Can I sign multisig transaction only with private key in a descriptor based wallet?

Question

I created a multisig wallet using bdk. It seems to accept descriptor with owner wallet's private key and other participating wallet's public key. Is it possible to create a multisig wallet where only one wallet can create transaction and will get access to other's public keys but other wallets don't need other participant's public keys for signing the transaction?

For example, If I create a 2 of 3 multisig with participants A,B,C. I created transaction with A who has access to public keys of both B and C using descriptor thresh(key(A_xprv),key(B_xpub),key(C_xpub) . Can I sign the transaction with B with only with its private key if it does not have access to public keys of A and C? I'm unable to create a descriptor which can sign the transaction for B without requiring public keys of A and C.

Answer 1

All public keys or redeem script/witness script is required to sign the transaction when spending bitcoin multisig UTXO.

An experiment to see if you can sign the transaction without public keys:

1. Run bitcoind -signet=1 -rpcport=38332 -rpcuser=user -rpcpassword=password

2. Create 3 wallets m1, m2 and m3

   $ bitcoin-cli -named createwallet wallet_name=m1 descriptors=false
   

3. Get 3 public keys from each wallet:

   $ bitcoin-cli -rpcwallet=m1 getnewaddress
   
   tb1q8hz93lwkmzjq2yapxr6mnsfwjt5wvp2f5zgm98
   
   $ bitcoin-cli -rpcwallet=m1 getaddressinfo tb1q8hz93lwkmzjq2yapxr6mnsfwjt5wvp2f5zgm98
   
   {
     "address": "tb1q8hz93lwkmzjq2yapxr6mnsfwjt5wvp2f5zgm98",
     "scriptPubKey": "00143dc458fdd6d8a40513a130f5b9c12e92e8e60549",
     "ismine": true,
     "solvable": true,
     "desc": "wpkh([045471ed/0'/0'/1']039927842080cc4a22d2d4a63c13b3d9a66564e230775981f03976787afe6cf716)#wht4f5zk",
     "iswatchonly": false,
     "isscript": false,
     "iswitness": true,
     "witness_version": 0,
     "witness_program": "3dc458fdd6d8a40513a130f5b9c12e92e8e60549",
     "pubkey": "039927842080cc4a22d2d4a63c13b3d9a66564e230775981f03976787afe6cf716",
     "ischange": false,
     "timestamp": 1663309171,
     "hdkeypath": "m/0'/0'/1'",
     "hdseedid": "ccd54fe6a42efde5251f8443f1edd7ebcf25fefa",
     "hdmasterfingerprint": "045471ed",
     "labels": [
       ""
     ]
   }
   

4. Create 2 of 3 multisig with the public keys:

   $ bitcoin-cli createmultisig 2 "[\"039927842080cc4a22d2d4a63c13b3d9a66564e230775981f03976787afe6cf716\",\"0359591df29bbcdb8fb2e4cde5d92ecc8c6698d9f0ab27f2f76938cdddc2323279\",\"037e44526a83fdb2c89de80356eeda1bbfdb3738a1b3b70c3c71ea95feaeec4046\"]"
   
   {
     "address": "2N7WpySLj8bBGFrZE8hxQUm29ZCwaqz5FvT",
     "redeemScript": "5221039927842080cc4a22d2d4a63c13b3d9a66564e230775981f03976787afe6cf716210359591df29bbcdb8fb2e4cde5d92ecc8c6698d9f0ab27f2f76938cdddc232327921037e44526a83fdb2c89de80356eeda1bbfdb3738a1b3b70c3c71ea95feaeec404653ae",
     "descriptor": "sh(multi(2,039927842080cc4a22d2d4a63c13b3d9a66564e230775981f03976787afe6cf716,0359591df29bbcdb8fb2e4cde5d92ecc8c6698d9f0ab27f2f76938cdddc2323279,037e44526a83fdb2c89de80356eeda1bbfdb3738a1b3b70c3c71ea95feaeec4046))#jqk9dcqj"
   }
   

