2

Is it possible to create a script that implements m of n pay to public key hash neatly? One way to do it would be to make use of OP_IF. But, that's not neat.

CHECKMULTISIGVERIFY can implement m of n, however, it takes public keys instead of public key hashes.

Thanks

  • Better answers are wanted if there's any. For now, I will just accept the only answer here. – Fries Mar 28 '17 at 5:07
1

I think I've figured out how to do it. (Not neatly, though.)

Here's a 3-of-5 pay to multi-pubkeyhash:

scriptSig: <key1> <key2> <key3> <sig1> <sig2> <sig3> <pos1> <pos2> <pos3>
scriptPubKey: <hash1> <hash2> <hash3> <hash4> <hash5>

// key1

// get the key <key1> and hash it
+2 13 OP_PICK OP_DUP OP_HASH160
// copy pos1
+1 9 OP_PICK 
// check 2 < pos1 < 7
+0 OP_DUP 2 7 OP_WITHIN OP_VERIFY
// copy to alt stack
+0 OP_DUP OP_TOALTSTACK
// get hash at pos1
-2 OP_PICK OP_EQUALVERIFY
// check signature
-1 11 OP_PICK OP_SWAP OP_CHECKSIGVERIFY

// key2

// get the key <key2> and hash it
+2 12 OP_PICK OP_DUP OP_HASH160
// copy pos2
+1 8 OP_PICK 
// check 2 < pos2 < 7
+0 OP_DUP 2 7 OP_WITHIN OP_VERIFY
// check pos2 < pos1
+0 OP_DUP OP_FROMALTSTACK OP_LESSTHAN OP_VERIFY
// copy to alt stack
+0 OP_DUP OP_TOALTSTACK
// get hash at pos2
-2 OP_PICK OP_EQUALVERIFY
// check signature
-1 10 OP_PICK OP_SWAP OP_CHECKSIGVERIFY

// key3

// get the key <key3> and hash it
+2 11 OP_PICK OP_DUP OP_HASH160
// copy pos3
+1 7 OP_PICK 
// check 2 < pos2 < 7
+0 OP_DUP 2 7 OP_WITHIN OP_VERIFY
// check pos3 < pos2
+0 OP_DUP OP_FROMALTSTACK OP_LESSTHAN OP_VERIFY
// get hash at pos3
-2 OP_PICK OP_EQUALVERIFY
// check signature
+0 9 OP_PICK OP_SWAP OP_CHECKSIG

(The number at the start of each line is how many stack elements that line adds or removes.)

The idea is that the spender provides the keys, the signatures, and the index of the hash that they're signing for. (keyN, sigN, and posN.) To prevent someone from providing the same index three times, we check that pos1 > pos2 > pos3. It's much longer than an equivalent multisig script, but on the plus side we do fewer signature verifications. (Normal 3-of-5 multisig will do up to 5 signature operations, but we only do 3.)

(Standard disclaimer about using untested scripts applies. If I made an off-by-one error above, all your money's gone.)

  • +1. Your solution is cool that I kind of agreeing that it's quite neat compared to an implementation of 3-of-5 pay using OP_IF. I will accept this if there's no other better answer. Thanks. – Fries Mar 20 '17 at 23:09
  • like. On the limitations and multisig, there was a longer discussion: bitcoin.stackexchange.com/questions/23893/…, aka is "OP_IF" accepted by standards? – pebwindkraft Apr 9 '17 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.