Two out of Four transaction with excluding some key pairs

Question

Is it in theory possible to set up a 2 out of 4 multi-sig transaction, but only allow a subset of all possible combinations?

More concrete: I want to have the keys A, B, C, D.

• Alice controls A
• Bob controls B
• Charlie controls C
• Dennis controls D

There are six ways to select 2 items from 4 items. However, the only valid combinations should be:

• A, B
• C, D
• A, D

Answer 1

Out of curiosity, what's the use case for a configuration like this?

Is it possible to do this using the bitcoin scripting language? Yes, absolutely. Making it and actually having it included into a block is questionable, mainly because it would be a non standard transaction type.

There aren't really a lot of tools to help you do it, though. I can describe what the scripts would have to look like, but not sure how you would actually make such a transaction. This question might be of interest to you as well.

The assumed scriptSig, where we don't know what combination of signatures we have:

0 {sig1} {sig2}

The scriptPubKey would be a standard P2SH pub key script:

OP_HASH160 {hash} EQUAL

The redeemScript (in this P2SH transaction) might look something like:

3DUP 2 {A_pub} {B_pub} 2 CHECKMULTISIG DUP NOTIF
    3DUP 2 {C_pub} {D_pub} 2 CHECKMULTISIG DUP NOTIF
        3DUP 2 {A_pub} {D_pub} 2 CHECKMULTISIG 
    ENDIF 
ENDIF

I believe this would work, but if someone could check the logic of this script here, I'd appreciate it. The OP_3DUP is necessary because the scriptSig should have 3 items on it already (2 signatures and the OP_0 to satisfy the off-by-1 error in the original client), and those 3 items need to be used more than once.