I have two valid txs and two valid signatures for those txs.

Right now they look like:

1) A -> B 
2) C -> D

A and C are inputs & B and D are outputs.

I want to be able to combine them into:

1) A, C -> B, D

Is there a way that I can combine these two tx's and their corresponding signatures into one valid tx without having access to the keys?

  • 1
    I'm not sure what is being asked here. Are A and C transactions? Signatures? What are 'B' and 'D'? Do you mean "UTXOs" when you say "txs"? I don't know what you are getting at.
    – Jestin
    May 25, 2016 at 19:08
  • @Jestin I might not be using the correct terminology... A and C are inputs B and D are outputs May 25, 2016 at 19:12
  • Out of curiosity, why do you want to do that?
    – Jus12
    Oct 6, 2016 at 17:36

2 Answers 2


The only possibility in Bitcoin today is the one described by kaykurokawa. Every signature specifies which inputs and outputs it signs for, so if you want independently-created signatures, it will be obvious to everyone which input and output were created simultaneously.

The general practice of combining multiple pieces of transactions into one is called CoinJoin. It works well in theory, but it does require the different parties to cooperate (each signs everyone's inputs and outputs).

A potential future development that could change this is, is based on One-Way Aggregatable Signatures (OWAS) (see the paper on https://download.wpsoftware.net/bitcoin/wizardry/horasyuanmouton-owas.pdf originally posted anonymously on https://bitcointalk.org/index.php?topic=290971.0). This mechanism would allow anyone on the network to take two transactions and CoinJoin them, without being able to tell afterwards which inputs and outputs were related. As a side benefit, it also combines all signatures in such transactions into one. Taken to the extreme, it would mean that a block can just be reduced to a single transaction, constructed by miners applying this joining operation on all transactions they want to include.

Unfortunately, OWAS relies on a signature scheme called BLS, which is much newer and not as well studied as ECDSA (which Bitcoin uses now), so its security is less certain. Furthermore it is far slower, and would need very invasive changes to Bitcoin. It is an active area of research, though.

More recently, a system called MimbleWimble has been proposed which supports offline transaction aggregation as well as cut-through transactions while only relying on EC cryptography.


Yes. But they require the transaction to be signed a certain way. OP_CHECKSIG has settable flags, which determines which of the inputs and outputs are signed.

If SIGHASH_SINGLE and SIGHASH_ANYONECANPAY is used for OP_CHECKSIG , each signature signs for its respective input and outputs, allowing others to add new inputs and outputs to the transaction.




  • 2
    If you use SIGHASH_SINGLE, you're basically giving away that the input and output are related. This unfortunately means the purpose of the coinjoin (privacy) is defeated.
    – Jimmy Song
    May 26, 2016 at 0:46
  • @Jimmy Song Perhaps privacy is not the reason the OP wants this.
    – Jus12
    Oct 6, 2016 at 17:37
  • True that this would defeat the purpose of CoinJoin by clearly linking inputs and outputs. But it could be used to lower fees. Imagine a service that repackages input/output pairs signed with SINGLE/ANYONECANPAY into larger transactions to reduce storage overhead. Jun 14, 2017 at 4:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.