If so, do the three separate parties have to agree on the character sequence?


Yes, that's possible.

In fact, the party that creates the address is the only one who needs to agree on the character sequence.

Suppose you have an address that can be spent with 2-of-3 multisig. This is a pay-to-script-hash address (starting with 3 instead of 1). Your script would probably look something like this:

2 <pubkey A> <pubkey B> <pubkey C> 3 OP_CHECKMULTISIG

This works, but this script's hash (with overwhelming probability) will be rather boring.

Suppose party A wants a more interesting address. She knows her private key k_A, and her public key Q_A, as well as everyone else's public key. All she has to do run the following algorithm:

while not interesting(address):
    Q = Q + G
    k = k + 1
    address = hash160('2 <Q> <pubkey B> <pubkey C> 3 OP_CHECKMULTISIG')

At which point her public key is Q, and her private key is k. G is the generator point for the secp256k1 curve. Then Alice reveals this script to Bob and Charlie, who verify that the script contains their public keys and that it hashes to the expected address.

Bob and Charlie cannot distinguish between an address generated in this special way, and Alice getting lucky on the first try in her choice of private key.

vanitygen already implements something like this for 1-of-1 signatures when you tell it to generate address starting with 3.


Agreement of the vanity multisig address is not required, the main thing is to provide the correct redeem script for the waste and the signature of the addresses used.

On bitcointalk there is an interesting thread on this topic:

Rare multisig (P2SH) address hall of fame

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.