5. Send 0.001 sBTC to multisig address using signet faucet: 0b30a06e2653b84b0b976559a0efc9018a6da2a4ea6c71c346496d2ac36e43b5

6. Create a PSBT to spend this UTXO:

   $ bitcoin-cli createpsbt "[{\"txid\":\"0b30a06e2653b84b0b976559a0efc9018a6da2a4ea6c71c346496d2ac36e43b5\",\"vout\":1}]" "[{\"tb1qvl3a3l8ejuyk62qfz2kjjxdndcrk99ldxchqvx\":\"0.0009\"}]" 
   
   cHNidP8BAFICAAAAAbVDbsMqbUlGw3Fs6qSibYoBye+gWWWXC0u4UyZuoDALAQAAAAD9////AZBfAQAAAAAAFgAUZ+PY/PmXCW0oCRKtKRmzbgdil+0AAAAAAAAA
   

7. You will get "complete": false in the output if you try signing it with any 2 wallets using walletprocesspsbt or individually sign, combine with combinepsbt followed by finalizepsbt

8. Import multisig address in m1, descriptor (has all public keys) in m2 and redeemscript in m3 wallet:

$ bitcoin-cli -rpcwallet=m1 importmulti '[{ "scriptPubKey": { "address": "2N7WpySLj8bBGFrZE8hxQUm29ZCwaqz5FvT" }, "timestamp":"now", "watchonly": true }]'

 [
   {
     "success": true
   }
 ]

$ bitcoin-cli -rpcwallet=m2 importmulti '[{ "desc": "sh(multi(2,039927842080cc4a22d2d4a63c13b3d9a66564e230775981f03976787afe6cf716,0359591df29bbcdb8fb2e4cde5d92ecc8c6698d9f0ab27f2f76938cdddc2323279,037e44526a83fdb2c89de80356eeda1bbfdb3738a1b3b70c3c71ea95feaeec4046))#jqk9dcqj", "timestamp":"now", "watchonly": true }]'

 [
   {
     "success": true
   }
 ]

$ bitcoin-cli -rpcwallet=m3 importmulti '[{ "scriptPubKey": "a9149c85346a6ea0c2b6c6904e5c464df6ef84fe170587", "redeemscript": "5221039927842080cc4a22d2d4a63c13b3d9a66564e230775981f03976787afe6cf716210359591df29bbcdb8fb2e4cde5d92ecc8c6698d9f0ab27f2f76938cdddc232327921037e44526a83fdb2c89de80356eeda1bbfdb3738a1b3b70c3c71ea95feaeec404653ae", "timestamp":"now", "watchonly": true }]'

 [
   {
     "success": true
   }
 ]

9. Try signing it with m1 and m2 or m1 and m3. It won't work.

   $ bitcoin-cli -rpcwallet=m1 walletprocesspsbt cHNidP8BAFICAAAAAbVDbsMqbUlGw3Fs6qSibYoBye+gWWWXC0u4UyZuoDALAQAAAAD9////AZBfAQAAAAAAFgAUZ+PY/PmXCW0oCRKtKRmzbgdil+0AAAAAAAAA
   {
     "psbt": "cHNidP8BAFICAAAAAbVDbsMqbUlGw3Fs6qSibYoBye+gWWWXC0u4UyZuoDALAQAAAAD9////AZBfAQAAAAAAFgAUZ+PY/PmXCW0oCRKtKRmzbgdil+0AAAAAAAEAcgIAAAABf9MjFLP83xBP8nl17j6VId+Y2UW/5seoLnxCqNnLOAcAAAAAAP7///8CMew0w1QGAAAWABRA3SSDttwD9s5g86KiG+bhufb1caCGAQAAAAAAF6kUnIU0am6gwrbGkE5cRk3274T+FwWH1qYBAAAA",
     "complete": false
   }
   
