<p>Armory has a key sharding feature that may be very useful. First, you generate a wallet, then you fund the wallet with what you want to leave to your heirs, then you generate an m of n backup. So, for example, you can generate 7 shards to the 7 people that you're leaving money to. The m would be the number of people that need to agree in order to restore the wallet. A simple majority or super-majority will be good. In our case, 5 or 6. That way, a single person can't hold the funds hostage and a small majority can't just take everything.</p>

<p>There are other alternatives, but this is the most flexible since you can add funds to the wallet by using the watching-only feature later on without having to compromise security or privacy.</p>

CC BY-SA 3.0
2016-05-27T17:07:01.440Z
2016-05-27T17:07:01.440Z
Jimmy Song
<p>Should point out that much of the information here overlaps a previous <a href="https://bitcoin.stackexchange.com/questions/38692/estate-planning-how-can-i-ensure-my-bitcoins-are-inheritable/38729#38729">answer</a>. Anyhow...</p>

<p>Use BIP 38 to encode the private keys and save the paper wallet among the heirs in advance of a death. Don't share the public address for the BIP 38 wallets.  This blinds heirs to the value of the coins they will eventually inherit.  Be sure to have instructions for heirs to no loose the information (i.e. BIP 38 wallets and associated SSSS snippets) distributed to them in advance. </p>

<p>Use Shamir's Shared Secret Scheme (SSSS) to spread the password for the BIP 38 encoded wallets. Mechanism like sealed wills and sharing limited SSSS secrets with heirs in advance can be used to bring enough shared secrets together upon a death to reconstitute passwords to decode BIP 38 wallets. </p>

<p>Each heir can have their own unique BIP 38 wallet and all inheritance BIP 38 wallets can share a common password.</p>

CC BY-SA 3.0
2016-05-29T02:43:34.560Z
2016-05-29T02:43:34.560Z
2017-04-13T12:47:33.660Z
skaht
<p>If you are comfortable with a command line, I have used <a href="http://linux.die.net/man/1/ssss-split">ssss-split</a> and <a href="http://linux.die.net/man/1/ssss-combine">ssss-combine</a> for sharding encryption keys in a n-of-m scheme.  These utilities use <a href="https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing">Shamir's Secret Sharing Scheme</a> to safely break up secrets for later reassembly.</p>

<p>For example, you could create a 4-of-7 scheme, where you would hide shards in 7 different locations (personal safe, safety deposit box, trusted lawyer, etc...).  Any 4 shards could be used to re-create the original secret.  It has the property where only having 3 shards gives an attacker no more chance of cracking the secret than if they had 0 shards.</p>

<p>One benefit to this scheme is that up to 3 shards could be lost, and the original secret could still be recovered.  The other benefit is that up to 3 shards could be <em>stolen</em>, and the attacker still doesn't have enough to obtain the secret.</p>

<p>One important thing to note, however, is that you still need to make sure that the collection of private keys is not lost, even if it is encrypted.  <a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki">BIP32</a> wallets are a great place to start (so you only need to shard a single key), but otherwise make sure that you have redundant copies of your encrypted wallet file.  The decryption key won't be any use if you lose the data that it decrypts.  Again, avoid that trouble by using a BIP32 wallet.</p>

CC BY-SA 3.0
2016-05-27T17:55:40.377Z
2016-05-27T19:48:41.220Z
2016-05-27T19:48:41.220Z
Jestin
<p>Assume that my friend would like to encrypt his Bitcoin private key(s) and safely store them in a secret location. This located would only be identified to heirs after death in his will. Should he put the key:</p>

<ul>
<li>In a safety deposit box</li>
<li>Buried in a weatherrpoof container somewhere on my property?</li>
<li>In the possession of my attorney?</li>
<li>Somewhere else</li>
</ul>

<p>Please answer the same question above for my encryption key which I would of course store separately.</p>

<p>As an alternative would a mult-sig solution be helpful? If so how would you design it?</p>

CC BY-SA 3.0
2016-05-27T21:17:03.450Z
Why would your friend put his key on your property or in possession of your attorney, not his own?
Tin Wizard
CC BY-SA 3.0
2016-05-27T21:47:16.437Z
Simple: get a programmable pacemaker, and program it to stop when any of your Bitcoins are taken. That way, any use of your Bitcoins will be after your death.
Nick ODell
CC BY-SA 3.0
2016-05-28T03:53:22.763Z
Note: the correct answer to these questions is *substantially* dependent on the threat model of who is trying to take the bitcoins.  A safety deposit box is useless to protect the coins against a government that can legally compel the bank to hand over the contents of the box.
Cort Ammon
<private-key><coldstorage><multi-signature><inheritance-plan>
What is the safest physical to store a private key only to be accessed after death?
Imagin Ation
# What is the safest physical to store a private key only to be accessed after death?

