BIP 11 M-of-N Standard Transactions Explained

This guide explains BIP 11 M-of-N transactions in plain English. It covers the problem behind the BIP, why it matters and whether the proposal is part of Bitcoin today.

What M-of-N mean

N public keys are committed in the locking script and the spending condition requires at least M valid signatures. A two-of-three policy can tolerate one unavailable key while preventing a single key from spending. The arithmetic says nothing about who controls each key, how devices are separated or how recovery is governed; those remain custody-design decisions.

Bare multisignature script

The output script places M, the public keys, N and CHECKMULTISIG directly on chain. A spender supplies the required signatures plus the historical dummy stack item consumed by CHECKMULTISIG. Every node sees the complete key set at funding time. This is distinct from script-hash designs that reveal the redeeming policy only when an output is spent.

Standardness versus consensus

BIP 11 changed the standard transaction policy used for relay and mining, within scripts that consensus could already evaluate. A non-standard transaction can still be consensus valid if a miner includes it. Wallets should not rely on that distinction casually: weak relay support can make a valid transaction difficult to propagate or fee-bump during an incident.

Key-count and sigop constraints

The proposal constrained bare multisig to small key counts to limit signature-operation cost and encourage predictable relay. CHECKMULTISIG contributes sigops that block construction must count. A transaction fitting the weight limit can still violate sigop constraints. Template builders validate the complete script and resource rules rather than estimating only bytes or fee rate.

A wallet policy limit may be stricter again, so relay, block validity and product support should be reported separately.

Why P2SH became preferable

P2SH lets the funding output commit to a script hash and uses a compact address, moving the full redeem script into the spending input. It improved sender usability and deferred script data. Native SegWit and Taproot later changed cost and privacy trade-offs again. Bare BIP 11 output is therefore historical context, not the default modern multisig recommendation.

Custody risks beyond the script

Cosigners need independent keys, verified wallet policy, secure backups, change recognition and a tested recovery quorum. Malware can propose an authorised but fraudulent destination to every signer. A coordinator can withhold data or reorder keys. Each hardware display should verify the transaction, while descriptors record key origins, script type and derivation paths.

How specialists test it

Developers test the proposal with made-up data on an isolated test network. They check normal cases and deliberately invalid cases. Different implementations should reach the same result before anyone relies on the proposal.

Conclusion

BIP 11 established practical standard bare multisignature relay, but modern multisig should use a supported script wrapper, explicit descriptors and independently verified custody controls. The M-of-N equation is only one layer of a recoverable signing system.