{"number":348,"title":"CHECKSIGFROMSTACK","authors":["Brandon Black","Jeremy Rubin"],"status":"Draft","type":"Specification","layer":"Consensus (soft fork)","created":"2024-11-26","license":"BSD-3-Clause","requires":[],"replaces":[],"replacedBy":[],"discussion":[],"abstract":"This BIP describes a new opcode for the purpose of checking cryptographic signatures in bitcoin scripts against data from the stack.","eli5":"Adds an instruction letting Bitcoin scripts verify a signature over any piece of data, not just over the spending transaction itself. That opens the door to things like delegating spending rights, using signed messages from outside parties (oracles), and building more efficient second-layer protocols.","categories":["consensus"],"filename":"bip-0348.md","githubUrl":"https://github.com/bitcoin/bips/blob/master/bip-0348.md","format":"markdown","readingMinutes":4,"inbound":2,"revisions":10,"impact":60,"core":false,"references":[],"lastModified":"2025-10-08","html":"

Abstract

\n

This BIP describes a new opcode for the purpose of checking cryptographic\nsignatures in bitcoin scripts against data from the stack.

\n

Summary

\n

When verifying taproot script spends having leaf version 0xc0 (as defined in\nBIP 342), we propose OP_CHECKSIGFROMSTACK to replace OP_SUCCESS204\n(0xcc).

\n

OP_CHECKSIGFROMSTACK has semantics similar to OP_CHECKSIG, as specified\nbelow. Briefly, it pops 3 elements from the stack: a 32-byte public key, a\nmessage, and a signature. If the signature is valid for that public key and\nmessage, 1 is pushed to the stack. If the signature is the empty vector, 0 is\npushed to the stack, and otherwise script execution fails.

\n

Only 32-byte keys are constrained. Similar to BIP 342 unknown key types, for\nother key lengths no signature verification is performed and it is considered\nsuccessful.

\n

Specification

\n\n

Design Considerations

\n
    \n
  1. Message hashing: BIP 340 is compatible with any size of message and does not require it to be a securely hashed input, so the message is not hashed prior to BIP 340 verification.
    2. \n
  2. Lack of verify semantics: Adding a single opcode for this purpose keeps the implementation and design simple. An earlier draft had a verify variant as a NOP upgrade, and if this functionality is later brought to legacy scripts, that would be a good time to add a verify variant.
    3. \n
  3. Add/multisig: No concession is made to OP_CHECKMULTISIG or OP_CHECKSIGADD semantics with OP_CHECKSIGFROMSTACK. In Tapscript, add semantics can be implemented with 1 additional vByte per key (OP_TOALTSTACK OP_CHECKSIGFROMSTACK OP_FROMALTSTACK OP_ADD).
    4. \n
  4. Splitting R/S on the stack: Implementing split/separate signatures is left as an exercise for other bitcoin upgrades, such as BIP 347 (OP_CAT).
    5. \n
  5. APO-style (BIP 118) Taproot internal key: Rather than introducing an additional key type in this change, we suggest implementing OP_INTERNALKEY (BIP 349) or separately introducing that key type for all Tapscript signature checking operations in a separate change.
    6. \n
\n

Resource Limits

\n

These opcodes are treated identically to other signature checking opcodes and\ncount against the sigops and budget.

\n

Motivation

\n

LN Symmetry

\n

When combined with BIP 119 (OP_CHECKTEMPLATEVERIFY/CTV),\nOP_CHECKSIGFROMSTACK (CSFS) can be used to implement Lightning Symmetry\nchannels. The construction OP_CHECKTEMPLATEVERIFY <pubkey> OP_CHECKSIGFROMSTACK with a spend stack containing the CTV hash and a\nsignature for it is logically equivalent to <bip118_pubkey> OP_CHECKSIG and\na signature over SIGHASH_ALL|SIGHASH_ANYPREVOUTANYSCRIPT. The\nOP_CHECKSIGFROMSTACK construction is 8 vBytes larger.

\n

Summary of alternatives:

\n\n

Delegation

\n

Using a script like:\n<pubkey> SWAP IF 2 PICK SWAP CSFS VERIFY ENDIF CHECKSIG\neither direct verification or delegation can be achieved by the following\nunlock stacks: <sig> 0 or <dsig> <dpubkey> <sig> 1

\n

Advanced delegation when combined with OP_PAIRCOMMIT or OP_CAT

\n

Using a script like:\nCLTV OVER PAIRCOMMIT TOALT CHECKSIGVERIFY FROMALT <pubkey> CSFS\nor:\nCLTV SHA256 OVER CAT TOALT CHECKSIGVERIFY FROMALT <pubkey> CSFS\nwith the unlock stack:\n<sig> <delegate_sig> <delegate_pubkey> <locktime>

\n

Delegates to a public key after a lock time, enabling delegation to various\nkeys after various associated times.

