<p>A multi-sig address is a hash of a script that combines <strong>multiple separate</strong> keys. In other words the purpose of it is to require multiple signatures from multiple keys that are stored (and usually generated) independently. For that reason it can not be generated from a <strong>single</strong> extended public key (xpub).<br>
What you can do, is to have <strong>multiple</strong> extended keys, and for each address derive a public key from each xkey at the same path and combine those pubkeys to get your address.  </p>

<p>For example a 2 of 2 scheme between Alice an Bob would work like this: </p>

<ol>
<li>Alice generates a master private key, stores it in a safe and private place.</li>
<li>Bob generate a master private key, stores it in a safe and private place.</li>
<li>Alice gets her master public key for a specific path like: <code>m/44'/0'/0'/0</code>* and shares it with Bob.</li>
<li>Bob gets his master public key for a specific path like: <code>m/44'/2'/1'/0</code>* and shares it with Alice.</li>
<li>They both agree that Alice pubkeys have to come first** and start at index 0. </li>
<li>To get an address they each independently derive the same public keys from the two extended pubkeys they have, combine them (<code>OP_2&lt;AlicePubKey&gt;&lt;BobPubKey&gt;&lt;OP_2&gt;&lt;OP_CheckMultiSig&gt;</code>) hash it and get the corresponding address.</li>
<li>Each time they want a new address, they get the next index and repeat step 6.  </li>
</ol>

<p>*. These paths are optional but the keys that are derived from these extended public keys can only have non-hardened paths.<br>
**. Note that in step 5 the order is important and they have to agree on it first. Otherwise the address for <code>OP_2&lt;BobPubKey&gt;&lt;AlicePubKey&gt;&lt;OP_2&gt;&lt;OP_CheckMultiSig&gt;</code> is different and mistakes like that could lead to losses.</p>

CC BY-SA 4.0
2019-09-09T12:57:51.240Z
2019-09-09T12:57:51.240Z
Coding Enthusiast
<p>Check out <a href="https://unchained-capital.github.io/caravan/" rel="nofollow noreferrer">Caravan</a> for example.  The xpub of each signatory in the quorum is shared instead of sharing an individual xpub.  The convention is that the addresses get generated using the same derivation path for each signatory.  Regarding the ordering which generates the redeem script and address, typically the pubkeys for each signatory are ordered lexicographically which basically means alphabetically.  These conventions simplify multi-sig so that for each quorum of xpub keys, there is one canonical address for each derivation path.</p>

CC BY-SA 4.0
2020-12-03T13:57:47.507Z
2020-12-05T12:55:03.713Z
2020-12-05T12:55:03.713Z
Eric
<p>When I have a typical wallet, I can give my Xpub to someone to generate addresses whenever they need. ("they" here could be an instance of BTCPAY server or some other application that I don't want to expose private keys to).</p>

<p>When I have a multisig scheme/wallet. How do addresses get generated? And is there an equivalent key (Xpub, zpub etc) that I could generate and put in my btcpay server?</p>

<p>Thanks</p>

CC BY-SA 4.0
2019-09-09T18:19:59.003Z
Not really an answer to your question, but here I talked about the "output descriptors" that have been introduced to Bitcoin Core a while ago: https://bitcoin.stackexchange.com/a/89281/208
Pieter Wuille
<multi-signature><public-key><address-generation><xpub>
Is there an equivalent to the Xpub/Zpub for multisig wallets?
FKrauss
# Is there an equivalent to the Xpub/Zpub for multisig wallets?

(Asked by: username_0 on 2019-09-09)

When I have a typical wallet, I can give my Xpub to someone to generate addresses whenever they need. ("they" here could be an instance of BTCPAY server or some other application that I don't want to expose private keys to).

When I have a multisig scheme/wallet. How do addresses get generated? And is there an equivalent key (Xpub, zpub etc) that I could generate and put in my btcpay server?

Thanks

**Tags:** multi-signature, public-key, address-generation, xpub

> **Comments:**
> **username_1**: Not really an answer to your question, but here I talked about the "output descriptors" that have been introduced to Bitcoin Core a while ago: https://bitcoin.stackexchange.com/a/89281/208  

---

## 2 answers

### Answer by username_2 on 2019-09-09. Score: 2

A multi-sig address is a hash of a script that combines **multiple separate** keys. In other words the purpose of it is to require multiple signatures from multiple keys that are stored (and usually generated) independently. For that reason it can not be generated from a **single** extended public key (xpub).  
What you can do, is to have **multiple** extended keys, and for each address derive a public key from each xkey at the same path and combine those pubkeys to get your address.

For example a 2 of 2 scheme between Alice an Bob would work like this:

1. Alice generates a master private key, stores it in a safe and private place.
2. Bob generate a master private key, stores it in a safe and private place.
3. Alice gets her master public key for a specific path like: `m/44'/0'/0'/0`\* and shares it with Bob.
4. Bob gets his master public key for a specific path like: `m/44'/2'/1'/0`\* and shares it with Alice.
5. They both agree that Alice pubkeys have to come first\*\* and start at index 0.
6. To get an address they each independently derive the same public keys from the two extended pubkeys they have, combine them (`OP_2<AlicePubKey><BobPubKey><OP_2><OP_CheckMultiSig>`) hash it and get the corresponding address.
7. Each time they want a new address, they get the next index and repeat step 6.

\*. These paths are optional but the keys that are derived from these extended public keys can only have non-hardened paths.  
\*\*. Note that in step 5 the order is important and they have to agree on it first. Otherwise the address for `OP_2<BobPubKey><AlicePubKey><OP_2><OP_CheckMultiSig>` is different and mistakes like that could lead to losses.


---

### Answer by username_3 on 2020-12-03. Score: 0

Check out [Caravan](https://unchained-capital.github.io/caravan/) for example. The xpub of each signatory in the quorum is shared instead of sharing an individual xpub. The convention is that the addresses get generated using the same derivation path for each signatory. Regarding the ordering which generates the redeem script and address, typically the pubkeys for each signatory are ordered lexicographically which basically means alphabetically. These conventions simplify multi-sig so that for each quorum of xpub keys, there is one canonical address for each derivation path.


---

