Review of multisig funds protection strategy

Question

I want to protect my bitcoin and my threat model is that one of the two paper copies of the seed is accessed to recover the wallet and steal the funds. To mitigate this risk I am contemplating the options of a 2-out-3 multi-sig wallet. My first strategy is as follows:

I have therefore 4 geographically separate and secret locations (excluding myself). In terms of hardware wallets with me, I only have 1 which means if the main device is stolen, my bitcoins are safe as one more key is needed. The same is true if locations 1 or 2 are uncovered and a hardware wallet devices were to be stolen (as just one hardware wallet is there). However, taking the seed perspective, two seeds would be compromised.

My first question is whether an attacker can steal the funds with the two seeds uncovered or if 3 seeds are a must in order to recreate the wallet and take the funds? (I am assuming that if the attacker would have access to the 2 seeds to recreate private keys and the multisig wallet that was set up on my personal computer is not possible). I think that is the case, because recovering multisig wallet on Electrum requires 3 seeds (or 1 seed and 2 public keys of the co-signers), but wanted to double-check with the community that indeed no bitcoin can be moved with just two seeds uncovered. Note that with this setup it is effectively cold-cold storage as moving bitcoin, in this case, requires going to either location 1 or 2 to take either hardware wallet 1 or 2 to co-sign with the hardware wallet 3.

The other option is to create a hidden wallet with a passphrase using just one wallet. In that case 2 copies of seed and 2 copies of the passphrase can be stored in 4 geographically distinct locations. If the seed is uncovered then the hidden wallet can't be accessed and if the passphrase is accessed then the hidden wallet can't be recreated too. The only vulnerability in the latter case is if the hardware device was stolen and used to move the money (either by tampering with it physically or by directly using it although usage can be restricted with the device PIN).

My second question is whether the first option gives a significantly higher entropy for the protection. Note that in terms of costs of storage the cost would be the same as in both cases we must make use of 4 locations.

Answer 1

My first question is whether an attacker can steal the funds with the two seeds uncovered or if 3 seeds are a must in order to recreate the wallet and take the funds?

They can steal funds if they have:

1. The keys
2. The multisig descriptor

You should put your multisig descriptor at each location and/or somewhere that can securely store it. The threats from a leaked multisig descriptor is only a loss of privacy.
Please don't rely on your wallet descriptor being secret and instead assume 2-of-3 security with one key being leaked being safe.

In that case 2 copies of seed and 2 copies of the passphrase can be stored in 4 geographically distinct locations.

Having 2 copies of a seed increasees the chance of compromise. If you want more copies, use 3-of-5.

Answer 2

My first question is whether an attacker can steal the funds with the two seeds uncovered or if 3 seeds are a must in order to recreate the wallet and take the funds?

With a 2-of-3 multisig 2 of the 3 private keys are needed to sign the transaction to move funds from it (and knowledge of the third public key but this shouldn't be used as a protection against attackers). I suspect from reading your question that you don't understand what a seed is for a HD wallet. A seed doesn't offer any additional protection, the seed is used to generate more private keys (and public keys). If an attacker gets access to this seed it can generate all the private keys from this seed that you can.

If you have three independent seeds for three independent HD wallets and you use a private key generated from each seed then an attacker would need to access two of the three private keys (or two of the three seeds, these can be used to generate two of the three private keys) to move funds from a 2-of-3 multisig.

The other option is to create a hidden wallet with a passphrase using just one wallet. In that case 2 copies of seed and 2 copies of the passphrase can be stored in 4 geographically distinct locations. If the seed is uncovered then the hidden wallet can't be accessed and if the passphrase is accessed then the hidden wallet can't be recreated too.

This offers no additional protection to a 2-of-3 multisig (an attacker still needs to access 2 locations) and it requires an additional geographical location (4 rather than 3 in the 2-of-3 multisig case). A passphrase also typically has less entropy than a seed depending on its length. The shorter the passphrase the easier it is to brute force. The advantage to this particular scheme would be that today it is easier to implement as most (all?) hardware wallets support encrypting a seed with a passphrase. Hardware signing support for multisig schemes is less widespread.