1

Is it in theory possible to set up a 2 out of 4 multi-sig transaction, but only allow a subset of all possible combinations?

More concrete: I want to have the keys A, B, C, D.

  • Alice controls A
  • Bob controls B
  • Charlie controls C
  • Dennis controls D

There are six ways to select 2 items from 4 items. However, the only valid combinations should be:

  • A, B
  • C, D
  • A, D
3
  • 1
    Minor justification: there are six ways to select 2 from 4. – Madzi Konjo Oct 24 '14 at 4:57
  • @MadziKonjo Good point. We don't care about the difference between A, B and B, A. – Nick ODell Oct 26 '14 at 15:09
  • This is a usecase for the question: It would be possible for an oracle to release ether key B or C. Now A OR D could access the funds. The oracle can never access the funds AND it does not need to have to know about Alice and Dennis or about the transaction. It only releases a key. – user599464 Oct 29 '14 at 15:17
2

Out of curiosity, what's the use case for a configuration like this?

Is it possible to do this using the bitcoin scripting language? Yes, absolutely. Making it and actually having it included into a block is questionable, mainly because it would be a non standard transaction type.

There aren't really a lot of tools to help you do it, though. I can describe what the scripts would have to look like, but not sure how you would actually make such a transaction. This question might be of interest to you as well.

The assumed scriptSig, where we don't know what combination of signatures we have:

0 {sig1} {sig2}

The scriptPubKey would be a standard P2SH pub key script:

OP_HASH160 {hash} EQUAL

The redeemScript (in this P2SH transaction) might look something like:

3DUP 2 {A_pub} {B_pub} 2 CHECKMULTISIG DUP NOTIF
    3DUP 2 {C_pub} {D_pub} 2 CHECKMULTISIG DUP NOTIF
        3DUP 2 {A_pub} {D_pub} 2 CHECKMULTISIG 
    ENDIF 
ENDIF

I believe this would work, but if someone could check the logic of this script here, I'd appreciate it. The OP_3DUP is necessary because the scriptSig should have 3 items on it already (2 signatures and the OP_0 to satisfy the off-by-1 error in the original client), and those 3 items need to be used more than once.

6
  • realitykeys.com Is would be possible for an oracle to release ether key C or D. Now A OR B could access the funds. The oracle can never access the funds AND it does not need to have to know about Alice and Bob or about the transaction. It only releases a key. – user599464 Oct 28 '14 at 0:19
  • 1
    But if the oracle has keys C and D then they will be able to spend it? And I think your configurations might have been a little off in the original question, wouldn't you be looking for any of these combinations: (A,B), (A,D), (B,C)? That way the oracle can release either D or C and doesn't have to actually go through the pains of signing the transaction. – morsecoder Oct 28 '14 at 0:28
  • Sorry - you are right I messed up A, B, C, and D. The question is still valid, but with the key names from the question the oracle should hold B and C. – user599464 Oct 29 '14 at 15:15
  • Can you edit the question to have exactly what you mean? Thanks! – morsecoder Oct 29 '14 at 15:16
  • In my opinion the question is fine? An answer to this questions is at the same time an answer how this usecase can be handled. Or do you think I should ask for a solution for the usecase? That would be a different questions in my opinion. – user599464 Oct 29 '14 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.