Pay to public key hash scripts hash the recipients public key for added security.

Is the same done with the public keys that make up part of a multisig script?

https://en.bitcoin.it/wiki/Script doesn't seem to indicate they are.


Yes and no.

In a bare multisig pubkey script, the public keys are not hashed. For example, a 2-of-3 pubkey script would look like:

2 <pubkey1> <pubkey2> <pubkey3> 3 OP_CHECKMULTISIG

In a multisig pay-to-script-hash (P2SH) script, the whole redeem script---including the public keys---would be hashed. For example, the redeem script would be the same as above, but the actual pubkey script would be:

OP_HASH160 <Hash160(redeemScript)> OP_EQUAL

Almost all multisig transactions on the network currently use P2SH multisig.

As an aside, although there is some hypothetical security increase from hashing public keys in case of a major problem with ECDSA, the main reason for hashing public keys is to create short addresses.

  • This is very useful, thanks. Just for clarification, with P2SH, the public keys within the redeemScript will only be public keys, not public key hashes if it is a multi-sig script? Is there no way to do multi-sig without exposing unhashed public keys at some point?
    – Dan
    Dec 10 '14 at 11:25
  • 1
    Correct. Also, there's no way to do any transaction secured with public key crypto without exposing the unhashed public keys at some point. In regular P2PKH, you reveal the unhashed keys in the signature script---the same as you do with P2SH. Also noteworthy: your public key can be reconstructed from your ECDSA signature in the signature script, although Bitcoin doesn't currently use this for anything. Dec 10 '14 at 12:47

Typically, you will use P2SH (pay to script hash) for multisig transactions, which means the transaction output does not contain the full script (with full public keys), but instead a hash of that script - and the full script is revealed when spending. See BIP16 for more information.

When this is done, you get the same effect: the transaction output does not contain a public key directly.

Note that there is indeed a small security benefit to this (it takes 2^160 steps in theory to reverse the hash function, while it takes 2^128 steps to find a private key for a given public key), but there are larger advantages (like the sender not needing to know the full script, and less data in the database of unspent transaction outputs that every full node maintains).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.