<p>Yes. But they require the transaction to be signed a certain way. OP_CHECKSIG has settable flags, which determines which of the inputs and outputs are signed. </p>

<p>If SIGHASH_SINGLE and SIGHASH_ANYONECANPAY is used for OP_CHECKSIG , each signature signs for its respective input and outputs, allowing others to add new inputs and outputs to the transaction. </p>

<p><a href="https://en.bitcoin.it/wiki/OP_CHECKSIG">https://en.bitcoin.it/wiki/OP_CHECKSIG</a></p>

<p><a href="https://bitcoin.org/en/glossary/sighash-single">https://bitcoin.org/en/glossary/sighash-single</a></p>

<p><a href="https://bitcoin.org/en/glossary/sighash-anyonecanpay">https://bitcoin.org/en/glossary/sighash-anyonecanpay</a></p>

CC BY-SA 3.0
2016-05-26T00:46:46.037Z
If you use SIGHASH_SINGLE, you're basically giving away that the input and output are related. This unfortunately means the purpose of the coinjoin (privacy) is defeated.
Jimmy Song
CC BY-SA 3.0
2016-10-06T17:37:32.717Z
@Jimmy Song Perhaps privacy is not the reason the OP wants this.
Jus12
CC BY-SA 3.0
2017-06-14T04:18:27.407Z
True that this would defeat the purpose of CoinJoin by clearly linking inputs and outputs. But it could be used to lower fees. Imagine a service that repackages input/output pairs signed with SINGLE/ANYONECANPAY into larger transactions to reduce storage overhead.
Rich Apodaca
CC BY-SA 3.0
2016-05-25T19:22:30.793Z
2016-05-25T19:22:30.793Z
k kurokawa
<p>The only possibility in Bitcoin today is the one described by kaykurokawa. Every signature specifies which inputs and outputs it signs for, so if you want independently-created signatures, it will be obvious to everyone which input and output were created simultaneously.</p>

<p>The general practice of combining multiple pieces of transactions into one is called CoinJoin. It works well in theory, but it does require the different parties to cooperate (each signs everyone's inputs and outputs).</p>

<p>A potential future development that could change this is, is based on One-Way Aggregatable Signatures (OWAS) (see the paper on <a href="https://download.wpsoftware.net/bitcoin/wizardry/horasyuanmouton-owas.pdf" rel="nofollow noreferrer">https://download.wpsoftware.net/bitcoin/wizardry/horasyuanmouton-owas.pdf</a> originally posted anonymously on <a href="https://bitcointalk.org/index.php?topic=290971.0" rel="nofollow noreferrer">https://bitcointalk.org/index.php?topic=290971.0</a>). This mechanism would allow anyone on the network to take two transactions and CoinJoin them, without being able to tell afterwards which inputs and outputs were related. As a side benefit, it also combines all signatures in such transactions into one. Taken to the extreme, it would mean that a block can just be reduced to a single transaction, constructed by miners applying this joining operation on all transactions they want to include.</p>

<p>Unfortunately, OWAS relies on a signature scheme called BLS, which is much newer and not as well studied as ECDSA (which Bitcoin uses now), so its security is less certain. Furthermore it is far slower, and would need very invasive changes to Bitcoin. It is an active area of research, though.</p>

<p>More recently, a system called MimbleWimble has been proposed which supports offline transaction aggregation as well as cut-through transactions while only relying on EC cryptography.</p>

CC BY-SA 3.0
2016-05-26T10:13:10.523Z
2017-07-17T17:50:54.220Z
2017-07-17T17:50:54.220Z
Pieter Wuille
<p>I have two valid txs and two valid signatures for those txs.</p>

<p>Right now they look like:</p>

<pre><code>1) A -&gt; B 
2) C -&gt; D
</code></pre>

<p><sup>A and C are inputs &amp; B and D are outputs.</sup></p>

<p>I want to be able to combine them into:</p>

<pre><code>1) A, C -&gt; B, D
</code></pre>

<p>Is there a way that I can combine these two tx's and their corresponding signatures into one valid tx without having access to the keys?</p>

