<p>Because it's possible to only partially sign a transaction (for example only one input) and then give that unfinished transaction to another party, who can then finish the transaction with their signature (for another input). Parties do not need to reveal their private keys to each other at all.</p>

<p>Only after all parties signed can the transaction be sent to the bitcoin network. A partially signed transaction would always be refused.</p>

CC BY-SA 3.0
2015-11-11T09:45:16.467Z
And this principle is used in CoinJoin, which is specifically designed to improve privacy by thwarting the assumption in the question.
Pieter Wuille
CC BY-SA 3.0
2015-11-11T09:47:18.123Z
Good point! It's still a fair assumption to make, isn't it? Ie how likely could it be that the partially signed Txs are not funded with inputs from immediately related parties/stakeholders?
Wizard Of Ozzie
CC BY-SA 3.0
2015-11-11T10:02:29.447Z
@WizardOfOzzie If the transaction you are looking at is interesting enough to investigate, it's more likely that it was also more important for the sending party to try to anonymize it through CoinJoin as Pieter mentioned.
Jannes
CC BY-SA 3.0
2015-11-11T09:43:09.027Z
2015-11-11T09:43:09.027Z
Jannes
<p>From <a href="http://bitcoin-class.org/ps/ps3/" rel="nofollow noreferrer">question 3 in a project titled <em>Blockchain: CSI</em></a> (in what looks like a <em><strong>very cool</strong></em> class, run by University of Virginia!):</p>
<blockquote>
<p>Problem 3. The Heuristic 1 (Section 4.3) used to detemine sets of public addresses owned by the same entity is based on the assumption that all inputs to a bitcoin transaction are controlled by the same entity. According to the paper, “<em><strong>the sender in the transaction must know the private signing key belonging to each public key used as an input, so it is unlikely that the collection of public keys are controlled by multiple entities</strong></em> (as these entities would need to reveal their private keys to each other).” Explain why this is not actually true. (A good answer will consider in more detail what is needed in the unlocking script to spend each input.)</p>
</blockquote>
<p>How is this a flawed assumption?</p>

<blockchain><privacy>
Why would a Tx's inputs not be assumed to be owned by a single service?
Wizard Of Ozzie
# Why would a Tx's inputs not be assumed to be owned by a single service?

(Asked by: username_0 on 2015-11-11)

From [question 3 in a project titled *Blockchain: CSI*](http://bitcoin-class.org/ps/ps3/) (in what looks like a ***very cool*** class, run by University of Virginia!):

> Problem 3. The Heuristic 1 (Section 4.3) used to detemine sets of public addresses owned by the same entity is based on the assumption that all inputs to a bitcoin transaction are controlled by the same entity. According to the paper, “***the sender in the transaction must know the private signing key belonging to each public key used as an input, so it is unlikely that the collection of public keys are controlled by multiple entities*** (as these entities would need to reveal their private keys to each other).” Explain why this is not actually true. (A good answer will consider in more detail what is needed in the unlocking script to spend each input.)

How is this a flawed assumption?

**Tags:** blockchain, privacy


---

## 1 answers

### Answer by username_1 on 2015-11-11. Score: 3

Because it's possible to only partially sign a transaction (for example only one input) and then give that unfinished transaction to another party, who can then finish the transaction with their signature (for another input). Parties do not need to reveal their private keys to each other at all.

Only after all parties signed can the transaction be sent to the bitcoin network. A partially signed transaction would always be refused.

> **Comments:**
> **username_2**: And this principle is used in CoinJoin, which is specifically designed to improve privacy by thwarting the assumption in the question.  
> **username_0**: Good point! It's still a fair assumption to make, isn't it? Ie how likely could it be that the partially signed Txs are not funded with inputs from immediately related parties/stakeholders?  
> **username_1**: @username_0 If the transaction you are looking at is interesting enough to investigate, it's more likely that it was also more important for the sending party to try to anonymize it through CoinJoin as username_2 mentioned.  

---

