In this question I discussed how sharding a private key with Shamir's Secret Sharing Scheme maybe a good alternative to MultiSig as a means of reducing excessive fees associated with MultiSig transactions. @Pieter Wuille provided an excellent analysis of the pros and cons of using Sharding vs. MultiSig and revealed some of the work in progress aiming to address the main concern with sharding (the "A Chain Only as Strong as Its Weakest Link" problem).

As mentioned, the main problem with employing SSS as an alternative to MultiSig is that it is necessary to reconstruct the actual secret key on a single machine before signing a transaction - once again making it vulnerable to a single point of failure (attack). As the saying goes "a chain is only as strong as its weakest link".

While Taproot and Schnorr signatures were proposed as potential alternatives to SSS, these two solutions are for the time being just "proposals" and they will need to be accepted by the entire Bitcoin community (which could take forever) before they become viable alternatives.

Are there any alternatives to SSS, which can be used right now, where a transaction can be signed by two (or more) parties without needing the secret key to convene on one machine? Are there any alternatives to "Shamir's Secret Sharing" that might allow this functionality?

In case it makes a difference, all I need is n-of-n (i.e, 3-out-of-3) rather than k-of-n (i.e, 3-out-of-4 or 2-out-of-3).


  • 2
    Yes, multiparty ECDSA exists. But it's many times more complicated than normal ECDSA. – Pieter Wuille Jan 31 at 2:25
  • 7
    If you need to ask "how to implement multiparty ECDSA", the answer is that you absolutely shouldn't. This sort of stuff should be done by people who know what they're doing. – Pieter Wuille Jan 31 at 3:35
  • 1
    @S.O.S You really shouldn't try to build your own crypto tools if you need to ask this kind of question here unless you really want to lose your money. It looks like people are working on it though so I would just wait it out. – ieatpizza Feb 1 at 13:26
  • Is there something wrong with the question that it was downvoted? I don't think it violates any rules on this site.. Please enlighten me. – S.O.S Feb 3 at 17:00
  • 1
    I didn't downvote, but note that downvoting does not mean any rules are violated (there are close votes and moderator flagging for that). It just means people think it's not a good question. – Pieter Wuille Feb 4 at 1:20

Right now, the top two alternatives to Taproot & Schnorr Signatures rely on multiparty ECDSA (elliptic curve digital signature algorithm) also known as threashold ECDSA.

Threshold ECDSA has two main functions: The first function is to spread out key generation across multiple machines. This makes it so that no single party is ever made aware of the full key. The second function is to sign a transaction with the key shares (generated in step 1) without needing to combine them in a single place. This allows a set of distinct parties (that do not trust each other and do not wish to reveal their PK to each other), to jointly compute a function over their inputs while keeping those inputs private.

ZenGo, is a Multi-party ECDSA written in Rust. It comes with two key features:

  • Key Generation for creating secret shares.
  • Signing for using the secret shares to generate a signature.

Binance Chain, is a Multi-party threshold signature scheme that supports the first two features but also allows for Dynamic Regrouping of shares:

  • Key Generation for creating secret shares with no trusted dealer ("keygen").
  • Signing for using the secret shares to generate a signature ("signing").
  • Dynamic Groups to change the group of participants while keeping the secret ("resharing").

Both libraries have been audited by Kudelski Security. Be warned, however, that both of these technologies are relatively "new" and may suffer from unknown bugs/security flaws. Use them at your own peril.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.