(Asked by: username_0 on 2016-05-27)

Assume that my friend would like to encrypt his Bitcoin private key(s) and safely store them in a secret location. This located would only be identified to heirs after death in his will. Should he put the key:

* In a safety deposit box
* Buried in a weatherrpoof container somewhere on my property?
* In the possession of my attorney?
* Somewhere else

Please answer the same question above for my encryption key which I would of course store separately.

As an alternative would a mult-sig solution be helpful? If so how would you design it?

**Tags:** private-key, coldstorage, multi-signature, inheritance-plan

> **Comments:**
> **username_1**: Why would your friend put his key on your property or in possession of your attorney, not his own?  
> **username_2**: Simple: get a programmable pacemaker, and program it to stop when any of your Bitcoins are taken. That way, any use of your Bitcoins will be after your death.  
> **username_3**: Note: the correct answer to these questions is *substantially* dependent on the threat model of who is trying to take the bitcoins.  A safety deposit box is useless to protect the coins against a government that can legally compel the bank to hand over the contents of the box.  

---

## 3 answers

### Answer by username_6 on 2016-05-27. Score: 9 | Accepted answer

If you are comfortable with a command line, I have used [ssss-split](http://linux.die.net/man/1/ssss-split) and [ssss-combine](http://linux.die.net/man/1/ssss-combine) for sharding encryption keys in a n-of-m scheme. These utilities use [Shamir's Secret Sharing Scheme](https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing) to safely break up secrets for later reassembly.

For example, you could create a 4-of-7 scheme, where you would hide shards in 7 different locations (personal safe, safety deposit box, trusted lawyer, etc...). Any 4 shards could be used to re-create the original secret. It has the property where only having 3 shards gives an attacker no more chance of cracking the secret than if they had 0 shards.

One benefit to this scheme is that up to 3 shards could be lost, and the original secret could still be recovered. The other benefit is that up to 3 shards could be *stolen*, and the attacker still doesn't have enough to obtain the secret.

One important thing to note, however, is that you still need to make sure that the collection of private keys is not lost, even if it is encrypted. [BIP32](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki) wallets are a great place to start (so you only need to shard a single key), but otherwise make sure that you have redundant copies of your encrypted wallet file. The decryption key won't be any use if you lose the data that it decrypts. Again, avoid that trouble by using a BIP32 wallet.


---

### Answer by username_4 on 2016-05-27. Score: 2

Armory has a key sharding feature that may be very useful. First, you generate a wallet, then you fund the wallet with what you want to leave to your heirs, then you generate an m of n backup. So, for example, you can generate 7 shards to the 7 people that you're leaving money to. The m would be the number of people that need to agree in order to restore the wallet. A simple majority or super-majority will be good. In our case, 5 or 6. That way, a single person can't hold the funds hostage and a small majority can't just take everything.

There are other alternatives, but this is the most flexible since you can add funds to the wallet by using the watching-only feature later on without having to compromise security or privacy.


---

### Answer by username_5 on 2016-05-29. Score: 1

Should point out that much of the information here overlaps a previous [answer](https://bitcoin.stackexchange.com/questions/38692/estate-planning-how-can-i-ensure-my-bitcoins-are-inheritable/38729#38729). Anyhow...

Use BIP 38 to encode the private keys and save the paper wallet among the heirs in advance of a death. Don't share the public address for the BIP 38 wallets. This blinds heirs to the value of the coins they will eventually inherit. Be sure to have instructions for heirs to no loose the information (i.e. BIP 38 wallets and associated SSSS snippets) distributed to them in advance.

Use Shamir's Shared Secret Scheme (SSSS) to spread the password for the BIP 38 encoded wallets. Mechanism like sealed wills and sharing limited SSSS secrets with heirs in advance can be used to bring enough shared secrets together upon a death to reconstitute passwords to decode BIP 38 wallets.

Each heir can have their own unique BIP 38 wallet and all inheritance BIP 38 wallets can share a common password.


---

