BA-06 · LESSON 10

Native and nested SegWit scripts

KEY DEFINITIONS

Terms used in this lesson

SegWit: Segregated Witness: a Bitcoin upgrade that separates authorization data from the transaction identifier and introduces versioned witness programs.
P2WPKH: Pay to Witness Public Key Hash: a native SegWit output for one public-key hash.
P2WSH: Pay to Witness Script Hash: a native SegWit output that commits to a witness script.
P2SH: Pay to Script Hash, a legacy Bitcoin output template that commits to a redeem script.
Witness: Signatures, scripts, or other data supplied to satisfy a Bitcoin output’s spending condition.
Hash160: SHA-256 followed by RIPEMD-160, producing the 20-byte hash used by several Bitcoin spending conditions.
OP_0: A Bitcoin Script operation that pushes an empty byte string, also used as the version marker for version-zero SegWit programs.
SHA-256: A cryptographic hash function used throughout Bitcoin to produce fixed-size 256-bit digests.
Sighash: The exact transaction digest and signature mode that determine which fields a Bitcoin signature authorizes.
CHECKMULTISIG: The Bitcoin Script operation that checks a threshold number of ordered signatures against a list of public keys.

Construct P2WPKH, P2WSH, P2SH-P2WPKH, and P2SH-P2WSH outputs and follow each redeem, witness, hash, and signature check.

45 min Difficulty 2/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · segwit script templatesNative and nested SegWit add one or two commitment layersSelect any state to inspect its exact role.

RELATIONSHIP MAPOrdered validation pipeline

01
P2WPKHOP_0 <20-byte key hash>
Witness supplies signature and compressed public key.
02
P2WSHOP_0 <32-byte script hash>
Witness supplies arguments followed by the exact script.
03
P2SH-P2WPKHScriptSig pushes 22-byte program
The P2SH redeem script is the witness program, not the signature data.
04
P2SH-P2WSHTwo hash checks then execute
P2SH checks the program, then SegWit checks and executes the witness script.
05
RESULTVersion-0 sighash succeeds
Nested compatibility adds bytes but does not change the final authorization policy.

Rule shown: P2SH can wrap a witness program, while final signatures and scripts remain in the witness and follow version-0 rules.

STAGE 1 OF 5P2WPKH: OP_0 <20-byte key hash>

Witness supplies signature and compressed public key.

Governing relationship: P2SH can wrap a witness program, while final signatures and scripts remain in the witness and follow version-0 rules. Complete path: 1. P2WPKH, OP_0 <20-byte key hash>. Witness supplies signature and compressed public key. 2. P2WSH, OP_0 <32-byte script hash>. Witness supplies arguments followed by the exact script. 3. P2SH-P2WPKH, ScriptSig pushes 22-byte program. The P2SH redeem script is the witness program, not the signature data. 4. P2SH-P2WSH, Two hash checks then execute. P2SH checks the program, then SegWit checks and executes the witness script. 5. RESULT, Version-0 sighash succeeds. Nested compatibility adds bytes but does not change the final authorization policy.

1. State transitionWhat exists, what changes, and what results

BEFORE

A P2SH-P2WSH output protects a 2-of-2 witness script.

MECHANISM

ScriptPubKey is OP_0 followed by a 20-byte key hash. The witness contains signature and compressed public key. The key hash and SegWit signature both must verify.

AFTER

Nested SegWit is a P2SH commitment to a witness program, not P2SH directly around the final witness script or key.

Text equivalent: Starting from A P2SH-P2WSH output protects a 2-of-2 witness script. The mechanism begins when ScriptPubKey is OP_0 followed by a 20-byte key hash. The witness contains signature and compressed public key. The key hash and SegWit signature both must verify. The resulting lesson is Nested SegWit is a P2SH commitment to a witness program, not P2SH directly around the final witness script or key.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 5

Build native P2WPKH

ScriptPubKey is OP_0 followed by a 20-byte key hash. The witness contains signature and compressed public key. The key hash and SegWit signature both must verify.

Complete path: 1. Build native P2WPKH: ScriptPubKey is OP_0 followed by a 20-byte key hash. The witness contains signature and compressed public key. The key hash and SegWit signature both must verify. 2. Build native P2WSH: ScriptPubKey is OP_0 followed by the 32-byte SHA-256 hash of a witness script. The witness supplies arguments followed by the exact script, which is hashed and then executed. 3. Wrap P2WPKH in P2SH: The redeem script is the 22-byte OP_0 plus 20-byte program. P2SH commits HASH160 of those 22 bytes. ScriptSig pushes the redeem script; the witness carries signature and public key. 4. Wrap P2WSH in P2SH: The redeem script is OP_0 plus the 32-byte script hash. ScriptSig reveals it, P2SH verifies its HASH160, then SegWit verifies the witness script's SHA-256 and executes it. 5. Compare identifiers and costs: All four forms move authorization data into witness and use SegWit sighash rules. Nested forms add redeem-script bytes for compatibility and therefore cost more than the corresponding native output.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

Both wrappers must match: P2SH HASH160 of the redeem program, then SegWit program hash and witness execution. Any mismatch stops before later authorization can count.

CHANGED CONDITION

Putting signatures in ScriptSig, using the witness script itself as the P2SH redeem script, or choosing Bech32m for version 0 constructs the wrong form.

Important distinction: P2SH-P2WSH stores the complete witness script in ScriptSig. ScriptSig reveals only the version-0 witness program. The complete witness script appears as the final witness item and must match the program's SHA-256.

Text equivalent: The accepted path is enforced by Both wrappers must match: P2SH HASH160 of the redeem program, then SegWit program hash and witness execution. Any mismatch stops before later authorization can count. If the required condition changes, Putting signatures in ScriptSig, using the witness script itself as the P2SH redeem script, or choosing Bech32m for version 0 constructs the wrong form.

Loading lesson visuals...

Learn the idea

SegWit outputs use a version byte and witness program. Native P2WPKH and P2WSH put that program directly in ScriptPubKey. Nested P2SH-P2WPKH and P2SH-P2WSH wrap the witness program in a redeem script whose HASH160 appears in P2SH. The ScriptSig then reveals only that witness-program redeem script, while signatures and witness scripts remain in the witness.

GUIDED EXPLANATION1/5 ideas inspected

Build native P2WPKH

ScriptPubKey is OP_0 followed by a 20-byte key hash. The witness contains signature and compressed public key. The key hash and SegWit signature both must verify.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“P2SH-P2WSH stores the complete witness script in ScriptSig.”

ScriptSig reveals only the version-0 witness program. The complete witness script appears as the final witness item and must match the program's SHA-256.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.