<blockquote>
<p>My question is that why does the locking script for multsig address contain their public keys instead of PubKeyHashes(addresses)?</p>
</blockquote>
<p>Why would it?</p>
<p>The reason for using a hash of the public key in P2PKH is because it resulted in shorter addresses (in Satoshi's time, before compressed public keys, public keys were 65 bytes, so using a 20-byte hash was significantly shorter). Such an argument does not exist for bare multisig, because there <strong>exists</strong> no address for bare multisig.</p>
<p>In P2SH (or P2WSH) multisig, the issue does not apply either, because what is given to the sender is an address that only contains a <em>hash</em> of the locking script. Whether or not that script uses pubkeys or pubkey hashes does not affect the size of that hash. Using an additional redirection inside the script there would also just be a waste of resources (because at spend time, both the pubkey hashes (inside the locking script) and the full public keys (as inputs to it) would need to be passed).</p>
<blockquote>
<p>And also isn't it dangerous for the receiving party(multsig owners) to reveal their public keys to senders</p>
</blockquote>
<p>There are certain cases where the senders will know the receiver's public keys, but in general, this is not the case. As said, no bare multisig address type exists, so most commonly, P2SH or P2WSH multisig is used. In that case, the sender only receives the script hash from the recipient.</p>
<p>Regarding the security reduction, my own (and apparently somewhat controversial) opinion is that the pubkey hashing does not meaningfully contribute to Bitcoin's security, and while it is frequently repeated, this is cargo cult. Reasons are:</p>
<ul>
<li>If ECDSA is broken, any attacker cooperating with miners can already exploit it (because unconfirmed transactions reveal public keys).</li>
<li>Millions of BTC are stored in outputs with publicly known public keys. You can't realistically hope that BTC holds any value after it's assumed ECDSA is broken (as long as ECDSA is commonly used).</li>
<li>Tons of interesting use cases involve revealing public keys to other parties (such as Lightning, or even just multisig <em>between the signers</em>). If we were seriously concerned about ECDSA's security, we shouldn't just be discouraging these, but going as far as outlawing them. That doesn't happen, because ECDSA is part of Bitcoin's security assumptions. Dealing with it being broken is done by migrating to something else, not by patching it up.</li>
</ul>
<p>There are other answers on this site which go into more detail about it.</p>

CC BY-SA 4.0
2021-10-12T10:49:29.287Z
Thanks for clarification!
Pranay Reddy
CC BY-SA 4.0
2021-10-11T19:06:05.557Z
2021-10-11T19:06:05.557Z
Pieter Wuille
<p>I am reading &quot;Mastering Bitcoin&quot; by Andreas Antonopoulos. In the transactions section, the locking script for normal account(single address) is</p>
<p><code>OP_DUP OP_HASH160 &lt;Cafe Public Key Hash&gt; OP_EQUALVERIFY OP_CHECKSIG</code></p>
<p>Which I'm sure that <code>&lt;Cafe Public Key Hash&gt;</code> is the address of the recipient. But the locking script for multsig account is,</p>
<p><code>2 &lt;Public Key A&gt; &lt;Public Key B&gt; &lt;Public Key C&gt; 3 CHECKMULTISIG</code></p>
<p>My question is that why does the locking script for multsig address contain their public keys instead of PubKeyHashes(addresses)? And also isn't it dangerous for the receiving party(multsig owners) to reveal their public keys to senders..Long shot but if ECDSA breaks, they can't be secure with SHA256 and RIPEMD160 right?</p>

CC BY-SA 4.0
2021-10-10T16:34:18.677Z
Are you talking about *bare* multisig (where the locking script with pubkeys goes into the scriptPubKey directly), or about P2SH/P2WSH multisig, where the scriptPubKey only contains a hash of the locking script? Both are possible, but the former is very uncommon (as it doesn't have a corresponding address type, so most wallets can't be instructed to create such outputs).
Pieter Wuille
CC BY-SA 4.0
2021-10-11T04:50:03.873Z
Yes, I'm aware of P2SH addresses of the multsig scipt. But I'm interested in knowing why the underlying raw script has PubKeys instead of addresses.
Pranay Reddy
<transactions><security><script><multi-signature><public-key>
Why does the locking script for MultSig contain PubKeys instead of PubKeyHash?
Pranay Reddy
# Why does the locking script for MultSig contain PubKeys instead of PubKeyHash?

