Received-SPF: pass (sog-mx-4.v43.ch3.sourceforge.com: domain of bitpay.com
	designates 209.85.160.169 as permitted sender)
	client-ip=209.85.160.169; envelope-from=jgarzik@bitpay.com;
	helo=mail-yk0-f169.google.com; 
MIME-Version: 1.0
In-Reply-To: <CA0DE0F6-C5B9-4BC4-9F79-D98C89A159F4@beams.io>
References: <1878927.J1e3zZmtIP@crushinator>
	<83BBF97F-290E-4CF9-B062-92445ED35F27@beams.io>
	<1701792.nYQmSeReja@crushinator>
	<CA0DE0F6-C5B9-4BC4-9F79-D98C89A159F4@beams.io>
From: Jeff Garzik <jgarzik@bitpay.com>
Date: Sat, 29 Mar 2014 09:27:36 -0400
Message-ID: <CAJHLa0N0YCHfBeDq+QLqK3ZVWD-rAx85MXvX4OBqSoQqgCXm2w@mail.gmail.com>
To: Chris Beams <chris@beams.io>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Presenting a BIP for Shamir's Secret
 Sharing of Bitcoin private keys
Precedence: list

The comparison with multisig fails to mention that multi-signature
transactions explicitly define security at the transaction level.
This permits fine-grained specificity of what a key holder may
approve.

Shamir is much more coarse-grained.  You reconstitute a private key,
which may then be used to control anything that key controls.  Thus,
in addition to Shamir itself, you need policies such as "no key
reuse."

My first impression of Shamir many moons ago was "cool!" but that's
since been tempered by thinking through the use cases.  Shamir has a
higher D.I.Y. factor, with a correspondingly larger surface of
things-that-could-go-wrong, IMO.

(None of this implies making an informational BIP lacks value; I'm all
for an informational BIP)


On Sat, Mar 29, 2014 at 7:54 AM, Chris Beams <chris@beams.io> wrote:
> Enlightening; thanks, Matt. And apologies to the list for my earlier inad=
vertent double-post.
>
> On Mar 29, 2014, at 12:16 PM, Matt Whitlock <bip@mattwhitlock.name> wrote=
:
>
>> On Saturday, 29 March 2014, at 10:08 am, Chris Beams wrote:
>>> Matt, could you expand on use cases for which you see Shamir's Secret S=
haring Scheme as the best tool for the job? In particular, when do you see =
that it would be superior to simply going with multisig in the first place?=
 Perhaps you see these as complimentary approaches, toward defense-in-depth=
? In any case, the Motivation and Rationale sections of the BIP in its curr=
ent form are silent on these questions.
>>
>> I have added two new sections to address your questions.
>>
>> https://github.com/whitslack/btctool/blob/bip/bip-xxxx.mediawiki
>
>
> -------------------------------------------------------------------------=
-----
>
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>


--=20
Jeff Garzik
Bitcoin core developer and open source evangelist
BitPay, Inc.      https://bitpay.com/