48
votes
Accepted
How will multisig addresses work?
I know this question is old, but I stumbled upon it looking how to teach myself how multisig addresses work, and I imagine others will to. So I’m going to try to explain the typical flow for creating, ...
- 2,276
37
votes
Accepted
What are the implications of Schnorr signatures?
Warning: I've never actually worked with the Schnorr signature scheme. The
following is my analysis based on reading the Wikipedia
article, the ed25519
page, and some discussions between devs in
#...
- 11.3k
33
votes
Accepted
What are the limits of m and n in m-of-n multisig addresses?
We need to distinguish the limitations for validity and standardness. The first is determined by the consensus rules (which cannot change without a hard fork). The second ones are determined by local ...
- 86.4k
22
votes
Accepted
What are the advantages of Schnorr vs ECDSA?
Your question seems to assume that the only goal is minimizing on-chain transaction size. Reducing size and related costs is certainly something that can be improved upon, but it's far from the only ...
- 86.4k
14
votes
Accepted
CHECKMULTISIG a worked out example
I expect that CHECKMULTISIG will call the CHECKSIG function and manipulate the stack to run CHECKSIG in a loop until it terminates and either has its M-out-of-N valid sigs or not?
That's not really ...
- 28.8k
13
votes
Accepted
Will SegWit allow for m of n multisig with very large n and m?
By reading this answer, I understand that in m-of-n multisig addresses, m and n are limited by the maximum size allowed by the P2SH redeemScript (i.e. 520 bytes).
That's correct. Even though the ...
- 86.4k
11
votes
Is there a difference between the multi-signature and Shamir's secret sharing?
The most fundamental difference is that Shamir Secret Shares shares... well, a secret. Multisig shares the ability to sign, but does not share the private keys directly.
You could use SSS to ...
- 86.4k
9
votes
What are the implications of Schnorr signatures?
Yes you can do public key recovery with EC Schnorr. Consider
R = kG, [r = R.x, s = k + H(r, m)d], Q = dG
verify:
sG = ?R + H(r, m)Q
recovery:
sG = kG + H(r, m) dG = R + H(r, m)Q
so
Q = 1 / H(r, ...
- 91
9
votes
Accepted
What is the safest physical to store a private key only to be accessed after death?
If you are comfortable with a command line, I have used ssss-split and ssss-combine for sharding encryption keys in a n-of-m scheme. These utilities use Shamir's Secret Sharing Scheme to safely break ...
- 8,734
9
votes
Accepted
2-of-3 multisig with Schnorr signatures
From what I understand, Schnorr signatures will allow n-of-n multisignature transactions, however m-of-n isn't possible using the key path alone.
That's not quite accurate. Schnorr signatures, as ...
- 86.4k
9
votes
Why isn't `OP_CHECKMULTISIG` compatible with batch verification of schnorr signatures?
Batch verification is effectively the following. Whenever a signature check is encountered during script execution, simply remember the (pubkey, message, signature) tuple, but continue immediately ...
- 86.4k
9
votes
What is the largest multisig quorum currently possible?
The rules governing this depend on the type of script used and whether that script is in the output script, in a P2SH, in a P2WSH, or in P2TR. Additionally, the rules are more restrictive for ...
- 62.4k
8
votes
Accepted
In a multisig wallet setup what needs to be backed up and why?
Ben Kaufman answered this on Twitter.
The main caveat in a multisig wallet is that, while you need only a threshold of devices (ie. 2 of 3, 3 of 5, etc.) to sign a transaction, losing access to even a ...
- 10.5k
8
votes
Accepted
Is Sharding a Good Alternative to MultiSig?
Advantages of OP_CHECKMULTISIG over Shamir Secret Sharing for k-of-n:
There is no need to reconstruct the actual secret key on one specific machine. With SSS, you're inherently relying on that one ...
- 86.4k
8
votes
Accepted
Can Schnorr aggregate signatures be nested inside other Schnorr aggregate signatures?
TL;DR: depending on what you mean, there is probably no published scheme with a security proof, but there is hope for such a scheme.
First, a few clarifications
Aggregation is just a concept, not an ...
- 86.4k
7
votes
Accepted
Are all private keys required to create a multisig bitcoin address
You do not need private keys at all to generate multisig m-of-n address!
