Multi-signature

Multisignature (multisig) refers to requiring more than one key to authorize a Bitcoin transaction. It is generally used to divide up responsibility for possession of bitcoins.

Standard transactions on the Bitcoin network could be called “single-signature transactions,” because transfers require only one signature — from the owner of the private key associated with the Bitcoin address. However, the Bitcoin network supports much more complicated transactions that require the signatures of multiple people before the funds can be transferred. These are often referred to as M-of-N transactions. The idea is that Bitcoins become “encumbered” by providing addresses of multiple parties, thus requiring cooperation of those parties in order to do anything with them. These parties can be people, institutions or programmed scripts.

Consider the following scenario:

Suppose I am working with a company that wants to accept Bitcoin for international trades.

The company, for security reasons, would not want a single one of its employees to have access to the company BTC wallet's password. Any transaction would have to meet the approval of more than one employee.

Is this possible already? If not, how could it be implemented with public-key cryptography?

Implementations

Specific to Bitcoin, GreenAddress.it, for example, has 2-of-2 and 2-of-3 accounts (requiring at least two keys to authorize a transaction). Electrum allows a multisig wallet made of any combination of m-of-n. Coinbase also offers 2-of-3 and 3-of-5 multisig, which they call Vault. Blocktrail offers 2-of-3 multisig.

This javascript page can create and spend from multisig addresses: https://coinb.in/ But see the warnings about Javascript cryptography.

See also the Electrum tutorial: http://docs.electrum.org/en/latest/multisig.html

Multisignature Applications

• 1-of-2: Husband and wife petty cash joint account — the signature of either spouse is sufficient to spend the funds.

• 2-of-2: Husband and wife savings account — both signatures are required to spend the funds, preventing one spouse from spending the money without the approval of the other

• 2-of-3: Parents’ savings account for child — the kid can spend the money with the approval of either parent, and money cannot be taken away from the child unless both parents agree

• 2-of-2: Two-factor authentication wallet - One private key is on your primary computer, the other on your smartphone — the funds cannot be spent without a signature from both devices. Thus, an attacker must gain access to both devices in order to steal your funds (much more difficult than one device)

• 3-of-5: Low-trust donation address - five trusted people from a project each hold a private key. Three people are required to actually spend the money but anybody can donate to the project's address. Reduces the risk of embezzlement, hacking/malware or loss due to a single person losing interest in the project. Which private key was used in the final signature is visible on the blockchain which aids accountability.

• 2-of-3: Buyer-seller with trustless escrow - buyer commits money into a 2-of-3 address with the seller and a third-party arbitrator. If transaction goes smoothly, then both buyer and seller sign the transaction to forward the money to the seller. If something goes wrong, they can sign a transaction to refund the buyer. If they cannot agree, they both appeal to the third-party who will arbitrate and provide a second signature to the party that it deems deserves it. The arbitrator cannot steal the money as they have only one key.

• 2-of-3: A board of three directors maintaining funds for their organization — those funds cannot be spent unless any two of those directors agrees. Bigger multi-signature transactions are possible for bigger organizations, such as 3-of-5, 5-of-9, etc.

• 2-of-3: Improved hot wallet security for businesses - A bitcoin business such as an exchange holds one private key online and one private key as paper backup. A separate bitcoin security firm holds the third key online and will only sign transactions after checking certain conditions (blacklists, whitelists, not more than X withdrawn per time period, two-factor authentication, comply with regulatory environment, etc). If the bitcoin business or the security firm's hot wallets individually get hacked, the bitcoins cannot be stolen. If the bitcoin security firm disappears the business can use the paper backup to access coins.

• 2-of-3: Decentralized cold storage vault - One of the keys is held in your own home, the second in a bank safe deposit box and copies of the third key are distributed to a close friend, a relative and stored in the office. The home vault is not vulnerable to raiding or burglary because spending the money requires a visit to either the friend, bank or office. Losing the safe deposit box also doesn't result in loss.

• 2-of-2: Smart contracts building block such as tumblebit, coinswap and Lightning Network.

• 1 OR 3-of-4: Distributed Backup - The primary owner can use the wallet at will, but if that owner loses their private keys, they can recover with the help of 3 of the other 4 trusted friends/organizations. One key could be kept in a security deposit box at a bank, the other 3 could be distribute to friends. In the case of death of the owner, the security deposit box can be willed to one of the trusted friends or someone who can get the help of the trusted friends. More complex multisig wallets can be created if desired.

See also: Storing_bitcoins#Multisignature_wallets

History of Multisignature

Multisignature has been used for thousands of years to protect the security of crypts holding the most precious relics of saints. The superior of a monastery would give monks only partial keys for gaining access to the precious relics. Thus, no single monk could gain access to and possibly steal the relics.

Multisignature Wallets

A number of companies have developed multisig wallets:

• Armory
• CarbonWallet
• Copay
• Bitgo
• Blocktrail
• GreenAddress
• Casa
• Coinbase
• Electrum
• Xapo
• Coinkite

Creating a Multisignature Address with Bitcoin-Qt

A 2of3 multisig address can be created by following these steps:

1. Gather (or generate) 3 bitcoin addresses, on whichever machines will be participating, using getnewaddress or getaccountaddress RPC commands (or copy and paste from the GUI).
2. Get their public keys using the validateaddress RPC command 3 times.
3. Then create a 2-of-3 multisig address using addmultisigaddress; e.g.

   bitcoind addmultisigaddress 2 '["044322868cb17d64dcc22185ae2d4493111d73244c3668f8ac79ecc79c0ba8d30a6756d0fa20157 709af3281cc721c7f53321a8cabda29b77900b7e4fe0174b114","..second pubkey..","..third pubkey.."]'

addmultisigaddress returns the multisignature address. Be a little careful, the public keys are raw hexadecimal and don't contain checksums like bitcoin addresses do. You can then send funds into that 2-of-3 transaction using the normal sendtoaddress/sendmany RPC commands, or the GUI (or anything that's been updated to recognize multisig addresses).

Gavin Andresen has an example of using multisig with bitcoin-qt Raw Transactions: https://gist.github.com/gavinandresen/3966071

Notable examples in practice

• The cold storage wallet of the Bitfinex exchange is a single 3-of-6 multisig address 3D2oetdNuZUqQHPJmcMDDHYoqkyNVsFk9r which as of December 2017 contains 141 177 btc ($1.5 billion). Presumably the keys are kept very safe by Bitfinex's operators.

References

• How To Create A Bitcoin Multisig Wallet