<blockquote>
<p>Is there a multi-signature scheme that only need the private keys,
thus simplifying backup (and restore) considerably?</p>
</blockquote>
<p>Yes, the <strong>2-of-2</strong> scheme.</p>
<p>The 2-of-2 is highly underrated in context of cold storage.</p>
<p>Obviously, no single key can be lost, but that can be managed with a multi-location backups.</p>

CC BY-SA 4.0
2021-07-08T10:01:49.980Z
2021-07-08T10:01:49.980Z
CypherpunkDev
<blockquote>
<p>A disadvantage of a multi-signature scheme compared to a Shamir's Shared Secret Scheme is the need to back up the xpub keys.</p>
</blockquote>
<p>If you don't want to backup the xpub (or xpriv) you can backup the individual private keys used in the multisig and ignore the fact that they were generated as part of a HD tree (if indeed they were). To spend from a 2-of-3 multisig you will need all 3 private keys or 2 private keys and a public key not associated with the 2 private keys.</p>
<blockquote>
<p>In my very rudimentary understanding of Taproot, you can efficiently chain multiple scripts together. Would it work to reduce a M-of-N scheme to a set of M-of-M schemes OR'ed together? For example, splitting a 2-of-3 with keys A, B, C into a script that accepts (A AND B) OR (A AND C) OR (B AND C)?</p>
</blockquote>
<p>You can do what you describe with Taproot. Murch has written a <a href="https://murchandamus.medium.com/2-of-3-multisig-inputs-using-pay-to-taproot-d5faf2312ba3" rel="nofollow noreferrer">blog post</a> on how to do this. If you want to spend using A and C and it is in the script path (rather than the key path) you will need to prove that it is in the Taproot tree. Hence you will need more than just the private keys of A and C so I don't think it meets your wish to only store a BIP 39 mnemonic.</p>

CC BY-SA 4.0
2021-07-07T14:27:37.500Z
2021-07-07T14:44:41.703Z
2021-07-07T14:44:41.703Z
Michael Folkson
<p>A disadvantage of a HD multi-signature scheme compared to a Shamir's Shared Secret Scheme is the need to back up the xpub keys. There's no BIP39-like encoding for xpubs, they're long, and they're sensitive so you can't just widely distribute them to counter risk of loss.</p>
<p>Is there a multi-signature M-of-N (M &lt; N) scheme that only needs M private keys, thus simplifying backup (and restore) considerably?</p>
<p>In my very rudimentary understanding of Taproot, you can efficiently chain multiple scripts together. Would it work to reduce a M-of-N scheme to a set of M-of-M schemes OR'ed together? For example, splitting a 2-of-3 with keys A, B, C into a script that accepts (A AND B) OR (A AND C) OR (B AND C)?</p>

<multi-signature><taproot>
Is there a multisignature scheme that don't need xpub backups?
Elias Naur
# Is there a multisignature scheme that don't need xpub backups?

(Asked by: username_0 on 2021-07-07)

A disadvantage of a HD multi-signature scheme compared to a Shamir's Shared Secret Scheme is the need to back up the xpub keys. There's no BIP39-like encoding for xpubs, they're long, and they're sensitive so you can't just widely distribute them to counter risk of loss.

Is there a multi-signature M-of-N (M < N) scheme that only needs M private keys, thus simplifying backup (and restore) considerably?

In my very rudimentary understanding of Taproot, you can efficiently chain multiple scripts together. Would it work to reduce a M-of-N scheme to a set of M-of-M schemes OR'ed together? For example, splitting a 2-of-3 with keys A, B, C into a script that accepts (A AND B) OR (A AND C) OR (B AND C)?

**Tags:** multi-signature, taproot


---

## 2 answers

### Answer by username_1 on 2021-07-08. Score: 2

> Is there a multi-signature scheme that only need the private keys,
> thus simplifying backup (and restore) considerably?

Yes, the **2-of-2** scheme.

The 2-of-2 is highly underrated in context of cold storage.

Obviously, no single key can be lost, but that can be managed with a multi-location backups.


---

### Answer by username_2 on 2021-07-07. Score: 1

> A disadvantage of a multi-signature scheme compared to a Shamir's Shared Secret Scheme is the need to back up the xpub keys.

If you don't want to backup the xpub (or xpriv) you can backup the individual private keys used in the multisig and ignore the fact that they were generated as part of a HD tree (if indeed they were). To spend from a 2-of-3 multisig you will need all 3 private keys or 2 private keys and a public key not associated with the 2 private keys.

> In my very rudimentary understanding of Taproot, you can efficiently chain multiple scripts together. Would it work to reduce a M-of-N scheme to a set of M-of-M schemes OR'ed together? For example, splitting a 2-of-3 with keys A, B, C into a script that accepts (A AND B) OR (A AND C) OR (B AND C)?

You can do what you describe with Taproot. Murch has written a [blog post](https://murchandamus.medium.com/2-of-3-multisig-inputs-using-pay-to-taproot-d5faf2312ba3) on how to do this. If you want to spend using A and C and it is in the script path (rather than the key path) you will need to prove that it is in the Taproot tree. Hence you will need more than just the private keys of A and C so I don't think it meets your wish to only store a BIP 39 mnemonic.


---

