5

Yes or no, depending on your definition. You are right that the expected time to forge a 2-of-2 multisignature is twice that of a single signature, because you obviously need to use your forger algorithm twice. However, in practice such constant factors are ignored when describing security levels. For example, typically ed25519 and secp256k1 are placed in ...


4

There are different types of addresses in Bitcoin. The simplest format is called pay-to-public-key-hash (p2pkh) which locks funds to a single private key. Another is called pay-to-script-hash (p2sh), which allows to lock funds to a script that encodes the spending conditions. The recipient(s) of a p2sh output must reveal the redeemscript upon spending and ...


3

No, the descriptors language currently doesn't support BIP67. It would be easy to add a multi_bip67 or so to the language if there is a need for it.


3

The main issue about using a non-segwit inputs in the funding transaction or a p2sh output as the channel anchor is the transaction malleability. The recovery guarantee before a channel is funded relies on the commitment transaction building on top of the funding transaction. If the funding transactions txid were to be malleated, the commitment transaction ...


3

It is possible to move funds with only two private keys, however, you must still know the missing private key's public key. The public keys are required to produce the redeem script, which is require to complete a transaction. If you already know the redeem script (for example, it may be recorded in an old wallet file, or available on the blockchain if the ...


3

Once an address has been spent from, the script that is used to create the P2SH address will be revealed in the spending transaction. So any addresses that have the 'm-of-n' information listed on that page will be addresses that have been spent from in the past. Interestingly, a BIP for something called Taproot was just published by @PieterWuille, which ...


2

Actually, the BOLT has been designed with very strong privacy properties with regard to watchtowers. You can give all your commitment tx id first halves to one watchtower and it still doesn't learn anything about the second halves, others txs or anything else about the state of the channel (or which channel it is watching at all), as long as the full ...


2

Keep in mind that the ledger itself, if compromised could leak the pk in other ways. These methods I outlined will only confirm to you that a given address belongs to the set of private keys you hold, not that you're the only person holding these pks like you said: one way you can cheaply verify that is to simply take the address and send a little bit of ...


2

These two things are actually not related. There are no restrictions to address reuse in the protocol. You could get away with never using more than a single address ever (although that is not recommended especially for privacy reasons) and p2sh addresses are no exception there. The redeem script encodes the conditions that have to be fulfilled in order to ...


2

Yes, this is possible. You can construct a script such as: OP_IF <key1> OP_CHECKSIG OP_ELSE OP_3 <key2> <key3> <key4> <key5> <key6> OP_5 OP_CHECKMULTISIG OP_ENDIF This will allow key1 to freely spend the coins, but if a signature from key1 is not present it also allows any 3 of the ...


2

The R value is the result of EC point multiplication between the k value (known as the nonce) and the secp256k1 curve's generator point. It is effectively the public key for k. The only way that an R value can repeat is if k is also the same. Given that k is a 256 bit number and is supposed to be chosen completely randomly, k should not repeat unless the ...


2

The Bitcoin Wiki entry for OP_CHECKSIG answers your question. OP_CHECKMULTISIG works the same way, just applied to each signature in the sequence. First of all, it depends on the SIGHASH type you, as the signer, choose. Most likely you will use the default SIGHASH_ALL for each of the required signatures, but you could actually use different SIGHASH methods ...


1

Yes, you are correct. Joseph Poon and Tadje Dryja in their Lightning Network whitepaper proposed the SIGHASH_NOINPUT flag to prevent transaction malleability flaw hampering the creation of commitment transaction prior to funding transaction. However, with the deployment of SegWit in 2017, NOINPUT was not longer needed as signatures are not part of the txid ...


1

You are using a non-standard script with opcodes that are not found in standard scripts. Bitcoin Core cannot sign for non-standard scripts, the signer does not understand them.


1

A multi-sig address is a hash of a script that combines multiple separate keys. In other words the purpose of it is to require multiple signatures from multiple keys that are stored (and usually generated) independently. For that reason it can not be generated from a single extended public key (xpub). What you can do, is to have multiple extended keys, and ...


1

A block can only have one coinbase transaction. You could however send the reward+fees of the coinbase transaction to multiple addresses (of any type) just like any other transaction. is there a limit to the number of signatures that a multi-sig wallet can require? https://bitcoin.stackexchange.com/a/28092/87716


1

From a security perspective related to spending bitcoins, since only the master public keys have been compromised, there is no way that the attackers can derive the child public keys as they do not have access to the chain code. However, if the chain code is also revealed, there is no way to derive child private keys and hence the attacker cannot spend the ...


