I have a few questions regarding the transaction hash preimage when signing with different values of the SIGHASH flag in the case of the P2PKH script.

I know what the transaction hash preimage looks like in case of SIGHASH_ALL, but what does it look like for other values of this flag.

So let’s say our transaction has 3 inputs and 4 outputs and we can denote it as T(I1, I2, I3; O1, O2, O3, O4), the preimage in the case of SIGHASH_ALL will be as follows.

Let’s start with the input. We take all inputs as they are (its full content). After that, we clear the scriptSig field of all inputs and set the length of the scriptSig field in all inputs to zero (0x00). Then, just for the input we’re signing, we set its scriptSig field to the scriptPubKey from the output (UTXO) that this input points to. Also, we will set the length of the scriptSig field in this input to the length of this newly added script scriptPubKey. The length of the scriptSig field in other inputs remains zero (0x00), and the scriptSig field remains empty. When it comes to the outputs, we copy their complete contents and add them to the previously described slightly modified contents of the inputs. Finally, we additionally append 0x01000000, which indicates that it is a SIGHASH_ALL type of signature.

This is how it works in the case of SIGHASH_ALL, but how does it work for other values of this flag.

My assumption is that it is exactly the same process, the only question is which inputs and outputs are taken into account. Therefore, the transaction hash preimages for the different values of the SIGHASH flag are as follows (I took into account the values defined in the Master Bitcoin book):

1. NONE (0x02) – Signature applies to all inputs, none of the outputs

   • for inputs, absolutely the same story that I described for SIGHASH_ALL applies
   • outputs are not taken into account (they are not part of the transaction hash preimage, similar as scriptSig field of other inputs is also not a part)
   • append 0x02000000 to the end

2. SIGNLE (0x03) – Signature applies to all inputs but only the one output with the same index number as the signed input

   • for inputs, absolutely the same story that I described for SIGHASH_ALL applies
   • only the content of the output whose index corresponds to the input index is taken into account (eg if we want to sign I2, we will take inputs I1, I2 and I3, but only output O2)
   • append 0x02000000 to the end

3. ALL|ANYONECANPAY (0x81) – Signature applies to one input and all outputs

   • only the input that we sign is included in the transaction hash preimage, the other inputs, i.e. their content, are not part of the transaction hash preimage in any form (we just ignore the other inputs, a similar scenario that we would have if the transaction had only one input and the SIGHASH_ALL)
   • for outputs, absolutely the same story that I described for SIGHASH_ALL applies (we take the entire content of all outputs)
   • append 0x81000000 to the end

4. NONE|ANYONECANPAY (0x82) – Signature applies to one input, none of the outputs

   • for inputs, absolutely the same story that I described for 0x81 (ALL|ANYONECANPAY) applies
   • outputs are not taken into account (they are not part of the transaction hash preimage)
   • append 0x82000000 to the end

5. SINGLE|ANYONECANPAY (0x83) – Signature applies to one input and the output with the same index number

   • for inputs, absolutely the same story that I described for 0x81 (ALL|ANYONECANPAY) applies
   • for outputs, absolutely the same story that I described for 0x03 (SIGNLE) applies
   • append 0x83000000 to the end

So my questions are:

1. Is this how it works?

2. Are there any other values for the SIGHASH flag that I should cover?

3. Is there some related work/paper/standard that explains this (perhaps for other scripts, like P2WPKH etc.)?