2

I wonder how multi-signature wallets communicate with each other?

My favorite wallet is copay. How do they communicate with each other before payment is done? How is privacy handled between each multi-sig device?

1

Copay Dev Here.

Copay uses Bitcore-Wallet-Service (https://github.com/bitpay/bitcore-wallet-service) to communicate transactions proposals between copayers. When we stated Copay (prior version 0.5 I think) we used to use webRTC to directly communicate (using P2P networking) proposals between copayers but it was:

  • Very difficult to debug and support
  • Supported only on some devices (not IOS, for example)
  • And copayers needed to be online at the same time to communicate

so we decide to create a wallet-service, that help crafting the transaction, recollect the signatures and interfase with the blockchain (using bitcore https://bitcore.io/ ). Proposals are signed by the copayers (to prevent the server for creating or tampering the proposals) and the sensitive parts are encrypted.

  • hey @ematiu, if the implementation of the server part of copay wallet is bitcore-wallet-service, why does its README state the sentence BWS have a extensive test suite but have not been tested on production environments yet and have been recently released, so it it is still should be considered BETA software? thanks in advance – knocte Nov 5 '16 at 14:26
  • Thanks @knocte. that line was really old... BWS have been using it Copay/Bitpay App for more that 1.5 years now. I just fix it. – ematiu Dec 5 '16 at 1:57
2

The final transaction that gets broadcast to the network, just like every other Bitcoin transaction, is public. This is safe because signatures do not reveal any secret information. In the case of multisig wallets, when one wallet adds its signature and then sends it to another wallet, it doesn't matter if anyone is eavesdropping. It would be perfectly safe to send the partially-signed transaction in the clear. After all, when subsequent signatures are added, it will all be made public anyways.

That said, there can be privacy implications about whether you wish to let the world know who you are doing multisig with. In that case, establishing secure channels for communication becomes important, as well as making sure the addresses/public keys used are not somehow associated with your identities.

  • I am sory, I made a little mistake in question, instead of when it is done i meant before it is broadcasted to the network and then included into blockchain. Question is already edited – Comodore May 27 '16 at 22:27
  • I'm talking about before it is broadcast to the network too. Nothing sensitive is contained in a half signed transaction, so security isn't an issue. – Jestin May 28 '16 at 0:14
  • Okay, but I would like to focus more on privacy implications.That's where I think could be great problems. If locations of devices are leaked it could be a significant problem for security also. – Comodore May 28 '16 at 11:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.