How do you prove you control an address?

Evidence

Each numbered marker in the text points here, and the ↩ links lead back to every place that cites an entry. Quotes are verbatim from the BIP files at commit 3a10b5b, including their wiki markup; links open the exact lines; the quoted text sits under each entry. Labels say what kind of statement each is: a rule, the author’s rationale, history, a test vector, or our own inference.

1. ↩ a b Author’s rationale The authors note the current (legacy) message signing standard only works for P2PKH addresses; basing signatures on Script means any coins can in principle be signed for.

   BIP 322 L30–32 BIP 322 L461–462

   Quoted source text (2)

   The current message signing standard only works for P2PKH (1...) invoice addresses. We propose to extend and generalize the standard by using an approach based on Bitcoin Script. This ensures that any coins, no matter what script they are controlled by, can in principle be signed for.

   This specification is backwards-compatible with the legacy signmessage/verifymessage specification

2. ↩ Author’s rationale Legacy signatures are ECDSA signatures that do not commit to the public key, so they do not prove knowledge of a secret key; third parties can tweak them into valid signatures for related keys.

   BIP 322 L37–39

   Quoted source text (1)

   Additionally, the current message signature format uses ECDSA signatures that do not commit to the public key, meaning that they do not actually prove knowledge of any secret keys. (Indeed, valid signatures can be tweaked by third parties to become valid signatures on certain related keys.)

3. ↩ History BIP 322 (Karl-Johan Alm, Oliver Gugger), assigned in 2018, is recorded as Complete at version 2.0.0; it was marked Complete in 2026.

   BIP 322 L4–9 BIP 322 L18 BIP 322 L496–497

   Quoted source text (3)

   Title: Generic Signed Message Format Authors: Karl-Johan Alm <karljohan-alm@garage.co.jp> Oliver Gugger <gugger@gmail.com> Status: Complete Type: Specification Assigned: 2018-09-10

   Version: 2.0.0

   * '''1.0.0''' (2026-04-15): ** Mark Complete

4. ↩ Author’s rationale BIP 322 is a standard for signed messages based on Bitcoin Script, for proving availability of funds or committing to a message as the intended recipient of funds sent to an address.

   BIP 322 L24–26

   Quoted source text (1)

   A standard for interoperable signed messages based on the Bitcoin Script format, either for proving availability of funds, or for committing to a message as the intended recipient of funds sent to the invoice address.

5. ↩ a b c Rule BIP 322 specifies three formats, legacy, simple and full, plus a full variant for proving control of a set of UTXOs; signers MUST prefix the signature with its variant (smp, ful, pof), and a verifier might assume simple when no prefix is present.

   BIP 322 L61–63 BIP 322 L97–99

   Quoted source text (2)

   This BIP specifies three formats for signing messages: ''legacy'', ''simple'' and ''full''. Additionally, a variant of the ''full'' format can be used to demonstrate control over a set of UTXOs.

   Signers MUST prefix the signature with the variant that was used to create the signature. To support backward compatibility with implementations of this BIP before it was finalized, a verifier might assume the ''simple'' variant in the absence of a prefix.

6. ↩ a b Rule New proofs SHOULD use the new format for all addresses including P2PKH; the legacy format MAY be used but MUST be restricted to P2PKH; the table's other legacy script types are possible on a technical level but SHOULD NOT be used.

   BIP 322 L103–105 BIP 322 L93–94

   Quoted source text (2)

   New proofs SHOULD use the new format for all invoice address formats, including P2PKH. The legacy format MAY be used, but MUST be restricted to the legacy P2PKH invoice address format.

   ¹: Possible on a technical level but SHOULD NOT be used anymore in the context of this BIP

7. ↩ a b Rule A simple signature is a witness stack, consensus-encoded and base64-encoded with prefix smp; validators rebuild to_spend and to_sign with default values and proceed as for a full signature.

   BIP 322 L109–112 BIP 322 L127

   Quoted source text (2)

   A ''simple'' signature consists of a witness stack, consensus encoded as a vector of vectors of bytes, and base64-encoded, prefixed by the variant (<code>smp</code>). Validators should construct <code>to_spend</code> and <code>to_sign</code> as defined below, with default values for all fields

   and then proceed as they would for a full signature.

8. ↩ a b Rule A full signature is the ful-prefixed base64 encoding of the signed to_sign transaction.

   BIP 322 L165–166

   Quoted source text (1)

   A ''full'' signature consists of the variant-prefixed (<code>ful</code>) base64-encoding of the <code>to_sign</code> transaction in standard network serialisation once it has been signed.

