

1. A hash is a digital fingerprint of a script that specifies the rules for spending.
   When creating a P2SH address or output, the script (the conditions for spending Bitcoin) is first written explicitly, then two hashing algorithms are applied:
   • SHA-256 from the script,
   • Then RIPEMD-160 the SHA-256 result.
     The resulting 20-byte hash is 06612b7cb2027e80ec340f9e02ffe4a9a59ba762. This hash uniquely identifies the exact scenario for which it was generated.
2. Uniqueness and Immutability
   Cryptographic hash functions have an “avalanche effect” property, whereby even a minimal change to the original script will produce a completely different hash. Therefore, this hash is unique and unforgeable in the context of the original script.
3. The purpose of using a hash is to ensure compactness and security.
   Instead of storing the full script in each output, which can be complex and take up a lot of space, only its hash is stored in the block. This saves space and increases privacy – the script itself is revealed only when funds are spent and only to those who fulfill the conditions.
4. The hash selection is the result of a specific script defined by the creator of the address or wallet.
   The developer or owner of the funds creates a script with the desired conditions (e.g. multi-signature, time delay, other logical conditions). The assigned script is hashed and this hash is tied to the transaction output. Thus, there is no arbitrary hash selection – it is determined by the content of the original script and the cryptographic algorithm.

---

• This hash is strictly linked to a specific script that the address owner has installed to protect their funds.
• It was generated using cryptographic hash functions ( SHA-256 + RIPEMD-160)from the original redeem script, so it is not possible to randomly or arbitrarily select a different hash.
• This hash is a reflection of the unique combination of spending conditions, and that is why it ended up in the transaction output script.a91406612b7cb2027e80ec340f9e02ffe4a9a59ba76287

---

Thus, the choice of this particular hash is dictated by the need for an accurate and secure linking of the output with specific spending conditions that control access to funds in the blockchain. All this is ensured by the properties of cryptographic hash functions, their uniqueness, and the impossibility of reverse recovery of the original data.

---

P2SH Mechanism: Meaning, Working Principle and Security in Bitcoin Network

Bitcoin developers have written the P2SH (Pay-to-Script-Hash) mechanism into the code as a key innovation that ensures security and expands the capabilities of the blockchain network. Let’s consider the structure and operating principle of this script, its difference from classic transactions, as well as the reasons for choosing this approach to storing and protecting digital assets.

Traditionally, Bitcoin transactions have worked using the Pay-to-Pubkey-Hash (P2PKH) scheme – where funds are “locked” using the recipient’s public key hash. To spend these funds, the user must provide their digital signature and public key, which are verified by the network.

However, beyond P2PKH, the interface was limited, as Bitcoin Script allows for much more complex spending conditions, from multi-signatures to time locks and other smart contract agreements. The problem was that long and complex scripts inevitably increased the size of transactions and reduced their usability.

---

It was to simplify interaction with such complex scenarios that the P2SH concept was introduced in 2012 , standardized in BIP 16 by Gavin Andresen. The essence of P2SH comes down to replacing the full script of spending conditions in scriptPubKey with its cryptographic hash – the so-called script hash.

---

 

 

---

How does the P2SH output script structure work?

Let’s look at the script specified as a result of deserialization:

OP_HASH160 06612b7cb2027e80ec340f9e02ffe4a9a59ba762 OP_EQUAL

This script differs from the standard P2PKH in that instead of a public key hash, it stores a hash of a redeemScript – a set of conditions under which funds can be spent.

• OP_HASH160 – hashes the data (in this case redeemScript) first with the SHA-256 algorithm, and then with RIPEMD-160.
• 06612b7cb2027e80ec340f9e02ffe4a9a59ba762 — 20-byte hash redeemScript.
• OP_EQUAL – checks if the provided redeemScript is equal to this hash.

---

The process of spending funds via a P2SH output

To spend such funds, it is necessary to transmit in the inputs (scriptSig) of the transaction referring to this output:

1. Serialized redeemScript – the original script whose conditions are encoded in a hash.
2. Unlock data – signatures or other evidence that meet the conditions of the redeemScript.

When processing a transaction, network nodes:

• Hash the redeemScript and compare it with the hash specified in output.
• If the hashes match (i.e. OP_EQUAL returns true), then redeemScript is deserialized and executed.
• A transaction is considered valid if the redeemScript is executed correctly, i.e. all spending conditions are met.

