Can you create a bitcoin-style multisig wallet in Monero in the current protocol?
You would have n participants, such that k of them can authorize a transaction.
Monero Stack Exchange is a question and answer site for developers and users of the secure, private and untraceable cryptocurrency Monero. It only takes a minute to sign up.Sign up to join this community
Yes. Essentially, you can split up the private spend key according to a (k,n)-secret sharing scheme. Then any k participants can collect the keys together to recreate this private spend key and then sign transactions.
Now the question is, how is the key generated, how are the shares generated, and who/what brings the shares together.
One simple way is this have a trusted dealer generate the key and distribute the shares, and a trusted signer to collect the shares and sign transactions. If you are doing this for your own cold storage uses, this should be sufficient.
If you don't want a trusted signer, you can use secure multi-party computation. You can have a transaction X, and then k participants can do a computation that signs X. By the properties of Secure multi-party computation, the shares won't be revealed, and the only thing computed is a signature for X. In this way, the k participants don't have to trust any central signer, or even each other.
If you don't want a trusted dealer, you can again use secure multi-party computation. In particular, you can design an algorithm that produces a spend-key, produces shares of it according to the secret sharing scheme, and then encrypts each share with a public key of a participant, P_n. This algorithm requires a certain amount of random data r. The m dealers each generate their own random data or entropy r_i, and do the above computation using r = the xor of all the r_i. As long as one dealer chooses a random r_i and then destroys that r_i, r can not be calculated. These m dealers can be the n participants, although in practice you would probably only need k of the participants to be dealers, since they have spend power anyways.
By using both of these suggestions, this multisig scheme is as powerful as a bitcoin style multisig. It can actually be implemented in any cryptocurrency, regardless of protocol. It actually is a little bit better than a bitcoin multisig because:
Unfortunately, I don't know any software that implements this yet. It would make a good project, if anyone's up for it. 😊
EDIT: Just found the fair play project. It can be used for secure multiparty computation.