23 votes
Accepted

What are the advantages of Schnorr vs ECDSA?

Your question seems to assume that the only goal is minimizing on-chain transaction size. Reducing size and related costs is certainly something that can be improved upon, but it's far from the only ...
Pieter Wuille's user avatar
14 votes
Accepted

CHECKMULTISIG a worked out example

I expect that CHECKMULTISIG will call the CHECKSIG function and manipulate the stack to run CHECKSIG in a loop until it terminates and either has its M-out-of-N valid sigs or not? That's not really ...
Nick ODell's user avatar
  • 29.3k
13 votes
Accepted

Will SegWit allow for m of n multisig with very large n and m?

By reading this answer, I understand that in m-of-n multisig addresses, m and n are limited by the maximum size allowed by the P2SH redeemScript (i.e. 520 bytes). That's correct. Even though the ...
Pieter Wuille's user avatar
12 votes

Is there a difference between the multi-signature and Shamir's secret sharing?

The most fundamental difference is that Shamir Secret Shares shares... well, a secret. Multisig shares the ability to sign, but does not share the private keys directly. You could use SSS to ...
Pieter Wuille's user avatar
11 votes
Accepted

In a multisig wallet setup what needs to be backed up and why?

Ben Kaufman answered this on Twitter. The main caveat in a multisig wallet is that, while you need only a threshold of devices (ie. 2 of 3, 3 of 5, etc.) to sign a transaction, losing access to even a ...
Michael Folkson's user avatar
10 votes
Accepted

2-of-3 multisig with Schnorr signatures

From what I understand, Schnorr signatures will allow n-of-n multisignature transactions, however m-of-n isn't possible using the key path alone. That's not quite accurate. Schnorr signatures, as ...
Pieter Wuille's user avatar
10 votes

What is the largest multisig quorum currently possible?

The rules governing this depend on the type of script used and whether that script is in the output script, in a P2SH, in a P2WSH, or in P2TR. Additionally, the rules are more restrictive for ...
Andrew Chow's user avatar
  • 68.5k
9 votes
Accepted

What is the safest physical to store a private key only to be accessed after death?

If you are comfortable with a command line, I have used ssss-split and ssss-combine for sharding encryption keys in a n-of-m scheme. These utilities use Shamir's Secret Sharing Scheme to safely break ...
Jestin's user avatar
  • 8,822
9 votes

Why isn't `OP_CHECKMULTISIG` compatible with batch verification of schnorr signatures?

Batch verification is effectively the following. Whenever a signature check is encountered during script execution, simply remember the (pubkey, message, signature) tuple, but continue immediately ...
Pieter Wuille's user avatar
8 votes
Accepted

Is Sharding a Good Alternative to MultiSig?

Advantages of OP_CHECKMULTISIG over Shamir Secret Sharing for k-of-n: There is no need to reconstruct the actual secret key on one specific machine. With SSS, you're inherently relying on that one ...
Pieter Wuille's user avatar
8 votes
Accepted

Possible number of signers with MuSig

The number of signers with MuSig (and MuSig2) is practically infinite. For example, creating a MuSig signature with 1 million signers takes about 130 seconds on my laptop (see https://github.com/...
nickler's user avatar
  • 776
8 votes
Accepted

Can Schnorr aggregate signatures be nested inside other Schnorr aggregate signatures?

TL;DR: depending on what you mean, there is probably no published scheme with a security proof, but there is hope for such a scheme. First, a few clarifications Aggregation is just a concept, not an ...
Pieter Wuille's user avatar
7 votes
Accepted

Difference between a SegWit address and a P2SH address

Until a P2SH-P2WPKH UTXO is spent and the redeemScript is exposed, a P2SH-P2WPKH address is indistinguishable from a non-segwit P2SH address (such as a non-segwit multi-signature address) Reference: ...
meshcollider's user avatar
  • 11.8k
7 votes
Accepted

Why is my P2SH sigScript field prepended with 0x00?

OP_CHECKMULTISIG contains a bug which consumes one extra element from the stack. Due to this, an additional OP_FALSE (0x00) is pushed for multisig scripts to make the script evaluation valid.
Raghav Sood's user avatar
  • 16.9k
7 votes
Accepted

What are the sizes of single-sig and 2-of-3 multisig taproot inputs?

