Received-SPF: pass (sog-mx-3.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.217.171 as permitted sender)
	client-ip=209.85.217.171; envelope-from=gmaxwell@gmail.com;
	helo=mail-lb0-f171.google.com; 
MIME-Version: 1.0
In-Reply-To: <3760502.BsfnhHlzm1@crushinator>
References: <CACsn0ckScTWG4YxNCscxvtdsmcUkxtR2Gi-rdBs2HCkirPz5rA@mail.gmail.com>
	<4906130.DUyjhm1C93@crushinator> <1396113933.8809.91.camel@mimiz>
	<3760502.BsfnhHlzm1@crushinator>
Date: Sat, 29 Mar 2014 10:46:41 -0700
Message-ID: <CAAS2fgTVo_j9NkDdHBw8mEDjw6i7yY2_Y5-Z=Yer7WUi0ZySQw@mail.gmail.com>
From: Gregory Maxwell <gmaxwell@gmail.com>
To: Matt Whitlock <bip@mattwhitlock.name>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>,
	Dev Random <c1.devrandom@niftybox.net>
Subject: Re: [Bitcoin-development] Presenting a BIP for Shamir's Secret
 Sharing of Bitcoin private keys
Precedence: list

On Sat, Mar 29, 2014 at 10:38 AM, Matt Whitlock <bip@mattwhitlock.name> wro=
te:
> But can threshold ECDSA work with BIP32?

Yes.

>In other words, can a threshold ECDSA public key be generated from separat=
e, precomputed private keys,
No.

> can it only be generated interactively?

Yes.

But see the first question.  Basically you can do an interactive step
to generate a master pubkey and then use BIP32 non-hardened derivation
to build thresholded children.

On Sat, Mar 29, 2014 at 10:42 AM, Matt Whitlock <bip@mattwhitlock.name> wro=
te:
> Respectfully, it's also possible to take a base58-encoded private key and=
 run it through GPG, which is included in most Linux distros. But yet we ha=
ve BIP38.

BIP38 is a bad example (because it was created without public
discussion due to a technical snafu).

In this case I don't see anything wrong with specifying secret
sharing, but I think=E2=80=94 if possible=E2=80=94 it should be carefully c=
onstructed
so that the same polynomials and interpolation code can be used for
threshold signatures (when encoding compatible data).

If it requires entirely different code than the code for threshold
signing it might as well be a file generic tool like SSSS.