I'm curious as to what exactly is protected by the seed that Electrum generates for a multisig wallet. My knowledge of the protocol implementation is rather basic, so please correct me where I'm wrong or incomplete.
As I understand it after reading Bitcoin multisig the hard way: Understanding raw P2SH multisig transactions, a P2SH multisig doesn't have its own private key; it has a redeem script that's reproducable by anybody who knows the public keys involved, their order in the script, and how many of them are required to spend the encumbered coins. (Based on this answer, it seems like Electrum follows BIP45 to allow deterministic ordering of keys, so knowing their order wouldn't be important.)
The P2SH multisig is then a hashed version of the redeem script which, apart from providing brevity, hides the public keys & the number required to be spent that are involved in the redeem script. After address generation, so long as each signer keeps track of her private key, is there any extra private information to safeguard?
An obfuscating element to P2SHs in Electrum, specifically, is the use of "master public keys" as inputs rather than plain public keys. How does electrum decide which generated public keys to use as the inputs to the redeem script? Is this what's protected by the seed?
Points of confusion:
- What is protected by the Electrum seed for a multisig address?
- If it's the redeem script—whose secrecy protects the public keys involved with the P2SH address—shouldn't it be possible to regenerate when it's time to spend the funds, and spare the user the burden of guarding another seed?
- How does Electrum generate a redeem script from master public keys?