(Asked by: username_0 on 2021-10-10)

I am reading "Mastering Bitcoin" by Andreas Antonopoulos. In the transactions section, the locking script for normal account(single address) is

`OP_DUP OP_HASH160 <Cafe Public Key Hash> OP_EQUALVERIFY OP_CHECKSIG`

Which I'm sure that `<Cafe Public Key Hash>` is the address of the recipient. But the locking script for multsig account is,

`2 <Public Key A> <Public Key B> <Public Key C> 3 CHECKMULTISIG`

My question is that why does the locking script for multsig address contain their public keys instead of PubKeyHashes(addresses)? And also isn't it dangerous for the receiving party(multsig owners) to reveal their public keys to senders..Long shot but if ECDSA breaks, they can't be secure with SHA256 and RIPEMD160 right?

**Tags:** transactions, security, script, multi-signature, public-key

> **Comments:**
> **username_1**: Are you talking about *bare* multisig (where the locking script with pubkeys goes into the scriptPubKey directly), or about P2SH/P2WSH multisig, where the scriptPubKey only contains a hash of the locking script? Both are possible, but the former is very uncommon (as it doesn't have a corresponding address type, so most wallets can't be instructed to create such outputs).  
> **username_0**: Yes, I'm aware of P2SH addresses of the multsig scipt. But I'm interested in knowing why the underlying raw script has PubKeys instead of addresses.  

---

## 1 answers

### Answer by username_1 on 2021-10-11. Score: 2 | Accepted answer

> My question is that why does the locking script for multsig address contain their public keys instead of PubKeyHashes(addresses)?

Why would it?

The reason for using a hash of the public key in P2PKH is because it resulted in shorter addresses (in Satoshi's time, before compressed public keys, public keys were 65 bytes, so using a 20-byte hash was significantly shorter). Such an argument does not exist for bare multisig, because there **exists** no address for bare multisig.

In P2SH (or P2WSH) multisig, the issue does not apply either, because what is given to the sender is an address that only contains a *hash* of the locking script. Whether or not that script uses pubkeys or pubkey hashes does not affect the size of that hash. Using an additional redirection inside the script there would also just be a waste of resources (because at spend time, both the pubkey hashes (inside the locking script) and the full public keys (as inputs to it) would need to be passed).

> And also isn't it dangerous for the receiving party(multsig owners) to reveal their public keys to senders

There are certain cases where the senders will know the receiver's public keys, but in general, this is not the case. As said, no bare multisig address type exists, so most commonly, P2SH or P2WSH multisig is used. In that case, the sender only receives the script hash from the recipient.

Regarding the security reduction, my own (and apparently somewhat controversial) opinion is that the pubkey hashing does not meaningfully contribute to Bitcoin's security, and while it is frequently repeated, this is cargo cult. Reasons are:

* If ECDSA is broken, any attacker cooperating with miners can already exploit it (because unconfirmed transactions reveal public keys).
* Millions of BTC are stored in outputs with publicly known public keys. You can't realistically hope that BTC holds any value after it's assumed ECDSA is broken (as long as ECDSA is commonly used).
* Tons of interesting use cases involve revealing public keys to other parties (such as Lightning, or even just multisig *between the signers*). If we were seriously concerned about ECDSA's security, we shouldn't just be discouraging these, but going as far as outlawing them. That doesn't happen, because ECDSA is part of Bitcoin's security assumptions. Dealing with it being broken is done by migrating to something else, not by patching it up.

There are other answers on this site which go into more detail about it.

> **Comments:**
> **username_0**: Thanks for clarification!  

---

