2

Two participants in a transaction, a buyer and a seller, need to interact financially. For security, they themselves keep their private keys and sign transactions on client using JS.

I want to create a 2 in 3 multi-sig address, i.e: "3...", and have the buyer pay to this address. When a confirmation is received for the acceptance of BTC I will tell the seller to ship product. When it physically arrives to the buyer - he will approve getting the product and sign the multi-sig transaction. In case any dispute site admin will have the third private key to resolve any issue.

My question is how to implement this on my site. There are many open source JS Bitcoin libraries supporting multi-sig out there. There is copay/bitpay api, bitgo, gem.co, coinb.in outcast3k, bitvault, coin kite. Not much online about how to properly go about doing this.

The best implementation I have seen is taking place on http://www.coincola.com/

Anyone can help clearing the fog here?

1 Answer 1

1

Most of the libraries you mentioned would work for this problem. However, some are built more like libraries to be called from other javascript (eg. BitcoinJS), while others are designed with a full user interface so a semi-technical user can host multisig signing functionality on their browser (eg Copay). Some options you mentioned are also multisig wallet services which require you have an account with them, and they are taking care of some of the nitty gritty of multisig (eg. BitGo). Since you are trying to build your own e-commerce site around multisig, where one key is always some key you control, you probably want a library you can call in your code, without a user interface.

Without commenting on the suitability of each and every library option, I will say that BitcoinJS can do what you need here. They provide a set of library functions that can create multisig addresses with any set of public keys and M-of-N requirements as well as signing functionality to sign those with private keys (which your buyer and seller could do on a browser hosted solution you provide or own their own).

See BitcoinJS's example for creating a 2-of-3 P2SH address, creating a transanction (to fund your multisig address) and spending from a 2-of-2 multisig address (you will need to modify to spend from a 2-of-3 address).

Bitcore by Bitpay (which Copay is built on) can also create multisig addresses and sign/create transanctions: https://github.com/bitpay/bitcore. You can use it in the browser with bower for easy setup, and their API is very well documented. You can see their example for generating a multisig address.

With all of that said, be very careful with your implementation. This is people's money and you don't want to be introducing vulnerabilities that loses people their money (or yours). If you don't feel comfortable with the security implications of your design decisions, create example demonstration versions and have them well vetted by more experienced people before bringing them into production.

2
  • Thanks Sjpour, for the detailed answer. I started zooming in on copay. Seems very well documented. As someone that integrated a lot of credit card Apis ten years back and taking your comments for being careful, I must say that integrating Bitcoin securily and openly (where user hold private key) is much more complicated to integrate then legacy payment systems.
    – Ami
    Dec 28, 2014 at 8:49
  • It is more complicated Ami, but please note: 1) It's early days. Many more services will come online in the next few years and existing services will get more sophisticated. Bitcoin is arguably at the same stage as the Internet was in 1994/1995. 2) What's fundamentally different is that Bitcoin is a cash-like, push system where actual value moves. Fiat payment systems are simply doing bookkeeping. They are defrauded all the time, but since there is a central processor (Visa) and issuer (central banks), they can reverse transactions. This is convenient but very costly to the overall network.
    – soroushjp
    Dec 28, 2014 at 9:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.