   $ bitcoin-cli -rpcwallet=m2 walletprocesspsbt cHNidP8BAFICAAAAAbVDbsMqbUlGw3Fs6qSibYoBye+gWWWXC0u4UyZuoDALAQAAAAD9////AZBfAQAAAAAAFgAUZ+PY/PmXCW0oCRKtKRmzbgdil+0AAAAAAAEAcgIAAAABf9MjFLP83xBP8nl17j6VId+Y2UW/5seoLnxCqNnLOAcAAAAAAP7///8CMew0w1QGAAAWABRA3SSDttwD9s5g86KiG+bhufb1caCGAQAAAAAAF6kUnIU0am6gwrbGkE5cRk3274T+FwWH1qYBAAAA
   {
     "psbt": "cHNidP8BAFICAAAAAbVDbsMqbUlGw3Fs6qSibYoBye+gWWWXC0u4UyZuoDALAQAAAAD9////AZBfAQAAAAAAFgAUZ+PY/PmXCW0oCRKtKRmzbgdil+0AAAAAAAEAcgIAAAABf9MjFLP83xBP8nl17j6VId+Y2UW/5seoLnxCqNnLOAcAAAAAAP7///8CMew0w1QGAAAWABRA3SSDttwD9s5g86KiG+bhufb1caCGAQAAAAAAF6kUnIU0am6gwrbGkE5cRk3274T+FwWH1qYBACICA1lZHfKbvNuPsuTN5dkuzIxmmNnwqyfy92k4zd3CMjJ5RzBEAiB1+POriSk9sPSZnMxkCE6oDKiLmYNW5KxuRN/q0nJJmgIgWM3ZX3ryJEDKhcyM4NI9wnLpMqkIXZwTueM33kYUysgBAQRpUiEDmSeEIIDMSiLS1KY8E7PZpmVk4jB3WYHwOXZ4ev5s9xYhA1lZHfKbvNuPsuTN5dkuzIxmmNnwqyfy92k4zd3CMjJ5IQN+RFJqg/2yyJ3oA1bu2hu/2zc4obO3DDxx6pX+ruxARlOuIgYDWVkd8pu824+y5M3l2S7MjGaY2fCrJ/L3aTjN3cIyMnkExzmGAiIGA35EUmqD/bLInegDVu7aG7/bNzihs7cMPHHqlf6u7EBGBIup2JAiBgOZJ4QggMxKItLUpjwTs9mmZWTiMHdZgfA5dnh6/mz3FgQ9xFj9AAA=",
     "complete": false
   }
   
   

   However, it will work with m2 and m3:

   $ bitcoin-cli -rpcwallet=m2 walletprocesspsbt cHNidP8BAFICAAAAAbVDbsMqbUlGw3Fs6qSibYoBye+gWWWXC0u4UyZuoDALAQAAAAD9////AZBfAQAAAAAAFgAUZ+PY/PmXCW0oCRKtKRmzbgdil+0AAAAAAAAA
   {
     "psbt": "cHNidP8BAFICAAAAAbVDbsMqbUlGw3Fs6qSibYoBye+gWWWXC0u4UyZuoDALAQAAAAD9////AZBfAQAAAAAAFgAUZ+PY/PmXCW0oCRKtKRmzbgdil+0AAAAAAAEAcgIAAAABf9MjFLP83xBP8nl17j6VId+Y2UW/5seoLnxCqNnLOAcAAAAAAP7///8CMew0w1QGAAAWABRA3SSDttwD9s5g86KiG+bhufb1caCGAQAAAAAAF6kUnIU0am6gwrbGkE5cRk3274T+FwWH1qYBACICA1lZHfKbvNuPsuTN5dkuzIxmmNnwqyfy92k4zd3CMjJ5RzBEAiB1+POriSk9sPSZnMxkCE6oDKiLmYNW5KxuRN/q0nJJmgIgWM3ZX3ryJEDKhcyM4NI9wnLpMqkIXZwTueM33kYUysgBAQRpUiEDmSeEIIDMSiLS1KY8E7PZpmVk4jB3WYHwOXZ4ev5s9xYhA1lZHfKbvNuPsuTN5dkuzIxmmNnwqyfy92k4zd3CMjJ5IQN+RFJqg/2yyJ3oA1bu2hu/2zc4obO3DDxx6pX+ruxARlOuIgYDWVkd8pu824+y5M3l2S7MjGaY2fCrJ/L3aTjN3cIyMnkExzmGAiIGA35EUmqD/bLInegDVu7aG7/bNzihs7cMPHHqlf6u7EBGBIup2JAiBgOZJ4QggMxKItLUpjwTs9mmZWTiMHdZgfA5dnh6/mz3FgQ9xFj9AAA=",
     "complete": false
   }
   
