{"type":"rich","version":"1.0","author_name":"npub19g47w5ewcqlpd7n07wpkp5cvcu2gjwrse0vl47l0avwl9hu933xsqct5d0","author_url":"https://nostr.ae/npub19g47w5ewcqlpd7n07wpkp5cvcu2gjwrse0vl47l0avwl9hu933xsqct5d0","provider_name":"njump","provider_url":"https://nostr.ae","html":"📅 Original date posted:2021-02-11\n📝 Original message:I think the key issue here is avoiding xpub key reuse in multisig. Not only\nin the future with Schnorr, but we need it today!\n\nCurrent common practice by hardware wallets is the 48'/0'/0'/2' derivation\nfor segwit multsig ( e.g.\n[90081696/48'/0'/0'/2']xpub6DYLEkDfCdHzh5FHGHDJksQvFqu6kYANa1sfo6fA8n5ZWkSwyCRVVzyq9LY2eNGB6T9BKDeGJp2ZarjRZHd7WB95nSaFEDhFMK6zSV6D49b\n) is the only one used for ALL multisigs offered by that hardware wallet.\n\nAs Pieter said, leveraging a HD path parameters can help, but we need a\nbetter, less reusable path for the index.\n\nI personally suggest a simpler solution, which is to create an index using\na PBKDF of the Account Policy (a descriptor with all xpubs and keys\nremoved), plus optional notes. (BTW, I think double sha256 or HMAC is\noverkill).\n\nExample: for the reference bit descriptor that might result in:\n\n```\nwsh(sortedmulti(2,xpub661MyMwAqRbcFW31YEwpkMuc5THy2PSt5bDMsktWQcFF8syAmRUapSCGu8ED9W6oDMSgv6Zz8idoc4a6mr8BDzTJY47LJhkJ8UB7WEGuduB/1/0/*,xpub69H7F5d8KSRgmmdJg2KhpAK8SR3DjMwAdkxj3ZuxV27CprR9LgpeyGmXUbC6wb7ERfvrnKZjXoUmmDznezpbZb7ap6r1D3tgFxHmwMkQTPH/0/0/*))\n```\n\nWhat Blockchain Commons (and the Airgapped Wallet Community) call a policy\nmap would be\n\n```\nwsh(sortedmulti(1,,,))\n```\n\nA PBKDF of that as would be unique for all 2 of 3 segwig transactions. With\nthe addition of the addition of the Policy Map creators optional note, it\nwould be truly unique. The Policy Map and/or PBKDF are small and could\neasily added to existing APIs.\n\nSo for legacy hardware, we can use existing 48' subtree, but 3' as the\nformat for this form (2' is segwit), then the desktop can just ask for the\n/48'/0'/0'/3'/PBKDF' when it requests a new xpub from the hardware token.\nMore sophisticated Airgapped apps you can send\n\"wsh(sortedmulti(1,,,))\"+label and let the cosigner app do the PBKDF, and\noptionally allow it return something different in a full keyset (i.e.\n\"[90081696/48'/0'/0'/3'/af3948cg…'/]xpub6DYLEk…\", and then the requesting\napp, knowing that it is different from the PBKDF can know what to do if it\nneeds to what to ask for in the future.\n\nThe other advantage of this technique is that the cosigner app can know\nwhat policy it is participating in, before the descriptor is completed. It\nmay decide it doesn't want to participate in some funky 4:9 with a weird\nscript, and not return an xpub at all.\n\nLong term I think a commitment scheme should be used, so that you don't\nreveal what xpub you offered until all the parties xpubs are shared, but as\nPieter said, we can do that at the same time we do the musig. But we need\nto prevent xpub reuse NOW, and I think my proposal easy and could the job.\n\n-- Christopher Allen, Blockchain Commons\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20210211/30d4ab91/attachment.html\u003e"}