Taproot generally has two ways of spending. The default way is to spend the output using the key path: pay-to-taproot then behaves like a p2pk output except that it is using a schnorr signature and ...
Murch's user avatar
  • 72.6k
7 votes
Accepted

musig2 with BIP-32 style nonce chain

I wonder, could the public nonce list be generated from a chain code in the same manner that BIP-32 allows a list of public keys to be generated? Absolutely not. (private) nonces need to be entirely ...
Pieter Wuille's user avatar
7 votes
Accepted

1-of-1 multisig

You may be looking at transactions of an unknown entity dubbed "Crazy1o1". To my knowledge, it is still unknown who they are or why they are using 1-of-1 transactions, but they've been ...
Murch's user avatar
  • 72.6k
7 votes
Accepted

How do I create a taproot multisig address requiring 21 of 210 keys to spend?

This will be possible in the upcoming Bitcoin Core 24.0 release, using RPCs like deriveaddresses and importdescriptors, which take as input specifications in the output descriptor language. RPCs like ...
Pieter Wuille's user avatar
7 votes
Accepted

Is the Schnorr digital signature scheme a multisignature interactive scheme, and also not an aggregated non-interactive scheme?

I want to start by addressing a few misconceptions in your question: "Schnorr signatures" aren't really a well-defined signature scheme. They're a class of digital signature schemes (with ...
Pieter Wuille's user avatar
6 votes
Accepted

Multisig where one of the keys specifically is required?

No, but instead you can make a 3-of-4 multisig where you hold both keys A and B, then you give key C to a family member, and D to someone else(just as an example). This way you are certain that you ...
m1xolyd1an's user avatar
  • 5,596
6 votes

What BIP32 derivation path does Electrum use for Multisig?

Electrum uses BIP45. m / purpose' / cosigner_index / change / address_index Example for non-change of the first cosigner and first address: m / 45' / 0 / 0 / 0 See: https://bitcointalk.org/index....
Jonas Schnelli's user avatar
6 votes
Accepted

Bitcoin 0.17 No public key shown (validateaddress)

validateaddress has changed to be separate from the wallet, so it cannot look up the public key information for an address. Use getaddressinfo instead in order to get all of the wallet information for ...
Andrew Chow's user avatar
  • 68.5k
6 votes
Accepted

How can one see if an address is multisig?

There are different types of addresses in Bitcoin. The simplest format is called pay-to-public-key-hash (p2pkh) which locks funds to a single private key. Another is called pay-to-script-hash (p2sh), ...
Murch's user avatar
  • 72.6k
6 votes
Accepted

Is it possible to do a 3-of-5 OR 1 multi-sig for backup purposes?

Yes, this is possible. You can construct a script such as: OP_IF <key1> OP_CHECKSIG OP_ELSE OP_3 <key2> <key3> <key4> <key5> <key6> ...
Raghav Sood's user avatar
  • 16.9k
6 votes
Accepted

Where can I get some MuSig2 test vectors?

As far as I know, there is not even a published specification for MuSig2. One is being worked on at https://github.com/jonasnick/bips/blob/musig2/bip-musig2.mediawiki, but it is incomplete. There are ...
Pieter Wuille's user avatar
6 votes
Accepted

Why CHECKMULTISIG bug can't be solved?

There are currently Bitcoin on the blockchain at various (non Taproot) addresses locked behind a script that includes the CHECKMULTISIG opcode with the bug in it. So you wouldn't want to change the ...
Michael Folkson's user avatar
5 votes
Accepted

How are Lightning network, duplex channels, and micropayment channels related?

Both lightning channels and duplex micropayment channels (DMC) are proposals to create bidirectional micropayment channels, that is, micropayment channels that can be used in both directions (a user A ...
cpsola's user avatar
  • 1,598
5 votes

Could cryptocurrency "insurance" slow Bitcoin adoption?

If anything, I believe the ability to buy insurance on cryptocurrency investments would speed up adoption by making it less risky to traditional investors. Simply having insurance available doesn't ...
Jestin's user avatar
  • 8,822
5 votes
Accepted

Can I rely on multisignature addresses being future proof?

Multisig transaction types use standard CHECKMULTISIG opcodes (which have been present in Bitcoin since its initial release in January 2009) and P2SH addresses (standardized in BIP13 in October 2011). ...
Pieter Wuille's user avatar
5 votes
Accepted

Would it be possible for miners to discriminate Lightning Network transactions?

The most distinguishing feature of a LN channel-opening transaction would be an OP_OR in the scriptPubKey of the channel-funding UTXO, where one side of the OP_OR requires two signatures, and the ...
Jestin's user avatar
  • 8,822

Only top scored, non community-wiki answers of a minimum length are eligible