P2SH thus shifts the responsibility for presenting and verifying the terms of the spend from the sender (who creates the required script) to the spender.

---

The advantages and importance of choosing such a mechanism

1. Flexibility and complex scenarios

P2SH allows you to create addresses with arbitrary, often multi-level conditions – for example, a multi-signature requirement (2 out of 3, 3 out of 5, etc.), time limits, distribution logic, and much more. In this case, the sender simply sends funds to a compact hash address, without going into technical details.

---

2. Saving space

Instead of storing the full script in the blockchain, only its hash is stored in the transaction. This reduces the load on the network, reduces the size of blocks and speeds up the verification of transactions.

---

3. Increased security

Since the redeemScript is only revealed and verified at the time of spending, it increases the confidentiality of the terms and makes unauthorized access attempts more difficult. The use of cryptographic hash functions guarantees protection against forgery and modification – any slight deviation in the script will result in a different hash and the network will refuse to accept the transaction.

---

4. Convenience for users and programmers

P2SH standardizes and simplifies the use of complex smart contracts in Bitcoin, simplifying integration and increasing compatibility with a variety of wallets and services.

---

Example of use: multi-signature wallets

A classic example is a wallet that requires signatures from two of five participants to complete a transaction. With P2SH:

• The output contains the hash of the corresponding script.
• To spend funds, you need to pass the full multi-signature enable script in scriptSig with signatures.
• The network checks the consistency of hashes and the validity of signatures.

This makes P2SH ideal for corporate accounts, joint ventures, and other situations where access control is required. The Pay-to-Script-Hash (P2SH) mechanism is a fundamental part of the Bitcoin architecture, providing a balance between:

• Security (protecting funds through strict conditions and cryptography),
• Efficiency (storing only the hash, not all the details),
• Flexibility (support for any, even complex, spending conditions),
• Convenience (simple address format and access standard).

---

 

 

---

Cryptanalysis of the extraction of the first transaction input ( ins)

Let’s run a command to obtain information about one of the inputs of a transaction with a hash 6102bfd4bad33443bcb99765c0751b6b8e4e65f4db4e3b65324c5e9e3dac8132. Analysis of such an input is important for understanding the mechanism of authorization of spending funds at the script level.

!./darkai -scriptsig 6102bfd4bad33443bcb99765c0751b6b8e4e65f4db4e3b65324c5e9e3dac8132

---

The result of extracting the first input of the transaction ( ins) is presented as follows:

{
  'script': '00483045022100e5d7c59ea1fb5d0285e755dfc09634e1e3af36d12950b9b5d5f92b136021b3d202202c181129443b08dcfb8d9ced30187186c57c96f9cdb3f3914e0798682ea35d2b03493046022100e1f8dbad16926cfa3bf61b66e23b3846323dcabf6c75748bcfad762fc50bfaf402210081d955160b5f8d2b9d09d8838a2cf61f5055009d9031e0e106e19ebab234d949034c695221023927b5cd7facefa7b85d02f73d1e1632b3aaf8dd15d4f9f359e37e39f05611962103d2c0e82979b8aba4591fe39cffbf255b3b9c67b3d24f94de79c5013420c67b802103ec010970aae2e3d75eef0b44eaa31d7a0d13392513cd0614ff1c136b3b1020df53ae',
  'outpoint': {
    'index': 1,
    'hash': 'ec2a40cac3ac5dadf1d31f3cad03bdc8465caab5acbc5407ee7f4a7400aab577'
  },
  'sequence': 4294967295
}

---

1. Detailed analysis of ScriptSig components ( script)

• The value of the field scriptis the scriptSig , which is used to unlock the corresponding previous transaction output.
• The content is a long sequence of bytes in hexadecimal format.
• In this case, it is a five-component script, which includes:
  • Standard digital signatures according to the ECDSA protocol, typically to confirm ownership of a private key.
  • Public keys required to verify the signature.
  • There may be a structure indicating multi-signature operations (multiple public keys and signatures).

