<p>Out of curiosity, what's the use case for a configuration like this? </p>

<p>Is it possible to do this using the bitcoin scripting language? Yes, absolutely. Making it and actually having it included into a block is questionable, mainly because it would be a non standard transaction type. </p>

<p>There aren't really a lot of tools to help you do it, though. I can describe what the scripts would have to look like, but not sure how you would actually make such a transaction. <a href="https://bitcoin.stackexchange.com/questions/26940/advanced-bitcoin-transactions">This question</a> might be of interest to you as well. </p>

<p>The assumed <code>scriptSig</code>, where we don't know what combination of signatures we have:</p>

<pre><code>0 {sig1} {sig2}
</code></pre>

<p>The <code>scriptPubKey</code> would be a standard P2SH pub key script:</p>

<pre><code>OP_HASH160 {hash} EQUAL
</code></pre>

<p>The <code>redeemScript</code> (in this P2SH transaction) might look something like:</p>

<pre><code>3DUP 2 {A_pub} {B_pub} 2 CHECKMULTISIG DUP NOTIF
    3DUP 2 {C_pub} {D_pub} 2 CHECKMULTISIG DUP NOTIF
        3DUP 2 {A_pub} {D_pub} 2 CHECKMULTISIG 
    ENDIF 
ENDIF
</code></pre>

<p>I believe this would work, but if someone could check the logic of this script here, I'd appreciate it. The <code>OP_3DUP</code> is necessary because the <code>scriptSig</code> should have 3 items on it already (2 signatures and the OP_0 to satisfy the off-by-1 error in the original client), and those 3 items need to be used more than once.</p>

CC BY-SA 3.0
2014-10-29T15:15:23.390Z
Sorry - you are right I messed up A, B, C, and D. The question is still valid, but with the key names from the question the oracle should hold B and C.
user599464
CC BY-SA 3.0
2014-10-29T15:16:31.087Z
Can you edit the question to have exactly what you mean? Thanks!
morsecoder
CC BY-SA 3.0
2014-10-29T16:25:16.443Z
In my opinion the question is fine? An answer to this questions is at the same time an answer how this usecase can be handled. Or do you think I should ask for a solution for the usecase? That would be a different questions in my opinion.
user599464
CC BY-SA 3.0
2014-10-29T16:37:55.130Z
I think my response answered the question you asked. Not sure what you mean by "how this usecase can be handled", but that soundsl like it might be a different question.
morsecoder
CC BY-SA 3.0
2014-10-28T00:19:50.200Z
https://www.realitykeys.com/
Is would be possible for an oracle to release ether key C or D. Now A OR B could access the funds. The oracle can never access the funds AND it does not need to have to know about Alice and Bob or about the transaction. It only releases a key.
user599464
CC BY-SA 3.0
2014-10-28T00:28:36.830Z
But if the oracle has keys C and D then they will be able to spend it? And I think your configurations might have been a little off in the original question, wouldn't you be looking for any of these combinations: (A,B), (A,D), (B,C)? That way the oracle can release either D or C and doesn't have to actually go through the pains of signing the transaction.
morsecoder
CC BY-SA 3.0
2014-10-26T12:22:38.710Z
2014-10-27T02:52:12.320Z
2017-04-13T12:47:36.647Z
morsecoder
<p>Is it in theory possible to set up a 2 out of 4 multi-sig transaction, but only allow a subset of all possible combinations?</p>

<p>More concrete: I want to have the keys A, B, C, D.</p>

<ul>
<li>Alice controls A</li>
<li>Bob controls B</li>
<li>Charlie controls C</li>
<li>Dennis controls D</li>
</ul>

<p>There are six ways to select 2 items from 4 items. However, the only valid combinations should be:</p>

