<p>The most fundamental difference is that Shamir Secret Shares shares... well, a secret. Multisig shares the ability to sign, but does not share the private keys directly.</p>

<p>You could use SSS to implement a sort-of multisig scheme. Multiple people come up jointly with a single key, split it into pieces, and then separate them. Now they want to produce a signature... the only way to do that is to first reconstruct the original key, as no signing is possible without it. This implies that to sign, at some point, someone needs to see the full key. If he makes a copy of that key, he can sign any number of messages afterwards. In short: SSS for multisig is only usable if you ever only sign one message. Afterwards, its security advantages are broken.</p>

<p>This is not the case for typical multisig schemes (including Bitcoin's). In that, everyone has their own independent key, and the private keys never need to leave the ownership of their holder. They merely each produce a partial signature, and all partial signatures are combined into a full one. However, a partial signature does not reveal the secret key at all.</p>

CC BY-SA 3.0
2017-04-29T13:59:00.760Z
2017-04-29T13:59:00.760Z
Pieter Wuille
<p>Is there a difference between the multi-signature and Shamir's secret sharing?</p>

<p>Technology/algorithm-wise.</p>

<multi-signature>
Is there a difference between the multi-signature and Shamir's secret sharing?
leo
# Is there a difference between the multi-signature and Shamir's secret sharing?

(Asked by: username_0 on 2017-04-29)

Is there a difference between the multi-signature and Shamir's secret sharing?

Technology/algorithm-wise.

**Tags:** multi-signature


---

## 1 answers

### Answer by username_1 on 2017-04-29. Score: 12

The most fundamental difference is that Shamir Secret Shares shares... well, a secret. Multisig shares the ability to sign, but does not share the private keys directly.

You could use SSS to implement a sort-of multisig scheme. Multiple people come up jointly with a single key, split it into pieces, and then separate them. Now they want to produce a signature... the only way to do that is to first reconstruct the original key, as no signing is possible without it. This implies that to sign, at some point, someone needs to see the full key. If he makes a copy of that key, he can sign any number of messages afterwards. In short: SSS for multisig is only usable if you ever only sign one message. Afterwards, its security advantages are broken.

This is not the case for typical multisig schemes (including Bitcoin's). In that, everyone has their own independent key, and the private keys never need to leave the ownership of their holder. They merely each produce a partial signature, and all partial signatures are combined into a full one. However, a partial signature does not reveal the secret key at all.


---

