<p>I think I've figured out how to do it. (Not neatly, though.)</p>

<p>Here's a 3-of-5 pay to multi-pubkeyhash:</p>

<pre><code>scriptSig: &lt;key1&gt; &lt;key2&gt; &lt;key3&gt; &lt;sig1&gt; &lt;sig2&gt; &lt;sig3&gt; &lt;pos1&gt; &lt;pos2&gt; &lt;pos3&gt;
scriptPubKey: &lt;hash1&gt; &lt;hash2&gt; &lt;hash3&gt; &lt;hash4&gt; &lt;hash5&gt;

// key1

// get the key &lt;key1&gt; and hash it
+2 13 OP_PICK OP_DUP OP_HASH160
// copy pos1
+1 9 OP_PICK 
// check 2 &lt; pos1 &lt; 7
+0 OP_DUP 2 7 OP_WITHIN OP_VERIFY
// copy to alt stack
+0 OP_DUP OP_TOALTSTACK
// get hash at pos1
-2 OP_PICK OP_EQUALVERIFY
// check signature
-1 11 OP_PICK OP_SWAP OP_CHECKSIGVERIFY

// key2

// get the key &lt;key2&gt; and hash it
+2 12 OP_PICK OP_DUP OP_HASH160
// copy pos2
+1 8 OP_PICK 
// check 2 &lt; pos2 &lt; 7
+0 OP_DUP 2 7 OP_WITHIN OP_VERIFY
// check pos2 &lt; pos1
+0 OP_DUP OP_FROMALTSTACK OP_LESSTHAN OP_VERIFY
// copy to alt stack
+0 OP_DUP OP_TOALTSTACK
// get hash at pos2
-2 OP_PICK OP_EQUALVERIFY
// check signature
-1 10 OP_PICK OP_SWAP OP_CHECKSIGVERIFY

// key3

// get the key &lt;key3&gt; and hash it
+2 11 OP_PICK OP_DUP OP_HASH160
// copy pos3
+1 7 OP_PICK 
// check 2 &lt; pos2 &lt; 7
+0 OP_DUP 2 7 OP_WITHIN OP_VERIFY
// check pos3 &lt; pos2
+0 OP_DUP OP_FROMALTSTACK OP_LESSTHAN OP_VERIFY
// get hash at pos3
-2 OP_PICK OP_EQUALVERIFY
// check signature
+0 9 OP_PICK OP_SWAP OP_CHECKSIG
</code></pre>

<p>(The number at the start of each line is how many stack elements that line adds or removes.)</p>

<p>The idea is that the spender provides the keys, the signatures, and the index of the hash that they're signing for. (keyN, sigN, and posN.) To prevent someone from providing the same index three times, we check that pos1 > pos2 > pos3. It's much longer than an equivalent multisig script, but on the plus side we do fewer signature verifications. (Normal 3-of-5 multisig will do up to 5 signature operations, but we only do 3.)</p>

<p>(Standard disclaimer about using untested scripts applies. If I made an off-by-one error above, all your money's gone.)</p>

CC BY-SA 3.0
2017-03-20T23:09:38.030Z
+1. Your solution is cool that I kind of agreeing that it's quite neat compared to an implementation of 3-of-5 pay using `OP_IF`. I will accept this if there's no other better answer. Thanks.
Fries
CC BY-SA 3.0
2017-04-09T15:28:45.220Z
*like*. On the limitations and multisig, there was a longer discussion: http://bitcoin.stackexchange.com/questions/23893/what-are-the-limits-of-m-and-n-in-m-of-n-multisig-addresses, aka is "OP_IF" accepted by standards?
pebwindkraft
CC BY-SA 3.0
2017-03-20T22:12:27.993Z
2017-03-20T22:12:27.993Z
Nick ODell
<p>Is it possible to create a script that implements <code>m of n</code> pay to public key hash neatly? One way to do it would be to make use of <code>OP_IF</code>. But, that's not neat.</p>

<p><code>CHECKMULTISIGVERIFY</code> can implement <code>m of n</code>, however, it takes public keys instead of public key hashes.</p>

<p>Thanks</p>

CC BY-SA 3.0
2017-03-28T05:07:57.300Z
Better answers are wanted if there's any. For now, I will just accept the only answer here.
Fries
<script><multi-signature>
CHECKMULTISIGVERIFY with public key hashes?
Fries
# CHECKMULTISIGVERIFY with public key hashes?