You do need public keys. Yes, three for m-of-3 and eleven for 5-of-11 (for example)
- 6,650
7
votes
How to create the same (2 of 3) multisig adresses as electrum's multisig wallets with createmultisig?
See BIP45.
Electrum is ordering the pubkeys lexicographically, ie
03722ef79a70b43843c642f3495d2b9b8a6403189d52a04ecac652c133f7940fed
03f5ce19296793c6695bfefd7ead459a3f88ef776d8fc08b470dbc749d266d5
...
- 5,178
7
votes
Accepted
Difference between a SegWit address and a P2SH address
Until a P2SH-P2WPKH UTXO is spent and the redeemScript is exposed, a P2SH-P2WPKH address is indistinguishable from a non-segwit P2SH address (such as a non-segwit multi-signature address)
Reference: ...
- 11.4k
7
votes
Accepted
Why is my P2SH sigScript field prepended with 0x00?
OP_CHECKMULTISIG contains a bug which consumes one extra element from the stack. Due to this, an additional OP_FALSE (0x00) is pushed for multisig scripts to make the script evaluation valid.
- 16.5k
7
votes
Accepted
What are the sizes of single-sig and 2-of-3 multisig taproot inputs?
Taproot generally has two ways of spending. The default way is to spend the output using the key path: pay-to-taproot then behaves like a p2pk output except that it is using a schnorr signature and ...
- 64.5k
7
votes
Accepted
Possible number of signers with MuSig
The number of signers with MuSig (and MuSig2) is practically infinite. For example, creating a MuSig signature with 1 million signers takes about 130 seconds on my laptop (see https://github.com/...
- 736
6
votes
What are the limits of m and n in m-of-n multisig addresses?
from 0-of-0 upto 20-of-20
https://blockchain.info/tx/970b435253b69cde8207b3245d7723bb24861fd7ab3cfe361f45ae8de085ac52
is 0-of-0 p2sh redeemption
https://blockchain.info/tx/...
- 6,650
6
votes
What percentage of Bitcoins stored in a multi sign address?
I calculated it here summarized per month:
month btc count
201201 0.010000 1
201202 1.150000 5
201203 0.015000 2
201209 0.010000 1
201212 137....
- 1,385
6
votes
Accepted
Multisig created from Multisig address
No. A "multisig address" is really a hash of a redeem script encoded as a P2SH address. Redeem scripts can't be nested, which means you can't include one redeem script inside another redeem script, ...
- 11.3k
6
votes
Accepted
Multi Sig Sub Keys
Yes, it's called HDM (Hierarchical-Deterministic-Multisig).
There's no standard, per se, and the main proponent (to the best of my knowledge) is/has been Vitalik Buterin, of Ethereum/Bitcoin Magazine ...
- 5,178
6
votes
Accepted
Multisig where one of the keys specifically is required?
No, but instead you can make a 3-of-4 multisig where you hold both keys A and B, then you give key C to a family member, and D to someone else(just as an example). This way you are certain that you ...
- 5,243
6
votes
What BIP32 derivation path does Electrum use for Multisig?
Electrum uses BIP45.
m / purpose' / cosigner_index / change / address_index
Example for non-change of the first cosigner and first address: m / 45' / 0 / 0 / 0
See: https://bitcointalk.org/index....
- 5,902
6
votes
Accepted
Bitcoin 0.17 No public key shown (validateaddress)
validateaddress has changed to be separate from the wallet, so it cannot look up the public key information for an address. Use getaddressinfo instead in order to get all of the wallet information for ...
- 62.4k
6
votes
Accepted
How can one see if an address is multisig?
There are different types of addresses in Bitcoin. The simplest format is called pay-to-public-key-hash (p2pkh) which locks funds to a single private key. Another is called pay-to-script-hash (p2sh), ...
- 64.5k
6
votes
Accepted
Is it possible to do a 3-of-5 OR 1 multi-sig for backup purposes?
Yes, this is possible. You can construct a script such as:
OP_IF
<key1>
OP_CHECKSIG
OP_ELSE
OP_3
<key2>
<key3>
<key4>
<key5>
<key6>
...
- 16.5k
Only top scored, non community-wiki answers of a minimum length are eligible