user10845: It has been stated:

A major problem with simple approaches to increasing the Bitcoin blocksize is that for certain transactions, signature-hashing scales quadratically rather than linearly.

https://bitcoincore.org/en/2016/01/26/segwit-benefits/#linear-scaling-of-sighash-operations
What are some examples of transactions with this behavior, and what do they have in common?
Does a simple one-input-two-output Alice-pays-Bob transaction show quadratic signature-hashing scaling?

user5406: The quadratic hashing issue appears in the verification of all pre-segwit transaction formats. It stems from the method of verifying the input scripts.
For each input the transaction has, all the other inputs are stripped from the transaction to check that remaining input against the output it spends as wells as the corresponding signature. As the effort of stripping the transaction is linearly dependent on the number inputs and the stripping is repeated for each input, we do n-times work that scales linearly with n: O(n)*O(n) = O(n²), the cost grows quadratically with the number of inputs. This means that with twice the number of inputs, the computational effort for the verification quadruples.
Rusty Russell explained the conundrum in his blog when he analyzed 'The Megatransaction: Why Does It Take 25 Seconds?'.

user208: Quadratic means that something grows as a square function of something else. If you're just talking about a one-input transaction, there is nothing that changes.
The quadratic hashing issue is that the amount of data to hash to compute or verify signatures grows as a square of the number of non-segwit inputs.

10845: <p>It has been stated:</p>

<blockquote>
  <p>A major problem with simple approaches to increasing the Bitcoin blocksize is that for certain transactions, signature-hashing scales quadratically rather than linearly.</p>
</blockquote>

<p><a href="https://bitcoincore.org/en/2016/01/26/segwit-benefits/#linear-scaling-of-sighash-operations" rel="nofollow noreferrer">https://bitcoincore.org/en/2016/01/26/segwit-benefits/#linear-scaling-of-sighash-operations</a></p>

<p>What are some examples of transactions with this behavior, and what do they have in common?</p>

<p>Does a simple one-input-two-output Alice-pays-Bob transaction show quadratic signature-hashing scaling?</p>
 5406: <p>The quadratic hashing issue appears in the verification of all pre-segwit transaction formats. It stems from the method of verifying the input scripts.</p>
<p>For each input the transaction has, all the other inputs are stripped from the transaction to check that remaining input against the output it spends as wells as the corresponding signature. As the effort of stripping the transaction is linearly dependent on the number inputs and the stripping is repeated for each input, we do n-times work that scales linearly with n: <code>O(n)*O(n) = O(n²)</code>, the cost grows quadratically with the number of inputs. This means that with twice the number of inputs, the computational effort for the verification quadruples.</p>
<p>Rusty Russell explained the conundrum in his blog when he analyzed <a href="http://rusty.ozlabs.org/?p=522" rel="nofollow noreferrer">'The Megatransaction: Why Does It Take 25 Seconds?'</a>.</p>
 208: <p>Quadratic means that something grows as a square function of something else. If you're just talking about a one-input transaction, there is nothing that changes.</p>
<p>The quadratic hashing issue is that the amount of data to hash to compute or verify signatures grows as a square of the number of non-segwit inputs.</p>