   $ bitcoin-cli -rpcwallet=m3 walletprocesspsbt cHNidP8BAFICAAAAAbVDbsMqbUlGw3Fs6qSibYoBye+gWWWXC0u4UyZuoDALAQAAAAD9////AZBfAQAAAAAAFgAUZ+PY/PmXCW0oCRKtKRmzbgdil+0AAAAAAAEAcgIAAAABf9MjFLP83xBP8nl17j6VId+Y2UW/5seoLnxCqNnLOAcAAAAAAP7///8CMew0w1QGAAAWABRA3SSDttwD9s5g86KiG+bhufb1caCGAQAAAAAAF6kUnIU0am6gwrbGkE5cRk3274T+FwWH1qYBACICA1lZHfKbvNuPsuTN5dkuzIxmmNnwqyfy92k4zd3CMjJ5RzBEAiB1+POriSk9sPSZnMxkCE6oDKiLmYNW5KxuRN/q0nJJmgIgWM3ZX3ryJEDKhcyM4NI9wnLpMqkIXZwTueM33kYUysgBAQRpUiEDmSeEIIDMSiLS1KY8E7PZpmVk4jB3WYHwOXZ4ev5s9xYhA1lZHfKbvNuPsuTN5dkuzIxmmNnwqyfy92k4zd3CMjJ5IQN+RFJqg/2yyJ3oA1bu2hu/2zc4obO3DDxx6pX+ruxARlOuIgYDWVkd8pu824+y5M3l2S7MjGaY2fCrJ/L3aTjN3cIyMnkExzmGAiIGA35EUmqD/bLInegDVu7aG7/bNzihs7cMPHHqlf6u7EBGBIup2JAiBgOZJ4QggMxKItLUpjwTs9mmZWTiMHdZgfA5dnh6/mz3FgQ9xFj9AAA=
   {
     "psbt": "cHNidP8BAFICAAAAAbVDbsMqbUlGw3Fs6qSibYoBye+gWWWXC0u4UyZuoDALAQAAAAD9////AZBfAQAAAAAAFgAUZ+PY/PmXCW0oCRKtKRmzbgdil+0AAAAAAAEAcgIAAAABf9MjFLP83xBP8nl17j6VId+Y2UW/5seoLnxCqNnLOAcAAAAAAP7///8CMew0w1QGAAAWABRA3SSDttwD9s5g86KiG+bhufb1caCGAQAAAAAAF6kUnIU0am6gwrbGkE5cRk3274T+FwWH1qYBAAEH/ABHMEQCIHX486uJKT2w9JmczGQITqgMqIuZg1bkrG5E3+rSckmaAiBYzdlfevIkQMqFzIzg0j3CcukyqQhdnBO54zfeRhTKyAFHMEQCIA2bI9IQ/SOsgaFtU5d7TFj3Em6Cy/Zm9YuS0zeAgOSvAiAZvOhcoFe6MQB1V4aMDqW1cXIrTiIDxSERdY2MMK/xuQFMaVIhA5knhCCAzEoi0tSmPBOz2aZlZOIwd1mB8Dl2eHr+bPcWIQNZWR3ym7zbj7LkzeXZLsyMZpjZ8Ksn8vdpOM3dwjIyeSEDfkRSaoP9ssid6ANW7tobv9s3OKGztww8ceqV/q7sQEZTrgAA",
     "complete": true
   }
   
   

