<blockquote>
  <p>Couldn't we check the signature even before doing the hash?</p>
</blockquote>

<p>We certainly could, but that would be silly. The hash is about 1000x faster than checking a signature. Doing the signature check when the hash fails would be a waste of time</p>

<blockquote>
  <p>More precisely, couldn't it instead do:</p>
  
  <p>scriptPubKey: OP_CHECKSIGVERIFY OP_DUP OP_HASH160  OP_EQUAL</p>
</blockquote>

<p>No, that certainly wouldn't work. The OP_CHECKSIGVERIFY would remove the public key from the stack, so there is nothing to compare it with. The OP_DUP would always fail, as there is nothing to duplicate anymore.</p>

CC BY-SA 3.0
2017-10-08T07:08:15.877Z
aha i see. thanks for the answer. Just to make sure i understood completely, so if we do `scriptPubKey: OP_DUP OP_CHECKSIGVERIFY OP_HASH160 <pubKeyHash> OP_EQUAL` and `scriptSig: <sig> <pubKey>`, this would: 1. work; 2. but not efficient therefore not used because hashing is much faster than checksig?
Vlad
CC BY-SA 3.0
2017-10-08T07:50:43.907Z
Not quite. After OP_DUP, your stack will be <sig> <pubkey> <pubkey>. Invoking OP_CHECKSIGVERIFY at that point will do a verification with <pubkey> as signature.
Pieter Wuille
CC BY-SA 3.0
2017-10-08T08:07:49.223Z
What would work (but be inefficient): scriptSig={<pubkey> <sig>}, scriptPubKey={OP_OVER OP_CHECKSIGVERIFY OP_HASH160 <pubkeyhash> OP_EQUAL}.
Pieter Wuille
CC BY-SA 3.0
2018-04-23T16:39:59.367Z
Actually, the scriptSig would be "<sig> <pubkey>" to use OP_OVER. If it was already "<pubkey> <sig>" the suggestion in the first comment would work, but it would require a change in the scriptSig, not only the scriptPubKey.
diego nunes
CC BY-SA 3.0
2017-10-08T06:41:06.967Z
2017-10-08T06:41:06.967Z
Pieter Wuille
<p>According to the <a href="https://en.bitcoin.it/wiki/Script" rel="nofollow noreferrer">bitcoin wiki</a>, the most common form of transaction (pay-to-pubkey-hash) looks like this:</p>

<pre><code>scriptPubKey: OP_DUP OP_HASH160 &lt;pubKeyHash&gt; OP_EQUALVERIFY OP_CHECKSIG
scriptSig: &lt;sig&gt; &lt;pubKey&gt;
</code></pre>

<p>I am curious why <code>OP_CHECKSIG</code> comes at the end. Couldn't we check the signature even before doing the hash?</p>

<p>More precisely, couldn't it instead do:</p>

<pre><code>scriptPubKey: OP_CHECKSIGVERIFY OP_DUP OP_HASH160 &lt;pubKeyHash&gt; OP_EQUAL
scriptSig: &lt;pubKey&gt; &lt;sig&gt;
</code></pre>

<p>This way you don't have to go through all the hashing if the pubkey and sig don't match to begin with. </p>

<p>I'm sure there's a good reason for this or i'm completely misunderstanding something, please enlighten me. Thank you!</p>

<script>
Why does pay to pubkey hash contain OP_CHECKSIG at the end instead of beginning?
Vlad
# Why does pay to pubkey hash contain OP_CHECKSIG at the end instead of beginning?

(Asked by: username_0 on 2017-10-08)

According to the bitcoin wiki, the most common form of transaction (pay-to-pubkey-hash) looks like this:
scriptPubKey: OP_DUP OP_HASH160  OP_EQUALVERIFY OP_CHECKSIG
scriptSig:  

I am curious why OP_CHECKSIG comes at the end. Couldn't we check the signature even before doing the hash?
More precisely, couldn't it instead do:
scriptPubKey: OP_CHECKSIGVERIFY OP_DUP OP_HASH160  OP_EQUAL
scriptSig:  

This way you don't have to go through all the hashing if the pubkey and sig don't match to begin with. 
I'm sure there's a good reason for this or i'm completely misunderstanding something, please enlighten me. Thank you!

**Tags:** script


---

## 1 answers

### Answer by username_1 on 2017-10-08. Score: 4 | Accepted answer

> Couldn't we check the signature even before doing the hash?

We certainly could, but that would be silly. The hash is about 1000x faster than checking a signature. Doing the signature check when the hash fails would be a waste of time

> More precisely, couldn't it instead do:
>
> scriptPubKey: OP\_CHECKSIGVERIFY OP\_DUP OP\_HASH160 OP\_EQUAL

No, that certainly wouldn't work. The OP\_CHECKSIGVERIFY would remove the public key from the stack, so there is nothing to compare it with. The OP\_DUP would always fail, as there is nothing to duplicate anymore.

> **Comments:**
> **username_0**: aha i see. thanks for the answer. Just to make sure i understood completely, so if we do `scriptPubKey: OP_DUP OP_CHECKSIGVERIFY OP_HASH160 <pubKeyHash> OP_EQUAL` and `scriptSig: <sig> <pubKey>`, this would: 1. work; 2. but not efficient therefore not used because hashing is much faster than checksig?  
> **username_1**: Not quite. After OP_DUP, your stack will be <sig> <pubkey> <pubkey>. Invoking OP_CHECKSIGVERIFY at that point will do a verification with <pubkey> as signature.  
> **username_1**: What would work (but be inefficient): scriptSig={<pubkey> <sig>}, scriptPubKey={OP_OVER OP_CHECKSIGVERIFY OP_HASH160 <pubkeyhash> OP_EQUAL}.  
> **username_2**: Actually, the scriptSig would be "<sig> <pubkey>" to use OP_OVER. If it was already "<pubkey> <sig>" the suggestion in the first comment would work, but it would require a change in the scriptSig, not only the scriptPubKey.  

---

