I've recently read somewhere (can't remember the source) that multisig often doesn't provide more security in hot wallets, but increases the size and thus the fee.

I can't seem to comprehend how this can be valid (multisig not providing better security for hot wallets), what could be the reason behind this statement?


Multisig scriptpubkeys do increase the overall size of the transaction. This is because when redeeming the output sent to the multisig script, a number (typically larger than one) of signatures have to be provided for validation in the redeeming transaction.

As for security in multisig, it depends on the setup of keys, and the scriptpubkey that ends up being executed. For example, for a 2-of-2 multisig script (where two signers must cooperate), it might seem that this script is "more secure" against an attacker obtaining one of the keys, but if both keys are kept on the same device, then there is no security to be gained from a multisig. On the other hand, if the script is a 1-of-2 multisig, then even if one of the keys is highly secured but the second is not, then the security in having a second signer (secured) is subverted.

Bitcoin's scriptpubkeys can be programmed to require not just multiple signers, but also conditions on when these multiple signers should participate or when they shouldn't. We could set up a 2-of-3 (requires at least 2 of the 3 predetermined signers to participate) multisig scriptpubkey such that :

  1. The first key is a "low" security key controlled by the user
  2. The second key is a "moderate" security controlled by a 3rd party
  3. The 3rd key is a "high" security key, known only to the user but is normally in cold storage and not used

In normal operation, the low security and medium security signers will cooperate to sign the user's transactions. The user can rest easy knowing that even if their low security key is obtained by an attacker, the funds will remain safe. The attacker will need to obtain the medium security key (the one that belongs to the 3rd party service) as well to actually move the funds. If the service itself disappears, the user can still make use of their high security, cold storage key to complete the script with two signers, so they are never "locked out" of their funds.

There are even more ways to upgrade this setup, using ntimelocked transactions, or encoding a lock time in the script itself using op_csv or op_cltv. I believe Greenaddress is using a setup very close to this.

So to answer your question, multisig is just a tool. The security (or not) gained by using this tool depends on the way that it is used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.