9. ↩ a b c Rule Proof of Funds adds inputs for any UTXOs the signer wants to show control of, encoded as a pof-prefixed finalized PSBT; it does not prove completeness or that the UTXOs are unspent, which needs the current UTXO set.

   BIP 322 L170–171 BIP 322 L175–177 BIP 322 L207–208

   Quoted source text (3)

   The Proof of Funds variant extends the basic scheme: in addition to signing a message under a single address's key, the signer proves control over an arbitrary set of UTXOs.

   In any case, however, the UTXO list does not aim to prove completeness (e.g., it does NOT mean: "these are all UTXOs that exist for an address"), nor that they are unspent (e.g., a validator must consult the blockchain to verify that).

   Unlike an ordinary signature, validators of a proof of funds need access to the current UTXO set, to learn that the claimed inputs exist on the blockchain and remain unspent.

10. ↩ a b c Rule to_spend has version 0, lock time 0, one input spending 000…000:0xFFFFFFFF with sequence 0 and scriptSig OP_0 PUSH32[message_hash], and one 0-value output to message_challenge; message_hash is the BIP 340 tagged hash with tag BIP0322-signed-message of the message as-is.

    BIP 322 L138–146 BIP 322 L148–151

    Quoted source text (2)

    nVersion = 0 nLockTime = 0 vin[0].prevout.hash = 0000...000 vin[0].prevout.n = 0xFFFFFFFF vin[0].nSequence = 0 vin[0].scriptSig = OP_0 PUSH32[ message_hash ] vin[0].scriptWitness = [] vout[0].nValue = 0 vout[0].scriptPubKey = message_challenge

    where <code>message_hash</code> is a BIP340-tagged hash of the message, i.e., sha256_tag(m), where tag = <code>BIP0322-signed-message</code> and <code>m</code> is the message as-is without length prefix or null terminator, and <code>message_challenge</code> is the (public) key script to be proven.

11. ↩ a b c Rule to_sign spends to_spend's output 0, carries message_signature as its witness, and has one 0-value OP_RETURN output; version, lock time and sequence are 0 unless the full format sets them (e.g. for time locks).

    BIP 322 L155–163

    Quoted source text (1)

    nVersion = 0 or (FULL format only) as appropriate (e.g., 2 for time locks) nLockTime = 0 or (FULL format only) as appropriate (for time locks) vin[0].prevout.hash = to_spend.txid vin[0].prevout.n = 0 vin[0].nSequence = 0 or (FULL format only) as appropriate (for time locks) vin[0].scriptSig = [] or (FULL format only) as appropriate (for non segwit-native transactions) vin[0].scriptWitness = message_signature vout[0].nValue = 0 vout[0].scriptPubKey = OP_RETURN

12. ↩ a b c Test vector This site's BIP 322 model reproduces the published message hashes and both transaction IDs, and verifies every published simple and full vector (P2PKH, P2SH, P2SH-wrapped and native SegWit, multisig, P2TR key and script paths, and time locks) with a script interpreter limited to a reviewed opcode set that applies the required rules in every script version; it reports inconclusive for scripts outside that set and for proof-of-funds signatures, whose PSBTs it does not decode. It rejects every published error vector. The build fails if a figure's verdict differs from the one recorded for that vector.

    BIP 322 L510–514

    Quoted source text (1)

    Basic test vectors for message hashing, transaction hashes and "simple" variant test cases can be found in [[bip-0322/basic-test-vectors.json|<code>basic-test-vectors.json</code>]]. Generated test vectors for more "simple" and "full" variant test cases can be found in [[bip-0322/generated-test-vectors.json|<code>generated-test-vectors.json</code>]].

13. ↩ a b c Rule A validator outputs one of three states: valid at time T and age S, inconclusive (unable to check the scripts), or invalid.

    BIP 322 L222–234

    Quoted source text (1)

    A validator is given as input an address ''A'', signature ''s'' and message ''m'', and outputs one of three states: <ul> <li> ''valid at time T and age S'' indicates that the signature has set timelocks but is otherwise valid </li> <li> ''inconclusive'' means the validator was unable to check the scripts </li> <li> ''invalid'' means that some check failed

14. ↩ Editorial inference to_spend spends an output that cannot exist, so neither virtual transaction can be valid on chain; they are built only to be checked.

