What is Sign Transaction?

In the context of global digital transformation, the concept of Sign Transaction has gone beyond the meaning of a mere technical operation to become a pillar of financial autonomy and cryptographic security. According to experts at Tan Phat Digital, in essence, signing a transaction is the process of using an individual's private key to create a unique digital proof, to authenticate ownership and authorize a command to execute on a decentralized network.

This is the core mechanism that allows entities to interact in a trustless environment, where "private keys are equivalent to ownership". When an individual signs a transaction, they are making an irreversible mathematical commitment, proving that the transfer of funds or interaction with a smart contract was made by the rightful holder of access to the asset without revealing sensitive information outside the device.

Foundations of cryptography: The shift from RSA to ECC

To understand what signing a transaction actually means, it is necessary to analyze the foundations of cryptography symmetry. Long-standing traditional financial and communications systems are often based on the RSA (Rivest-Shamir-Adleman) algorithm, which is based on the difficulty of factoring large integers into prime factors. However, the development of blockchain required more efficient standards in terms of computation and bandwidth, leading to the popularity of Elliptic Curve Cryptography (ECC).

Analysis of mainstream digital signing algorithms

In public key infrastructure (PKI), the choice between algorithms directly determines the performance of the network. Below are the detailed parameters compiled by Tan Phat Digital:

RSA algorithm:
- Mathematical basis: Prime factorization.
- Key size: 3072 bits (for security level 128-bit) number.
- Key size: 3072 bits.
- Speed: Slower than RSA in both signing and authentication.
- Application: Government digital signature.
ECC algorithm (ECDSA):
- Mathematics: Elliptic curve over finite field.
- Key size: Only 256 bits but provides security equivalent to 3072 bit RSA.
- Speed: Very fast, saves CPU and bandwidth communication.
- Application: Gold standard for Blockchain (Bitcoin, Ethereum), IoT devices.

The efficiency of ECC allows low-power devices such as hardware wallets or mobile phones to sign transactions quickly without overloading the system.

The mechanism of action of secp256k1

Most Most of the leading blockchains use a specific Elliptic curve called secp256k1. This curve is defined by the equation y^2 = x^3 + 7 over a finite field. When a user signs a transaction, the ECDSA algorithm will perform a series of calculations to create two main values, r and s.

This process includes the following technical steps:

Random number generation (Nonce): The system chooses a random number k for each signature. The uniqueness of k is extremely important; if k is repeated for two different signatures from the same secret key, the secret key can be recovered by an attacker.
R-point calculation: R-point = k x G (where G is the predetermined generator point on the curve). The value r is the x coordinate of point R.
Creating value s: Use the formula s = k^{-1} (z + r x d) (mod n), where z is the hash of the transaction message and d is the secret key.

The resulting signature is a tuple (r, s), often accompanied by the recovery value $v$ to help network nodes easily identify public key from signature without additional data.

See more: What is Transaction?

Transaction lifecycle process and the role of signature

Signing a transaction is not an isolated event but the beginning of a complex lifecycle process that ensures integrity and consensus across the network.

Critical stages in the transaction lifecycle:

Initiation Phase: User creates transaction data packet (recipient, number money, gas...). The signature now plays the role of providing an authentication context for this content.
Digital Signature Phase: The ECDSA algorithm generates the triple $(r, s, v)$. This is a steel proof that proves the user's will and legal ownership of the asset.
Broadcasting Phase: The transaction is sent to neighboring nodes. The accompanying signature acts as a "passport" that carries proof of authorization.
Validation Phase: Network nodes check the validity of the signature through the ecrecover algorithm to prevent fake transactions.
Inclusion Phase: Transactions are included in the new block by miners or validators. The signature now officially locks the transaction into the immutable history of the blockchain.

Immutability and Transaction Confirmation

Once a transaction has been signed and included in a block through consensus mechanisms such as Proof-of-Work (PoW) or Proof-of-Stake (PoS), it becomes immutable. Modifying any information in a transaction will result in the signature becoming invalid, because the signature is a mathematical result associated with the hash content of the original data.

Signature standards on Ethereum: EIP-191 and EIP-712

To improve user experience and security, the Ethereum ecosystem has developed specialized signature standards, helping users clearly understand what they are doing signature.

EIP-191: Standardize signed data

EIP-191 introduces a standard format for signed data, starting with byte 0x19. This byte ensures that the signed data cannot be mistaken as a valid RLP transaction, thereby preventing bad actors from tricking users into signing a message that is actually a hidden money transfer order.

EIP-712: Revolutionizing Clear Signing

EIP-712 allows data to be displayed as meaningful information fields to humans (token name, quantity, address...) instead of because hexadecimal strings are long. This mechanism performs "Clear Signing", helping users accurately verify parameters before pressing the confirmation button.

Risks of signing transactions: Blind signing, Phishing and Unlimited Allowance

Even though cryptography is safe, the human factor is still the weakest link. Tan Phat Digital recommends that users pay special attention to the following types of attacks:

Unlimited Allowance: The attacker tricks the user into granting maximum spending permission for a token. As a result, they can drain that token from the wallet at any time in the future.
Ice Phishing: The attacker modifies the application interface to request the signing of a command to transfer asset ownership. All assets will be transferred immediately after signing.
Blind Signing: Users sign "Contract Interaction" orders without knowing what is actually inside, often resulting in permanent loss of assets.

Safe practice: Use a hardware wallet with a standalone monitor such as Ledger or Cypherock to check transaction information Offline translation before signing. Regularly revoke unnecessary approval rights.

See more: Hacked crypto wallets often originate from Where?

Compare Blockchain transaction signing and traditional finance (TradFi)

The concepts of "signing" and "transaction code" have similarities in function but profound differences in infrastructure.

Difference between TxHash and Reference Code (TRN):

Blockchain TxHash (ID): Created by cryptographic hashing (SHA-256) from transaction data; public on Explorer; has absolute immutability based on mathematics.
TradFi TRN (Reference code): Automatically allocated by the banking system (like Techcombank's FT code or Vietcombank's MBVCB code); is private and depends on the bank's centralized database.

CVV/CVC vs. ECDSA Digital Signature:

The CVV code is a static series of numbers used to authenticate the card. If exposed, criminals can use it many times. In contrast, signing blockchain transactions uses dynamic digital signatures. Each signature is tied to a unique nonce (sequence number), so an old signature can never be reused for a new transaction.

Post-signing transaction management: RBF and CPFP

In blockchain, there is no "cancel" button for a transaction after it has been propagated. However, we have mechanisms to regulate:

Replace-By-Fee (RBF): The sender replaces the old transaction with a new one with a higher gas fee to be prioritized by miners for faster processing.
Child-Pays-For-Parent (CPFP): The receiver creates a new transaction that consumes the pending amount of the old transaction at a rate extremely high fees, forcing miners to process the old transaction (parent) to get the fee of the new transaction (child).

The future of transaction signing: Account abstraction (ERC-4337)

Account Abstraction (AA) is changing the game by turning wallets into smart contracts. According to Tan Phat Digital's forecast, the following features will become popular:

Session Keys: Sign once to transact multiple times within a certain limit/time.
Social Recovery: Restore wallet through friends or other devices instead of having to remember 12-24 seed words same.
Biometric Signing: Use FaceID or fingerprint via Passkeys (WebAuthn) standard to sign transactions, providing a convenient experience like modern banking applications.