CC BY-SA 3.0
2016-05-25T19:08:56.867Z
I'm not sure what is being asked here.  Are `A` and `C` transactions?  Signatures?  What are 'B' and 'D'?  Do you mean "UTXOs" when you say "txs"?  I don't know what you are getting at.
Jestin
CC BY-SA 3.0
2016-05-25T19:12:14.783Z
@Jestin I might not be using the correct terminology... A and C are inputs B and D are outputs
Jack Fraser
CC BY-SA 3.0
2016-10-06T17:36:58.907Z
Out of curiosity, why do you want to do that?
Jus12
<transactions><raw-transaction><transaction-malleability>
Is it possible to combine two separate transactions into one transaction by only using their signatures?
Jack Fraser
# Is it possible to combine two separate transactions into one transaction by only using their signatures?

(Asked by: username_0 on 2016-05-25)

I have two valid txs and two valid signatures for those txs.
Right now they look like:
1) A -> B 
2) C -> D

A and C are inputs & B and D are outputs.
I want to be able to combine them into:
1) A, C -> B, D

Is there a way that I can combine these two tx's and their corresponding signatures into one valid tx without having access to the keys?

**Tags:** transactions, raw-transaction, transaction-malleability

> **Comments:**
> **username_1**: I'm not sure what is being asked here.  Are `A` and `C` transactions?  Signatures?  What are 'B' and 'D'?  Do you mean "UTXOs" when you say "txs"?  I don't know what you are getting at.  
> **username_0**: @username_1 I might not be using the correct terminology... A and C are inputs B and D are outputs  
> **username_2**: Out of curiosity, why do you want to do that?  

---

## 2 answers

### Answer by username_6 on 2016-05-26. Score: 8 | Accepted answer

The only possibility in Bitcoin today is the one described by kaykurokawa. Every signature specifies which inputs and outputs it signs for, so if you want independently-created signatures, it will be obvious to everyone which input and output were created simultaneously.

The general practice of combining multiple pieces of transactions into one is called CoinJoin. It works well in theory, but it does require the different parties to cooperate (each signs everyone's inputs and outputs).

A potential future development that could change this is, is based on One-Way Aggregatable Signatures (OWAS) (see the paper on <https://download.wpsoftware.net/bitcoin/wizardry/horasyuanmouton-owas.pdf> originally posted anonymously on <https://bitcointalk.org/index.php?topic=290971.0>). This mechanism would allow anyone on the network to take two transactions and CoinJoin them, without being able to tell afterwards which inputs and outputs were related. As a side benefit, it also combines all signatures in such transactions into one. Taken to the extreme, it would mean that a block can just be reduced to a single transaction, constructed by miners applying this joining operation on all transactions they want to include.

Unfortunately, OWAS relies on a signature scheme called BLS, which is much newer and not as well studied as ECDSA (which Bitcoin uses now), so its security is less certain. Furthermore it is far slower, and would need very invasive changes to Bitcoin. It is an active area of research, though.

More recently, a system called MimbleWimble has been proposed which supports offline transaction aggregation as well as cut-through transactions while only relying on EC cryptography.


---

### Answer by username_3 on 2016-05-25. Score: 6

Yes. But they require the transaction to be signed a certain way. OP\_CHECKSIG has settable flags, which determines which of the inputs and outputs are signed.

If SIGHASH\_SINGLE and SIGHASH\_ANYONECANPAY is used for OP\_CHECKSIG , each signature signs for its respective input and outputs, allowing others to add new inputs and outputs to the transaction.

<https://en.bitcoin.it/wiki/OP_CHECKSIG>

<https://bitcoin.org/en/glossary/sighash-single>

<https://bitcoin.org/en/glossary/sighash-anyonecanpay>

> **Comments:**
> **username_4**: If you use SIGHASH_SINGLE, you're basically giving away that the input and output are related. This unfortunately means the purpose of the coinjoin (privacy) is defeated.  
> **username_2**: @username_4 Perhaps privacy is not the reason the OP wants this.  
> **username_5**: True that this would defeat the purpose of CoinJoin by clearly linking inputs and outputs. But it could be used to lower fees. Imagine a service that repackages input/output pairs signed with SINGLE/ANYONECANPAY into larger transactions to reduce storage overhead.  

---