    BIP 322 L34–35 BIP 322 L218

    Quoted source text (2)

    except that it contains an invalid input, so it cannot be spent on any real network

    output with prevout <code>000...000:FFFFFFFF</code> does not exist.

15. ↩ Author’s rationale The signature format resembles a Bitcoin transaction, for compatibility with signing hardware, but contains an invalid input so it cannot be spent on any real network.

    BIP 322 L32–35

    Quoted source text (1)

    For easy interoperability with existing signing hardware, we also define a signature message format that resembles a Bitcoin transaction (except that it contains an invalid input, so it cannot be spent on any real network).

16. ↩ Rule Except for legacy, to_spend and to_sign must pass all consensus checks, except that the output 000…000:FFFFFFFF does not exist.

    BIP 322 L216–218

    Quoted source text (1)

    For all signature types, except legacy, the <code>to_spend</code> and <code>to_sign</code> transactions must be valid transactions which pass all consensus checks, except of course that the output with prevout <code>000...000:FFFFFFFF</code> does not exist.

17. ↩ Rule In BIP 322 a "signature" is a witness stack, a full transaction or a PSBT that satisfies the address's script, and may not contain a cryptographic signature at all.

    BIP 322 L52–57

    Quoted source text (1)

    whenever the word "signature" or similar is used, it refers to the output of the signing process described below, and, depending on the script type of the <code>message_challenge</code>, is either a full transaction input witness stack, a full transaction, or a PSBT packet that can be validated against a Bitcoin Script Interpreter. Such a "signature" may or may not contain an actual cryptographic (ECDSA or Schnorr) signature, depending on what is required to satisfy the script corresponding to the <code>message_challenge</code>.

18. ↩ Rule A signer may use simple if they added no inputs, left version, sequence and lock time at 0, and the address is native SegWit; full if they added no inputs; otherwise they must use proof of funds.

    BIP 322 L296–306 BIP 322 L301–306

    Quoted source text (2)

    If they added no inputs to <code>to_sign</code>, left nVersion, nSequence and nLockTime at 0, and ''A'' is a "native" Segwit address (P2WPKH, P2WSH, P2TR), then they may base64-encode <code>message_signature</code> with <code>smp</code> as prefix.

    If they added no inputs to <code>to_sign</code>, they may base64-encode <code>to_sign</code> with <code>ful</code> as prefix. </li> <li> Otherwise, they must base64-encode the finalized PSBT of <code>to_sign</code> with <code>pof</code> as prefix.

19. ↩ Rule Multisig signatures are produced by coordinating signers through a PSBT, as for a real multisig spend; BIP 322 adds the global field PSBT_GLOBAL_GENERIC_SIGNED_MESSAGE (0x09) carrying the UTF-8 message.

    BIP 322 L312–315 BIP 322 L332–336

    Quoted source text (2)

    A valid witness stack for a multisig address must be constructed by coordinating different signers to produce a partial signature each. The coordination procedure is not specified by this BIP, but due to the use of PSBTs it should closely resemble the coordination of signing a multisig transaction for publishing to the network.

    | <tt>PSBT_GLOBAL_GENERIC_SIGNED_MESSAGE = 0x09</tt> | None | No key data | <tt><bytes message></tt> | The UTF-8 encoded message to be signed.

20. ↩ Rule The BIP recommends keeping messages to a few kilobytes for compatibility and committing to very large messages by hash.

    BIP 322 L378–381

    Quoted source text (1)

    There is no specified maximum length of an input's <code>valuedata</code> or a PSBT as a whole in [[bip-0174.mediawiki|BIP174]], but different signers might impose safety limits. It is recommended to use a maximum length of a few kilobytes to maximize compatibility. Very large messages should be committed to by hash instead.

21. ↩ a b Rule Validation recomputes to_spend from the message and address, decodes to_sign, and for full signatures checks that to_sign's first input spends to_spend's output and that it has exactly one output. The pair must satisfy consensus, except for to_spend's missing input and to_sign's lock time and first sequence, which are not checked.

    BIP 322 L243–246 BIP 322 L249 BIP 322 L250

    Quoted source text (3)

    ## Compute the transaction <code>to_spend</code> from ''m'' and ''A'' ## Decode ''s'' as the transaction <code>to_sign</code> ## If ''s'' was a full transaction or PSBT, confirm all fields are set as specified above; in particular that ##* <code>to_sign</code> has at least one input and its first input spends the output of <code>to_spend</code>

    ##* <code>to_sign</code> has exactly one output, as specified above

    ## Confirm that the two transactions together satisfy all consensus rules, except for <code>to_spend</code>'s missing input, and except that ''nSequence'' of <code>to_sign</code>'s first input and ''nLockTime'' of <code>to_sign</code> are not checked.

