--- bip: 124 title: "Hierarchical Deterministic Script Templates" status: Closed type: Informational layer: "Applications" authors: ["Eric Lombrozo","William Swanson"] assigned: 2015-11-20 last_modified: 2025-10-08 topics: ["wallets"] license: "PD" url: https://bipexplorer.com/bip/124 source: https://github.com/bitcoin/bips/blob/master/bip-0124.mediawiki --- # BIP 124: Hierarchical Deterministic Script Templates > **In plain English:** Defines a template format that lets wallets automatically generate scripts with specific spending rules, such as multisignature, from HD wallet keys. Shared templates help different wallets produce matching addresses for the same arrangement of keys. ## Abstract This BIP defines a script template format that can be used by wallets to deterministically generate scripts with specific authorization policies using the key derivation mechanism defined in BIP32. ## Motivation Currently existing wallets typically issue scripts in only a tiny handful of widely used formats. The most popular formats are pay-to-pubkey-hash and m-of-n pay-to-script-hash (BIP16). However, different wallets tend to use mutually incompatible derivation schemes to generate signing keys and construct scripts from them. Moreover, with the advent of hashlocked and timelocked contracts (BIP65, BIP112), it is necessary for different wallets to be able to cooperatively generate even more sophisticated scripts. In addition, there's a lot of ongoing work in the development of multilayered protocols that use the blockchain as a settlement layer (i.e. the Lightning Network). These efforts require sufficiently generalized templates to allow for rapidly evolving script designs. This BIP provides a generalized format for constructing a script template that guarantees that different wallets will all produce the same scripts for a given set of derivation paths according to BIP32. ## Specification ### Keys An individual key is determined by a BIP32 derivation path and an index. For convenience, we introduce the following notation: **A**k = (derivation path for A)/k ### Key Groups Let **m**i denote distinct BIP32 derivation paths. We define a key group of n keys as a set of key derivation paths with a free index k: {**K**k} = { **m**1/k, **m**2/k, **m**3/k, ..., **m**n/k } Key groups are useful for constructing scripts that are symmetric in a set of keys. Scripts are symmetric in a set of keys if the semantics of the script is unaffected by permutations of the keys. Key groups enforce a canonical form and can improve privacy. ### Sorting We define a lexicographic sorting of the keys. (TODO: specification of sorting conventions - compressed pubkeys, encoding, etc...) Define {**K**k}j to be the jth element of the sorted keys for derivation index k. ### Script Templates We construct script templates by inserting placeholders for data into a script. To denote a placeholder, we use the following notation: _Script_(**A**) = opcodes \[**A**\] opcodes We extend this notation to an arbitrary number of placeholders: _Script_(**X1**, **X2**, ..., **Xn**) = opcodes \[**X1**\] opcodes \[**X2**\] opcodes ... opcodes \[**Xn**\] opcodes We introduce the following convenient notation for sorted key groups: \[{**K**k}\] = \[{**K**k}1\] \[{**K**k}2\] ... \[{**K**k}n\] ### Operations on Keys In some applications, we might want to insert the result of some operation performed on a key rather than the key itself into the script. For example, we might want to insert a Hash160 of key **A**k. We can use the following notation: \[_Hash160_(**A**k)\] ### Encoding TODO ## Examples ### 2-of-3 Multisig The script template is defined by: _Script_(**X**) = 2 \[**X**\] 3 OP\_CHECKMULTISIG Letting **K**k = { **m**1/k, **m**2/k, **m**3/k }, the _k_th script for this key group is denoted by _Script_({**K**k}). ### 1-of-1 or 2-of-3 The script template is defined by: _Script_(**A**, **B**) =         OP\_DUP \[**A**\] OP\_CHECKSIG         OP\_NOTIF                 2 \[**B**\] 3 OP\_CHECKMULTISIGVERIFY         OP\_NOTIF         OP\_ENDIF         OP\_TRUE Let **M**k = **m**/k be a key of a superuser that can authorize all transactions and {**K**k} be a key group of three users that can only authorize transactions if at least two of them agree. The _k_th script is given by _Script_(**M**k, {**K**k}). ### Timelocked Contract The output is payable to Alice immediately if she knows the private key for **A**k. Bob must know the private key for **B**k and also wait for a timeout **t** before being able to spend the output. The script template is defined by: _Script_(**A**, **B**, **T**) =         OP\_IF                 OP\_DUP OP\_HASH160 \[_Hash160_(**A**)\] OP\_EQUALVERIFY OP\_CHECKSIG         OP\_ELSE                 \[**T**\] OP\_CHECKLOCKTIMEVERIFY OP\_DROP                 OP\_DUP OP\_HASH160 \[_Hash160_(**B**)\] OP\_EQUALVERIFY OP\_CHECKSIG         OP\_ENDIF The _k_th script with timeout **t** is given by _Script_(**A**k, **B**k, **t**). ## References - [BIP16 - Pay to Script Hash](https://bipexplorer.com/bip/16) - [BIP32 - Hierarchical Deterministic Wallets](https://bipexplorer.com/bip/32) - [BIP65 - OP\_CHECKLOCKTIMEVERIFY](https://bipexplorer.com/bip/65) - [BIP112 - CHECKSEQUENCEVERIFY](https://bipexplorer.com/bip/112) - [Lightning Network Whitepaper](https://lightning.network/lightning-network-paper.pdf) ## Copyright This document is placed in the public domain.