Analysis of the script structure:

• Starts with 00, which in the context of scriptSig can mean OP_0 , traditionally used in multi-signature scenarios (e.g. in the case of the Pay-to-Script-Hash multi-signature standard, where a stub is needed).
• Next come the signatures in DER format (e.g. 3045...), which typically consist of a series of bytes containing the signature details.
• The signatures are followed by public keys (in length and structure, most likely in a compressed format, since about 33 bytes), which confirm that the signatures belong to the correct owners.
• In general, the script format corresponds to redeemScript or the construction typical for P2SH multi-signature transactions.

---

2. Outpoint (outpoint)

• Contains data about the previous output that is used in this input:
  • 'hash': 'ec2a40cac3ac5dadf1d31f3cad03bdc8465caab5acbc5407ee7f4a7400aab577'— is the hash of the previous transaction.
  • 'index': 1– indicates the second output (numbered from zero), which is used for unlocking.
• Thus, the input references a specific output from a previous transaction, proving that the author of the transaction has the right to spend it.

---

3. Sequence (sequence)

• The value 4294967295 (0xFFFFFFFF)is a maximum 32-bit number.
• In Bitcoin, this field will serve to indicate that the input is not participating in the Replace-By-Fee (RBF) mechanism or does not have a time/lock on Relative Timelock.
• Often used by default for fixed inputs.

The Importance of scriptSig in a Security Context

• ScriptSig is the data for unlocking funds that are protected by the locking script of the previous exit.
• In the case of P2SH transactions (often for multi-signature), scriptSig contains:
  • Signatures of participants confirming the right to spend funds.
  • The original redeemScript, the hash of which is specified in the locking script of the previous output.
• A successful scriptSig check ensures that the author of the transaction actually has the necessary authority to dispose of the funds.

---

Cryptanalysis of the extraction of the first transaction input ( ins) with the given transaction hash showed that:

---

• The input of the first transaction contains a complex unlock script, including digital signatures and public keys.
• A reference to a specific output of another transaction is used ec2a40cac3ac5dadf1d31f3cad03bdc8465caab5acbc5407ee7f4a7400aab577:1.
• The maximum sequence value indicates the absence of special locks or RBF.
• Presumably, we are talking about a P2SH multi-signature transaction, where several signatures are required to confirm the spending of funds.

---

Thus, the obtained data allows for a deeper understanding of the mechanics of checking the rights to spend funds, is used to ensure the security of the Bitcoin network, as well as in the development and audit of smart contracts based on Bitcoin scripts.

---

Detailed analysis of the result of extracting the second output ( outs)

Let’s run the command to get information about one of the outputs of the transaction with the identifier ec2a40cac3ac5dadf1d31f3cad03bdc8465caab5acbc5407ee7f4a7400aab577.

!./darkai -redeemscript ec2a40cac3ac5dadf1d31f3cad03bdc8465caab5acbc5407ee7f4a7400aab577

outs Specifically, the second output ( ) of this transaction, the element with index 1, was extracted .

---

The result obtained:

{
  'value': 350000,
  'script': 'a91406612b7cb2027e80ec340f9e02ffe4a9a59ba76287'
}

---

1. Detailed analysis of the received data field value

• Size: 350,000 satoshis.
• This amount of funds is in the second output of the specified transaction and can be spent if the conditions specified in the corresponding script are met.
• Translation in BTC: 350,000 satoshi = 0.0035 BTC

2. Field value script

• Characteristic:
  The script a91406612b7cb2027e80ec340f9e02ffe4a9a59ba76287is a classic locking script (scriptPubKey) of the P2SH (Pay-to-Script-Hash) format .
• Script transcript:
  • a9— OP_HASH160 is an operator that first applies SHA-256 and then RIPEMD-160 to the input data.
  • 14— the length (20 bytes) of the next value is the hash size.
  • 06612b7cb2027e80ec340f9e02ffe4a9a59ba762— 20-byte hash, also known as script hash , is a unique representation of the redeem script that controls the spending of these funds.
  • 87— OP_EQUAL is an operator that compares two values and returns true if they are equal.

Thus, the script requires that in order to unlock (spend funds), the user presents a redeem script whose hash matches this value.

---

The meaning and role of redeem script in the context of P2SH

• Redeem script is an original script that sets the conditions for spending funds, for example, multi-signature, a complex scenario with a time limit, etc.
• Transaction outputs only store the hash from the redeem script, saving space and protecting the details of the conditions.
• To use the funds invested in this output, when creating a new transaction, the user must provide in scriptSig a serialized redeem script that is correctly decoded and verified by the network.