\n

Reference Implementation

\n

A reference implementation is provided here:

\n

https://github.com/bitcoin/bitcoin/pull/29270

\n

Backward Compatibility

\n

By constraining the behavior of an OP_SUCCESS opcode,\ndeployment of the BIP can be done in a backwards compatible, soft-fork manner.\nIf anyone were to rely on the OP_SUCCESS behavior of\nOP_SUCCESS204, OP_CHECKSIGFROMSTACK would invalidate\ntheir spend.

\n

Deployment

\n

TBD

\n

Credits

\n

Reference implementation was made with reference to the implementation in\nElements and started by moonsettler.

\n

Copyright

\n

This document is licensed under the 3-clause BSD license.

\n","toc":[{"id":"abstract","title":"Abstract","level":2},{"id":"summary","title":"Summary","level":2},{"id":"specification","title":"Specification","level":2},{"id":"design-considerations","title":"Design Considerations","level":2},{"id":"resource-limits","title":"Resource Limits","level":2},{"id":"motivation","title":"Motivation","level":2},{"id":"ln-symmetry","title":"LN Symmetry","level":3},{"id":"delegation","title":"Delegation","level":3},{"id":"advanced-delegation-when-combined-with-op-paircommit-or-op-cat","title":"Advanced delegation when combined with OP_PAIRCOMMIT or OP_CAT","level":3},{"id":"reference-implementation","title":"Reference Implementation","level":2},{"id":"backward-compatibility","title":"Backward Compatibility","level":2},{"id":"deployment","title":"Deployment","level":2},{"id":"credits","title":"Credits","level":2},{"id":"copyright","title":"Copyright","level":2}],"history":{"totalCommits":10,"firstCommit":"2024-04-24T14:40:53-07:00","lastUpdated":"2025-10-08T14:59:36-07:00","events":[{"sha":"24e96e870fffaa257b465ce1f0370c14aac588e8","date":"2025-10-08T14:59:36-07:00","author":"Murch","message":"process: Created ↦ Assigned","url":"https://github.com/bitcoin/bips/commit/24e96e870fffaa257b465ce1f0370c14aac588e8","kind":"edit"},{"sha":"5207ef92a52d0b8902895b0dbb40823a4d698ec9","date":"2025-04-11T20:08:17-07:00","author":"Murch","message":"process: Author ↦ Authors","url":"https://github.com/bitcoin/bips/commit/5207ef92a52d0b8902895b0dbb40823a4d698ec9","kind":"edit"},{"sha":"59730dec4fb641a41589aa1b91d3c452f13e0e36","date":"2025-04-11T20:05:13-07:00","author":"Murch","message":"process: Remove Comments-URI and -Summary","url":"https://github.com/bitcoin/bips/commit/59730dec4fb641a41589aa1b91d3c452f13e0e36","kind":"edit"},{"sha":"a233bde4af52c6a11269e2e6dd9707abce441ffe","date":"2025-04-11T18:19:21-07:00","author":"Murch","message":"process: Standards Track ↦ Specification","url":"https://github.com/bitcoin/bips/commit/a233bde4af52c6a11269e2e6dd9707abce441ffe","kind":"edit"},{"sha":"1dee48343649585d5a4b469edfc40a0187d819c2","date":"2025-03-10T16:20:42-04:00","author":"Antoine Poinsot","message":"Remove now unused reference to bip-0341","url":"https://github.com/bitcoin/bips/commit/1dee48343649585d5a4b469edfc40a0187d819c2","kind":"edit"},{"sha":"97a7edb0da7ec0ec7aaaff6cd43e106a3aee69e0","date":"2025-03-10T16:16:36-04:00","author":"Antoine Poinsot","message":"bip-0348: correct reference to Tapscript unknown key types","url":"https://github.com/bitcoin/bips/commit/97a7edb0da7ec0ec7aaaff6cd43e106a3aee69e0","kind":"edit"},{"sha":"726df6f4d54c7c7f9f1856ab37d07ece5defa0eb","date":"2025-02-08T20:04:18+10:00","author":"Anthony Towns","message":"Use code block instead of pre for markdown","url":"https://github.com/bitcoin/bips/commit/726df6f4d54c7c7f9f1856ab37d07ece5defa0eb","kind":"edit"},{"sha":"45fbec92cd6a1d016d96d6ce7616f9b346056112","date":"2024-12-16T15:23:08-05:00","author":"Danbo","message":"BIPs 348 and 379: spelling fixups (#1715)","url":"https://github.com/bitcoin/bips/commit/45fbec92cd6a1d016d96d6ce7616f9b346056112","kind":"edit"},{"sha":"f799ea1fa0509e45b0e5406e3ad19872ef5c240c","date":"2024-12-10T20:37:01-06:00","author":"kdmukai","message":"Trivial text correction","url":"https://github.com/bitcoin/bips/commit/f799ea1fa0509e45b0e5406e3ad19872ef5c240c","kind":"edit"},{"sha":"d2932bd00d16992d90df82d2a37db79c355046c4","date":"2024-04-24T14:40:53-07:00","author":"Brandon Black","message":"Add BIP 0348 - CHECKSGIFROMSTACK","url":"https://github.com/bitcoin/bips/commit/d2932bd00d16992d90df82d2a37db79c355046c4","kind":"edit"}]}}