> For the complete documentation index, see [llms.txt](https://docs.zkbob.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.zkbob.com/implementation/transaction-overview/signing-a-transaction.md).

# Signing a Transaction

Transactions in zkBob are signed by the spending key $$\sigma$$. To verify a transaction signature the prover should use an intermediate key A.

### Transaction hashing

A client application should sign a 'composite' transaction hash instead of full transaction data. The transaction hash is calculated from the input and output hashes:

$$H = Hash\_{sponge}(Hash\_{account}(Acc^\text{in}), Hash\_{note}(Note\_0^\text{in}), Hash\_{note}(Note\_1^\text{in}), Hash\_{note}(Note\_2^\text{in}), TxCommit)$$ 

where

* $$Hash$$ is a [Poseidon multi-hash (sponged) routine](/implementation/untitled/the-poseidon-hash.md) in the different modes
* $$Acc^\text{in}$$is an input account
* $$Note\_i^\text{in}$$is an input notes,
* $$TxCommit$$ - is a transaction commitment hash (Merkle subtree root). It depends on transaction output account and notes.

### Signing

Next, a client uses the account spending key to sign a transaction hash $$H$$:

$$r = Blake2s(\sigma, H)$$, where[$$Blake2s$$ is the 256-bit hash function ](https://www.blake2.net/blake2x.pdf)

$$R = rG$$, $$A=\sigma G$$ (moving $$r$$ and $$\sigma$$ to the JubJub Elliptic curve field)

$$S = r + Hash\_{eddsa}(R.x, A.x, H)\sigma$$

The output signature $$(S, R)$$ will be sent with a intermediate key $$A = \sigma G$$

### Verifying

To verify a transaction signature a validator should perform the following computations:

$$SG == R + Hash\_{eddsa}(R.x, A.x, H)A$$