22. ↩ Rule Required rules: signatures MUST use SIGHASH_ALL (or SIGHASH_DEFAULT where supported); CODESEPARATOR and FindAndDelete are forbidden; LOW_S, STRICTENC, NULLFAIL, MINIMALDATA, CLEANSTACK and MINIMALIF apply; failure means invalid.

    BIP 322 L253–254 BIP 322 L255–258 BIP 322 L259

    Quoted source text (3)

    ## All signatures MUST use the <code>SIGHASH_ALL</code> flag, unless the output type supports <code>SIGHASH_DEFAULT</code>, which then MAY be used alternatively (e.g., [[bip-0341.mediawiki|BIP341 P2TR]]). ## The use of <code>CODESEPARATOR</code> or <code>FindAndDelete</code> is forbidden.

    ## <code>LOW_S</code>, <code>STRICTENC</code> and <code>NULLFAIL</code>: valid ECDSA signatures must be strictly DER-encoded and have a low-S value; invalid ECDSA signature must be the empty push ## <code>MINIMALDATA</code>: all pushes must be minimally encoded ## <code>CLEANSTACK</code>: require that only a single stack element remains after evaluation ## <code>MINIMALIF</code>: the argument of <code>IF</code>/<code>NOTIF</code> must be exactly 0x01 or empty push

    ## If any of the above steps failed, the validator should stop and output the ''invalid'' state.

23. ↩ a b Rule A validator without a full script interpreter should check it understands all scripts being satisfied, and otherwise output inconclusive.

    BIP 322 L251

    Quoted source text (1)

    # (Optional) If the validator does not have a full script interpreter, it should check that it understands all scripts being satisfied. If not, it should stop here and output ''inconclusive''.

24. ↩ Rule Upgradeable rules: to_sign's version must be 0 or 2, upgrade NOPs and SegWit versions above 1 are forbidden; failure means inconclusive.

    BIP 322 L261–264

    Quoted source text (1)

    ## The version of <code>to_sign</code> must be 0 or 2. ## The use of NOPs reserved for upgrades is forbidden. ## The use of Segwit versions greater than 1 is forbidden. ## If any of the above steps failed, the validator should stop and output the ''inconclusive'' state.

25. ↩ a b Rule T is to_sign's nLockTime and S the nSequence of its first input; the output is valid at time T and age S.

    BIP 322 L265

    Quoted source text (1)

    # Let ''T'' be the nLockTime of <code>to_sign</code> and ''S'' be the nSequence of the first input of <code>to_sign</code>. Output the state ''valid at time T and age S''.

26. ↩ a b Author’s rationale No message signing protocol can prove control of funds: a signature is obsolete once created, and a key holder may sign messages for others without signing transactions.

    BIP 322 L41–44

    Quoted source text (1)

    Ultimately, no message signing protocol can actually prove control of funds, both because a signature is obsolete as soon as it is created, and because the possessor of a secret key may be willing to sign messages on others' behalf even if it would not sign actual transactions. No message signing protocol can fix these limitations.

27. ↩ a b Author’s rationale BIP 322 shows a signer will be able to control funds sent to the address; it cannot prove that the signer sent a prior transaction.

    BIP 322 L46–48

    Quoted source text (1)

    Finally, this BIP only addresses the use case where a signer shows they will be able to control funds sent to the invoice address. Proving that a signer sent a prior transaction is not possible using this BIP.

28. ↩ Editorial inference A BIP 322 signature carries no timestamp (T is a lock-time field, not a signing date); how recent it is depends on the message containing something the verifier chose fresh.

    BIP 322 L41–42 BIP 322 L265

    Quoted source text (2)

    a signature is obsolete as soon as it is created

    Let ''T'' be the nLockTime of <code>to_sign</code>

29. ↩ Rule A PSBT signer must tell the user the message and address being signed for, and should present it like signing a message, not a transaction.

    BIP 322 L423–430

    Quoted source text (1)

    If all of the above steps are true, the signer must inform the user about the message they are signing and the address they are signing for. <ol> <li> Even though the message being signed is a transaction, the user interaction (e.g., the steps and messages shown on a hardware signing device's screen) should resemble the steps to sign a legacy message, not the steps for signing a transaction.