<ul>
<li>A, B</li>
<li>C, D</li>
<li>A, D</li>
</ul>

CC BY-SA 3.0
2014-10-29T15:17:22.720Z
This is a usecase for the question: It would be possible for an oracle to release ether key B or C. Now A OR D could access the funds. The oracle can never access the funds AND it does not need to have to know about Alice and Dennis or about the transaction. It only releases a key.
user599464
CC BY-SA 3.0
2014-10-24T04:57:22.317Z
Minor justification: there are *six* ways to select 2 from 4.
Maǳi Koǌo
CC BY-SA 3.0
2014-10-26T15:09:13.223Z
@MaǳiKoǌo Good point. We don't care about the difference between A, B and B, A.
Nick ODell
<multi-signature>
Two out of Four transaction with excluding some key pairs
user599464
# Two out of Four transaction with excluding some key pairs

(Asked by: username_0 on 2014-10-15)

Is it in theory possible to set up a 2 out of 4 multi-sig transaction, but only allow a subset of all possible combinations?

More concrete: I want to have the keys A, B, C, D.

* Alice controls A
* Bob controls B
* Charlie controls C
* Dennis controls D

There are six ways to select 2 items from 4 items. However, the only valid combinations should be:

* A, B
* C, D
* A, D

**Tags:** multi-signature

> **Comments:**
> **username_1**: Minor justification: there are *six* ways to select 2 from 4.  
> **username_2**: @MaǳiKoǌo Good point. We don't care about the difference between A, B and B, A.  
> **username_0**: This is a usecase for the question: It would be possible for an oracle to release ether key B or C. Now A OR D could access the funds. The oracle can never access the funds AND it does not need to have to know about Alice and Dennis or about the transaction. It only releases a key.  

---

## 1 answers

### Answer by username_3 on 2014-10-26. Score: 2 | Accepted answer

Out of curiosity, what's the use case for a configuration like this? 
Is it possible to do this using the bitcoin scripting language? Yes, absolutely. Making it and actually having it included into a block is questionable, mainly because it would be a non standard transaction type. 
There aren't really a lot of tools to help you do it, though. I can describe what the scripts would have to look like, but not sure how you would actually make such a transaction. This question might be of interest to you as well. 
The assumed scriptSig, where we don't know what combination of signatures we have:
0 {sig1} {sig2}

The scriptPubKey would be a standard P2SH pub key script:
OP_HASH160 {hash} EQUAL

The redeemScript (in this P2SH transaction) might look something like:
3DUP 2 {A_pub} {B_pub} 2 CHECKMULTISIG DUP NOTIF
    3DUP 2 {C_pub} {D_pub} 2 CHECKMULTISIG DUP NOTIF
        3DUP 2 {A_pub} {D_pub} 2 CHECKMULTISIG 
    ENDIF 
ENDIF

I believe this would work, but if someone could check the logic of this script here, I'd appreciate it. The OP_3DUP is necessary because the scriptSig should have 3 items on it already (2 signatures and the OP_0 to satisfy the off-by-1 error in the original client), and those 3 items need to be used more than once.

> **Comments:**
> **username_0**: https://www.realitykeys.com/ Is would be possible for an oracle to release ether key C or D. Now A OR B could access the funds. The oracle can never access the funds AND it does not need to have to know about Alice and Bob or about the transaction. It only releases a key.  
> **username_3**: But if the oracle has keys C and D then they will be able to spend it? And I think your configurations might have been a little off in the original question, wouldn't you be looking for any of these combinations: (A,B), (A,D), (B,C)? That way the oracle can release either D or C and doesn't have to actually go through the pains of signing the transaction.  
> **username_0**: Sorry - you are right I messed up A, B, C, and D. The question is still valid, but with the key names from the question the oracle should hold B and C.  
> **username_3**: Can you edit the question to have exactly what you mean? Thanks!  
> **username_0**: In my opinion the question is fine? An answer to this questions is at the same time an answer how this usecase can be handled. Or do you think I should ask for a solution for the usecase? That would be a different questions in my opinion.  
> **username_3**: I think my response answered the question you asked. Not sure what you mean by "how this usecase can be handled", but that soundsl like it might be a different question.  

---