1

If the bitcoin is locked with three private keys using a simple script that involves signing by all three private keys (3 of 3), then there is no way to spend it without providing all three private keys for the signature. However, bitcoin being a programmable money, it allows you to create a locking script that is decided by time. By that I mean, you can ...


1

You almost have it, you just need to make sure you are creating a transaction with an output that your wallet can sign. Example (on regtest) bitcoin-cli -regtest addmultisigaddress 2 '["02983a79d2de8e504d00ddd2343b582acef7e17ed91b308ade8dff027a92e7716d","03548ca1916957bc06dd1c6e3639ebf7b2c3c8b1715915433c1d37cab56fb26ef0","...


1

There may be a few misunderstandings around BIP32/BIP44 key derivation and bcoin wallet usage in particular. I re-wrote your script below to demonstrate how to use bcoin multisig wallets and manually derive multisig P2SH addresses from keys. If you run it, you should see all three output addresses are identical. Here are a few things you need to know for ...


1

Lets say bitcoin become a global currency which replace fiat money Logically, if Bitcoin were to fully replace fiat money and be used for every transaction, then we should expect there would be some way of facilitating transactions easily, in pretty much every situation. Otherwise, people aren't going to adopt it if it is a worse solution that what is ...


1

You can't. If all you have is a capture of the wire traffic for a single tx, you can't (always) compute the actual address. In a certain subset of cases, such as for standardized scripts such as P2PKH or P2SH multisig, you might be able to assume the script sig to correspond to one of them, if it has the right data. The scriptsig mentioned is for a segwit ...


1

Let's re-write and calculate from scratch as the calculations that you have posted might not be self-explanatory in itself and some of them are not entirely accurate. From the question, I presume you are trying to find the size of transaction for spending bitcoins from a multi-sig address. Redeem Script Size I think there is an error in the size of redeem ...


1

How do that re-secure their wallet and effectively revoke the information that Mallory has learned? They would have to generate new keys and send the Bitcoin to the multisig address that uses those new keys. If Mallory has/had access to one wallet, she could record any and all keys in that wallet. Thus all keys in that wallet must be considered compromised ...


1

Related: In the bitcoin scripting language, how can I access other outputs of the transaction? Or how else can I limit how the coins may be spent? You cannot create your specified spend conditions with Bitcoin script directly, because you cannot specify the nature of a future output within an input's script. Put differently, an input's script cannot define ...


1

There is no way to check the transaction separately for each signature. Either the entire transaction is valid or it is invalid. When you receive the partially signed transaction, you would need to sign it with your own private key using the signrawtransaction command in bitcoind. It would give you two outputs (1) hex which is the serialized transaction and (...


1

Those are P2SH (Pay-to-script-hash) addresses. You can read more about different address prefixes here: https://en.bitcoin.it/wiki/List_of_address_prefixes Decimal prefix Hex Example use Leading symbol(s) Example 0 00 Pubkey hash (P2PKH address) 1 17VZNX1SN5NtKa8UQFxwQbFeFc3iqRYhem 5 05 ...


1

In the paper, it mentions a third party, Chuck, who will resolve disputes. (1): If customer (Alice) before receiving the product, signs 2-of-2 transaction, then transaction is payable for merchant (Bob), but what happens if merchant (Bob) does not send the product to customer (Alice)? Assuming Bob only cared about getting paid, he would always sign ...


1

There is a bit of a misunderstanding of what an address is here. When Bitcoin are sent, they're not moved "to an address" so much as they're locked to the fulfillment of some authentication requirement. The standard scheme hereby is "pay-to-public-key-hash (p2pkh)" which could be described as "to spend these funds, you need to reveal a public key which ...


1

For anyone working in the core test framework, I used this code to create a 2 of 2 multisig witness stack with a null dummy as the first element on the stack: witness_program = CScript([OP_2, pubkey1, pubkey2, OP_2,OP_CHECKMULTISIG] tx.wit.vtxinwit[0].scriptWitness.stack = [b'', sig1, sig2, witness_program] I'm not a Python programmer so it took ...


Only top voted, non community-wiki answers of a minimum length are eligible