---

Overall meaning of the result

• The transaction ID ec2a40cac3ac5dadf1d31f3cad03bdc8465caab5acbc5407ee7f4a7400aab577is associated with an output that contains 0.0035 BTC.
• These funds are tied to a P2SH address controlled by a script with a hash 06612b7cb2027e80ec340f9e02ffe4a9a59ba762.
• In order to spend these funds, you must present a redeem script corresponding to this hash and fulfill the conditions laid out in it.

---

The significance of the information obtained in a broader context

• This result allows us to confirm that the funds are indeed at the output with the Pay-to-Script-Hash conditions.
• Understanding the structure of such outputs is important for security analysis, developing complex allocation scenarios, and verifying spending conditions.
• Using P2SH provides a secure and efficient mechanism for managing funds in the Bitcoin network, allowing for the creation of smart contracts and secure wallets.

---

The information received confirms that the second transaction output record ec2a40cac3ac5dadf1d31f3cad03bdc8465caab5acbc5407ee7f4a7400aab577 stores the amount of 0.0035 BTC, controlled by a standard P2SH script with a hash160 value 06612b7cb2027e80ec340f9e02ffe4a9a59ba762. To manage these funds, it is necessary to present the corresponding redeem script, which provides a high level of security and flexibility in managing bitcoins.

---

Let’s confirm the scriptSig decryption:

OP_FALSE 304502... 304602... 5221023927b5cd7facefa7b85d02f73d1e1632b3aaf8dd15d4f9f359e37e39f05611962103d2c0e82979b8aba4591fe39cffbf255b3b9c67b3d24f94de79c5013420c67b802103ec010970aae2e3d75eef0b44eaa31d7a0d13392513cd0614ff1c136b3b1020df53ae

---

Let’s run the command to get HASH160 Bitcoin developers have set a standard for a 20-byte hash (hex) which is widely used without changes in other popular cryptocurrencies such as Bitcoin (BTC), Ethereum (ETH), Tether (USDT), BNB (BNB), Solana (SOL), XRP (XRP), Cardano (ADA), Dogecoin (DOGE), USDC (USDC), Polkadot (DOT), Avalanche (AVAX), Shiba Inu (SHIB), Stellar (XLM), TRON (TRX), Chainlink (LINK), Litecoin (LTC), Bitcoin Cash (BCH), Monero (XMR) to denote the shortened identifier of scripts and public keys.

---

Let’s run the command:

!./darkai -hexdata 5221023927b5cd7facefa7b85d02f73d1e1632b3aaf8dd15d4f9f359e37e39f05611962103d2c0e82979b8aba4591fe39cffbf255b3b9c67b3d24f94de79c5013420c67b802103ec010970aae2e3d75eef0b44eaa31d7a0d13392513cd0614ff1c136b3b1020df53ae

Processing process:

1. The original string, represented in hexadecimal format, is converted into a sequence of bytes (decoded from hex to binary format). This sequence is a serialized script (redeem script) or a similar structure of a bitcoin script.
2. The received bytes are hashed using the SHA-256 (one-shot hash) algorithm, the result of which is then processed by the RIPEMD-160 cryptographic function.
3. The resulting RIPEMD-160 hash of the SHA-256 binary data is obtained as a string:

06612b7cb2027e80ec340f9e02ffe4a9a59ba762

This 20-byte hash (hex) is called HASH160 and is widely used in Bitcoin to denote a shortened identifier for scripts and public keys.

---

Meaning and context of the result

• The RIPEMD-160(SHA-256(data)) hashing process , known as HASH160, is the standard for creating addresses and scripts in Bitcoin, including P2SH (Pay-to-Script-Hash). HASH160 provides a unique and compact identifier that saves space on the blockchain.
• The use of double hashing (SHA-256, then RIPEMD-160) combines the strong cryptographic properties of both functions: collision resistance, one-wayness, and attack resistance.
• The resulting hash corresponds to the script hash of the redeem script – that is, the script that controls access to funds locked at the P2SH address.
• In particular, this HASH160 appears in the locking script (scriptPubKey) of the outputs of specific transactions, which requires that the original redeem script itself with the same hash and correct signatures be provided when spending.

