I'd like to implement a 2-of-3 multisig protocol such that:
- Three parties generate private keys
- The private keys are never physically combined on one system - each private key never leaves its system of origin
- X Bitcoins are sent to some combination of these private keys
- It takes 2 parties to send the bitcoins to a new address
- None of the parties gains any information about the stored bitcoins, in particular the value of X or any related addresses
- However, two parties working together can gain complete information.
Motivation: You don't trust yourself to hold your bitcoins, and you want to rely on two of your friends to make it very hard on an attacker to steal your bitcoins (he'd have to compromise all of your systems). Still, you don't want to tell your friends information like how many bitcoins you have and where they are stored.