(Asked by: username_0 on 2017-03-19)

Is it possible to create a script that implements `m of n` pay to public key hash neatly? One way to do it would be to make use of `OP_IF`. But, that's not neat.

`CHECKMULTISIGVERIFY` can implement `m of n`, however, it takes public keys instead of public key hashes.

Thanks

**Tags:** script, multi-signature

> **Comments:**
> **username_0**: Better answers are wanted if there's any. For now, I will just accept the only answer here.  

---

## 1 answers

### Answer by username_1 on 2017-03-20. Score: 1 | Accepted answer

I think I've figured out how to do it. (Not neatly, though.)
Here's a 3-of-5 pay to multi-pubkeyhash:
scriptSig:         
scriptPubKey:     

// key1

// get the key  and hash it
+2 13 OP_PICK OP_DUP OP_HASH160
// copy pos1
+1 9 OP_PICK 
// check 2 < pos1 < 7
+0 OP_DUP 2 7 OP_WITHIN OP_VERIFY
// copy to alt stack
+0 OP_DUP OP_TOALTSTACK
// get hash at pos1
-2 OP_PICK OP_EQUALVERIFY
// check signature
-1 11 OP_PICK OP_SWAP OP_CHECKSIGVERIFY

// key2

// get the key  and hash it
+2 12 OP_PICK OP_DUP OP_HASH160
// copy pos2
+1 8 OP_PICK 
// check 2 < pos2 < 7
+0 OP_DUP 2 7 OP_WITHIN OP_VERIFY
// check pos2 < pos1
+0 OP_DUP OP_FROMALTSTACK OP_LESSTHAN OP_VERIFY
// copy to alt stack
+0 OP_DUP OP_TOALTSTACK
// get hash at pos2
-2 OP_PICK OP_EQUALVERIFY
// check signature
-1 10 OP_PICK OP_SWAP OP_CHECKSIGVERIFY

// key3

// get the key  and hash it
+2 11 OP_PICK OP_DUP OP_HASH160
// copy pos3
+1 7 OP_PICK 
// check 2 < pos2 < 7
+0 OP_DUP 2 7 OP_WITHIN OP_VERIFY
// check pos3 < pos2
+0 OP_DUP OP_FROMALTSTACK OP_LESSTHAN OP_VERIFY
// get hash at pos3
-2 OP_PICK OP_EQUALVERIFY
// check signature
+0 9 OP_PICK OP_SWAP OP_CHECKSIG

(The number at the start of each line is how many stack elements that line adds or removes.)
The idea is that the spender provides the keys, the signatures, and the index of the hash that they're signing for. (keyN, sigN, and posN.) To prevent someone from providing the same index three times, we check that pos1 > pos2 > pos3. It's much longer than an equivalent multisig script, but on the plus side we do fewer signature verifications. (Normal 3-of-5 multisig will do up to 5 signature operations, but we only do 3.)
(Standard disclaimer about using untested scripts applies. If I made an off-by-one error above, all your money's gone.)

> **Comments:**
> **username_0**: +1. Your solution is cool that I kind of agreeing that it's quite neat compared to an implementation of 3-of-5 pay using `OP_IF`. I will accept this if there's no other better answer. Thanks.  
> **username_2**: *like*. On the limitations and multisig, there was a longer discussion: http://bitcoin.stackexchange.com/questions/23893/what-are-the-limits-of-m-and-n-in-m-of-n-multisig-addresses, aka is "OP_IF" accepted by standards?  

---

