3

I created 2-of-3 multisig address using bitcoinqt by three public keys from my wallet . when I tried to validate this address after creation it shows :

"isvalid" : true "ismine" : false

should it be is mine as it is created by 3 of my addresses ? can you explain me why it does not belong to the wallet ?

3

TL;DR: Bitcoin Core currently (as of v.0.9.3) does not support spending from a multi signature address even even you create a multi signature address with public keys of addresses inside your wallet. Therefore it does not show the generated multi signature address in the UI or return "ismine:true".

Spending from a multisig address requires including the generated "redeem script" within the transaction. Additionally, the raw transaction has to be signed by 2 of the 3 public keys provided to "createmultisig" (also included in the script) in the order they were provided to "createmultisig". As of now, the wallet does not store these redeem scripts, nor does it know in which order the raw transaction needs to be signed. Because of this, you cannot spend from a Multisig address via the UI. Therefore, it doesn't make sense for Multisig address to be included within the wallet UI.

Using Multisig addresses is still considered an "advanced feature." Therefore, they don't show up in the UI. This requires understanding what Multisig addresses actually are and how they work.

A Multisig address is a type of "Pay-to-Script" address. The addresses created using bitcoin-qt create a script like this:

OP_x (x = number of required signatures)
PUSH next 33 bytes
[33-byte public key (compressed)]
PUSH next 33 bytes
[33-byte public key (compressed)]
...
OP_y (y = total number of public keys)
OP_CHECKMULTISIG

This script is hashed to create your address. So, since this script is unique to you (your public keys), it does belong to you.

In order to spend coins from this address, you have to create a raw transaction that spends from the address and sign it with the private keys that correspond to at least x of the public keys (in the order they were given when creating the address/script).

Part of this spending transaction is the script itself such as the one above (in hex form). This is a required part of the transaction. Of course, the script could be built from the UI, but the UI would have to have to know the exact order the keys were presented to build the original address in order to re-build the script.

This brings us to the next problem. In the current UI, there is no way to sign a transaction. However, even if you could, the UI would not know (based off the address alone) in which order the transaction must be signed to be valid.

One way to alleviate these problems would be to store the script in the client itself, however this might pose a security risk to some degree. If the wallet were to store the address and the script in the wallet, somebody (perhaps malware) that is able to access your wallet would be able to get your private keys as well as the script required to spend from the address -- which is also in your wallet. If you know what you're looking for, it's fairly easy read the script, find the corresponding keys in the wallet and create a transaction to spend the coins.

At least with the current Multisig pains such as manual transaction signing and such there is a layer of obscurity. If you were to send all of your BTC to a Multisig address, an attacker wouldn't be able to just up and run off with all your BTC. They would have to have a few key pieces of information: the original Multisig script (which I don't believe is known until a successful spending transaction has occurred), the private keys, and they'd have to know both the correct private keys and the correct order to sign the spending transaction in. Of course, that's a lot of information that would be needed just to make a successful spending transaction -- none of which (other than the private keys) is actually stored in the wallet.

So, while it may be difficult to deal with Multisig transactions/addresses in bitcoin-qt, it may be a good thing!

However, I don't see why once you've generated a multisig address that it couldn't be added to your receiving addresses. I have a feeling it has to do with the difference between how regular and pay-to-script addresses are generated and the fact that regular addresses use a fixed-width private key, where as a script (which is basically the private key of a Multisig address) is an arbitrary length: 1+(34*num_public_keys)+2.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.