Author: Craig Raw 2021-02-15 13:53:05
Published on: 2021-02-15T13:53:05+00:00
A proposal has been made to establish multisig wallets securely. The proposal raises concerns over the tampering of multisig configurations, which could include script type, derivation paths, and number of required signatures. To mitigate these risks, the proposal suggests defining an interoperable multisig configuration format.However, two concerns with the proposal were raised during a discussion via email. Firstly, it was suggested that adding TOKEN and encryption adds unnecessary complexity without adding much security. Secondly, asking users to enter their derivation into the Signer unnecessarily complicates the process.The proposal recommends using the efficient UR2.0 standard and associated formats for air-gapped data transmission using QR codes. It also outlines the setup process involving the Coordinator and Signers. The Coordinator initiates the multisig setup and determines the type of multisig used, while the Signer provides their key record and persists the descriptor record in their storage. The proposal defines encryption modes, key derivation, and an encryption scheme. Finally, QR codes can be used to transmit data following the UR standard.The proposal introduces two layers of protection to secure the membership set of signers. The first layer involves a temporary, secret token used to encrypt communication between the signer and the coordinator during setup. The second layer involves descriptor checksum and visual inspection of the descriptor itself. Signers must check their membership in the descriptor to detect changes or removals. If one signer fails to do so, the setup could be compromised. The descriptor checksum and visual inspection are the only ways to guard against malicious members being inserted into the set.The proposal acknowledges Dmitry Petukhov, Christopher Allen, Craig Raw, and others for their feedback on the specification. For more details, interested parties should see the UR Type Definition for BIP44 Accounts and UR Type Definition for Bitcoin Output Descriptors on the BlockchainCommons Research GitHub page.
Updated on: 2023-06-14T17:26:48.237519+00:00