<p>Yes and no.</p>

<p>In a bare multisig pubkey script, the public keys are not hashed.  For example, a 2-of-3 pubkey script would look like:</p>

<pre><code>2 &lt;pubkey1&gt; &lt;pubkey2&gt; &lt;pubkey3&gt; 3 OP_CHECKMULTISIG
</code></pre>

<p>In a multisig pay-to-script-hash (P2SH) script, the whole redeem script---including the public keys---would be hashed.  For example, the redeem script would be the same as above, but the actual pubkey script would be:</p>

<pre><code>OP_HASH160 &lt;Hash160(redeemScript)&gt; OP_EQUAL
</code></pre>

<p>Almost all multisig transactions on the network currently use P2SH multisig.</p>

<p>As an aside, although there is some hypothetical security increase from hashing public keys in case of a major problem with ECDSA, the main reason for hashing public keys is to create short addresses.</p>

CC BY-SA 3.0
2014-12-10T11:25:59.390Z
This is very useful, thanks. Just for clarification, with P2SH, the public keys within the redeemScript will only be public keys, not public key hashes if it is a multi-sig script? Is there no way to do multi-sig without exposing unhashed public keys at some point?
Dan
CC BY-SA 3.0
2014-12-10T12:47:15.970Z
Correct.  Also, there's no way to do any transaction secured with public key crypto without exposing the unhashed public keys at some point.  In regular P2PKH, you reveal the unhashed keys in the signature script---the same as you do with P2SH.  Also noteworthy: your public key can be reconstructed from your ECDSA signature in the signature script, although Bitcoin doesn't currently use this for anything.
David A. Harding
CC BY-SA 3.0
2014-12-10T03:28:23.810Z
2014-12-10T03:28:23.810Z
David A. Harding
<p>Typically, you will use P2SH (pay to script hash) for multisig transactions, which means the transaction output does not contain the full script (with full public keys), but instead a hash of that script - and the full script is revealed when spending. See BIP16 for more information.</p>

<p>When this is done, you get the same effect: the transaction output does not contain a public key directly.</p>

<p>Note that there is indeed a  small security benefit to this (it takes 2^160 steps in theory to reverse the hash function, while it takes 2^128 steps to find a private key for a given public key), but there are larger advantages (like the sender not needing to know the full script, and less data in the database of unspent transaction outputs that every full node maintains).</p>

CC BY-SA 3.0
2014-12-10T03:27:46.753Z
2014-12-10T03:27:46.753Z
Pieter Wuille
<p>Pay to public key hash scripts hash the recipients public key for added security.</p>

<p>Is the same done with the public keys that make up part of a multisig script?</p>

<p><a href="https://en.bitcoin.it/wiki/Script" rel="nofollow">https://en.bitcoin.it/wiki/Script</a> doesn't seem to indicate they are.</p>

<transactions><multi-signature>
Are the keys in a multisig transaction output hashed?
Dan
# Are the keys in a multisig transaction output hashed?

(Asked by: username_0 on 2014-12-10)

Pay to public key hash scripts hash the recipients public key for added security.

Is the same done with the public keys that make up part of a multisig script?

<https://en.bitcoin.it/wiki/Script> doesn't seem to indicate they are.

**Tags:** transactions, multi-signature


---

## 2 answers

### Answer by username_1 on 2014-12-10. Score: 3 | Accepted answer

Yes and no.

In a bare multisig pubkey script, the public keys are not hashed. For example, a 2-of-3 pubkey script would look like:

```
2 <pubkey1> <pubkey2> <pubkey3> 3 OP_CHECKMULTISIG

```

In a multisig pay-to-script-hash (P2SH) script, the whole redeem script---including the public keys---would be hashed. For example, the redeem script would be the same as above, but the actual pubkey script would be:

```
OP_HASH160 <Hash160(redeemScript)> OP_EQUAL

```

Almost all multisig transactions on the network currently use P2SH multisig.

As an aside, although there is some hypothetical security increase from hashing public keys in case of a major problem with ECDSA, the main reason for hashing public keys is to create short addresses.

> **Comments:**
> **username_0**: This is very useful, thanks. Just for clarification, with P2SH, the public keys within the redeemScript will only be public keys, not public key hashes if it is a multi-sig script? Is there no way to do multi-sig without exposing unhashed public keys at some point?  
> **username_1**: Correct.  Also, there's no way to do any transaction secured with public key crypto without exposing the unhashed public keys at some point.  In regular P2PKH, you reveal the unhashed keys in the signature script---the same as you do with P2SH.  Also noteworthy: your public key can be reconstructed from your ECDSA signature in the signature script, although Bitcoin doesn't currently use this for anything.  

---

### Answer by username_2 on 2014-12-10. Score: 3

Typically, you will use P2SH (pay to script hash) for multisig transactions, which means the transaction output does not contain the full script (with full public keys), but instead a hash of that script - and the full script is revealed when spending. See BIP16 for more information.

When this is done, you get the same effect: the transaction output does not contain a public key directly.

Note that there is indeed a small security benefit to this (it takes 2^160 steps in theory to reverse the hash function, while it takes 2^128 steps to find a private key for a given public key), but there are larger advantages (like the sender not needing to know the full script, and less data in the database of unspent transaction outputs that every full node maintains).


---