10. This transaction can be finalized and broadcasted:

    $ bitcoin-cli finalizepsbt cHNidP8BAFICAAAAAbVDbsMqbUlGw3Fs6qSibYoBye+gWWWXC0u4UyZuoDALAQAAAAD9////AZBfAQAAAAAAFgAUZ+PY/PmXCW0oCRKtKRmzbgdil+0AAAAAAAEAcgIAAAABf9MjFLP83xBP8nl17j6VId+Y2UW/5seoLnxCqNnLOAcAAAAAAP7///8CMew0w1QGAAAWABRA3SSDttwD9s5g86KiG+bhufb1caCGAQAAAAAAF6kUnIU0am6gwrbGkE5cRk3274T+FwWH1qYBAAEH/ABHMEQCIHX486uJKT2w9JmczGQITqgMqIuZg1bkrG5E3+rSckmaAiBYzdlfevIkQMqFzIzg0j3CcukyqQhdnBO54zfeRhTKyAFHMEQCIA2bI9IQ/SOsgaFtU5d7TFj3Em6Cy/Zm9YuS0zeAgOSvAiAZvOhcoFe6MQB1V4aMDqW1cXIrTiIDxSERdY2MMK/xuQFMaVIhA5knhCCAzEoi0tSmPBOz2aZlZOIwd1mB8Dl2eHr+bPcWIQNZWR3ym7zbj7LkzeXZLsyMZpjZ8Ksn8vdpOM3dwjIyeSEDfkRSaoP9ssid6ANW7tobv9s3OKGztww8ceqV/q7sQEZTrgAA
    {
      "hex": "0200000001b5436ec32a6d4946c3716ceaa4a26d8a01c9efa05965970b4bb853266ea0300b01000000fc00473044022075f8f3ab89293db0f4999ccc64084ea80ca88b998356e4ac6e44dfead272499a022058cdd95f7af22440ca85cc8ce0d23dc272e932a9085d9c13b9e337de4614cac80147304402200d9b23d210fd23ac81a16d53977b4c58f7126e82cbf666f58b92d3378080e4af022019bce85ca057ba31007557868c0ea5b571722b4e2203c52111758d8c30aff1b9014c695221039927842080cc4a22d2d4a63c13b3d9a66564e230775981f03976787afe6cf716210359591df29bbcdb8fb2e4cde5d92ecc8c6698d9f0ab27f2f76938cdddc232327921037e44526a83fdb2c89de80356eeda1bbfdb3738a1b3b70c3c71ea95feaeec404653aefdffffff01905f01000000000016001467e3d8fcf997096d280912ad2919b36e076297ed00000000",
      "complete": true
    }
    
    $ bitcoin-cli sendrawtransaction 0200000001b5436ec32a6d4946c3716ceaa4a26d8a01c9efa05965970b4bb853266ea0300b01000000fc00473044022075f8f3ab89293db0f4999ccc64084ea80ca88b998356e4ac6e44dfead272499a022058cdd95f7af22440ca85cc8ce0d23dc272e932a9085d9c13b9e337de4614cac80147304402200d9b23d210fd23ac81a16d53977b4c58f7126e82cbf666f58b92d3378080e4af022019bce85ca057ba31007557868c0ea5b571722b4e2203c52111758d8c30aff1b9014c695221039927842080cc4a22d2d4a63c13b3d9a66564e230775981f03976787afe6cf716210359591df29bbcdb8fb2e4cde5d92ecc8c6698d9f0ab27f2f76938cdddc232327921037e44526a83fdb2c89de80356eeda1bbfdb3738a1b3b70c3c71ea95feaeec404653aefdffffff01905f01000000000016001467e3d8fcf997096d280912ad2919b36e076297ed00000000
    
    6f56b1b93a6053cb9e7b91ae4786a20f8d34f1d183022142c2fbf8a16d780766
    

Tx: 6f56b1b93a6053cb9e7b91ae4786a20f8d34f1d183022142c2fbf8a16d780766

You might also find this interesting: https://github.com/1440000bytes/p2p