Can you have a multsig wallet with the current Monero protocol?

Can you create a bitcoin-style multisig wallet in Monero in the current protocol?

You would have n participants, such that k of them can authorize a transaction.

Yes. Essentially, you can split up the private spend key according to a (k,n)-secret sharing scheme. Then any k participants can collect the keys together to recreate this private spend key and then sign transactions.

Now the question is, how is the key generated, how are the shares generated, and who/what brings the shares together.

One simple way is this have a trusted dealer generate the key and distribute the shares, and a trusted signer to collect the shares and sign transactions. If you are doing this for your own cold storage uses, this should be sufficient.

If you don't want a trusted signer, you can use secure multi-party computation. You can have a transaction X, and then k participants can do a computation that signs X. By the properties of Secure multi-party computation, the shares won't be revealed, and the only thing computed is a signature for X. In this way, the k participants don't have to trust any central signer, or even each other.

If you don't want a trusted dealer, you can again use secure multi-party computation. In particular, you can design an algorithm that produces a spend-key, produces shares of it according to the secret sharing scheme, and then encrypts each share with a public key of a participant, P_n. This algorithm requires a certain amount of random data r. The m dealers each generate their own random data or entropy r_i, and do the above computation using r = the xor of all the r_i. As long as one dealer chooses a random r_i and then destroys that r_i, r can not be calculated. These m dealers can be the n participants, although in practice you would probably only need k of the participants to be dealers, since they have spend power anyways.

By using both of these suggestions, this multisig scheme is as powerful as a bitcoin style multisig. It can actually be implemented in any cryptocurrency, regardless of protocol. It actually is a little bit better than a bitcoin multisig because:

• It is indistinguishable from a monero address, helping to protect privacy. (Bitcoin miners and nodes which actually ignore multisig transactions with too many participants).
• The above property also makes this cheaper as well, since transactions to and from an address are the same size regardless of whether its multisig or not.

Unfortunately, I don't know any software that implements this yet. It would make a good project, if anyone's up for it. 😊

EDIT: Just found the fair play project. It can be used for secure multiparty computation.

• I think you're saying... no ? :D I had a look earlier at doing SSS on the seed, so you'd get N word lists. It'd need modexp primitives though, which would have meant bringing some amount of other code in. It'd be pretty nice to add that though... Aug 4, 2016 at 22:16
• @user36303 But it doesn't need to be on chain. It's all off-chain. You can use it with today's monero. Aug 4, 2016 at 23:19
• I really like the secure multi-party computation idea and would love to see an implementation of this Aug 5, 2016 at 3:03
• @SebastianUllrich I just found a project for multiparty computation. If simplewallet can be ported into its programming language, it would accomplish the task. Aug 10, 2016 at 23:15