---

Technical details and explanations

• Bitcoin has a concept of double hashing SHA-256 and RIPEMD-160 to protect addresses and scripts.
• Using HASH160 instead of a simple 256-bit SHA-256 output reduces the hash length from 32 bytes to 20 bytes, which reduces the storage and data size on the network.
• HASH160 is used to generate mainly P2SH addresses and legacy P2PKH addresses.

---

A key step in processing Bitcoin scripts using cryptographic hash functions.
Converting serialized scripts or public keys to HASH160 allows for efficient identification, indexing, and protection of data on the Bitcoin blockchain.

Received hash:

{'06612b7cb2027e80ec340f9e02ffe4a9a59ba762'}

The team has produced the exact hash that serves as the link between complex scripts and the compact format used to store and verify transactions on the Bitcoin network.

---

Why Satoshi Chose Double SHA-256 and How It Affects Cryptographic Strength

Satoshi Nakamoto chose to use SHA-256 double hashing (that is, applying SHA-256 twice in a row) in Bitcoin’s hashing algorithms for several important reasons that enhance the cryptographic strength and security of the network.

Reasons for choosing dual SHA-256

1. Improving resistance to various attacks
   A single application of SHA-256 already has high cryptographic resistance, is resistant to collisions and preimages. However, double application of the hash function – first SHA-256 to the original data, then SHA-256 to the result – further complicates the analysis and attacks on the hash.
   This reduces the probability of successfully selecting a collision or reverse recovery of the original data, makes it more labor-intensive to select various options and protects against weaknesses that are possible in specific implementations of the algorithm.
2. Protection against input data length issues
   Double SHA-256 provides an additional layer of preventative security by taking into account the behavior of internal hash construction and the handling of padding bits in the data markup. This minimizes potential attacks related to data formatting.
3. Following Good Cryptographic Practices
   Double hashing is a well-established security technique in a number of cryptographic protocols. For example, checksums and digital signatures use double encryption or double hashing. This increases the strength of the security chain.
4. Proven Security and Wide Support
   SHA-256 is a member of the SHA-2 family developed by the U.S. National Security Agency (NSA) and published by the National Institute of Standards and Technology (NIST). This algorithm is considered one of the most secure today, and its dual use provides maximum security.

---

How does this affect cryptographic strength?

• Collision and Preimage Resistance
  Each of the SHA-256 rounds is highly collision resistant—it is extremely difficult to find two inputs with the same hash. Double hashing enhances this guarantee because an attacker must find a collision for two consecutive SHA-256s, which significantly increases the computational complexity.
• One-way function with avalanche effect
  Double application enhances the “avalanche effect”, where the slightest change in the input data causes a radical change in the output hash, making it difficult to detect patterns and reverse engineer.
• Enhanced Cryptanalysis Resistance
  Double SHA-256 protects against potential implementation weaknesses or unexpected vulnerabilities that could be discovered in a single iteration, minimizing the risk of attacks using quantum or classical computing tools.
• Applicability to Proof-of-Work and Blockchain Security
  The PoW mechanism in Bitcoin relies on calculating block hashes that must satisfy a certain difficulty. Double hashing creates an additional barrier to block forgery, increasing the reliability and trust in the blockchain 5 .

---

Dual use SHA-256is a deliberate choice by Satoshi Nakamoto to provide an additional layer of security and robust cryptographic strength to the entire Bitcoin system. This design minimizes collision risks, enhances one-wayness, and securely protects data on the blockchain network, creating a solid foundation for transaction security and consensus in the system. Thus, dual SHA-256 is a key element of the Bitcoin architecture, combining advanced cryptographic techniques with a distributed system.

---

 

 

---

 

This was the first part of the article. The continuation follows in the next publication.

 

---

This material was created for the  CRYPTO DEEP TECH portal  to ensure financial data security and cryptography on elliptic curves  secp256k1  against weak  ECDSA signatures  in the  BITCOIN cryptocurrency . The creators of the software are not responsible for the use of materials.

---

Source code

Crypto Tools

Google Colab

Telegram: https://t.me/cryptodeeptech

Video: https://youtu.be/qbu1m_C1wyA

Video tutorial: https://dzen.ru/video/watch/68801dfc0c886621f7c1a0db

Source: https://cryptodeeptech.ru/digital-signature-forgery-attack

---

 Cryptanalysis