BA-04 · LESSON 08

Multisig and threshold custody

KEY DEFINITIONS

Terms used in this lesson

Vault: A set of Bitcoin outputs and spending rules that holds collateral and represents the current loan state.
Witness: Signatures, scripts, or other data supplied to satisfy a Bitcoin output’s spending condition.
DKG: Distributed key generation: participants create shares of a group key without one party learning the complete secret.

A multisignature script asks Bitcoin to verify several visible signatures. Threshold signing instead lets several participants cooperate to produce one group signature.

65 min Difficulty 2/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · key derivationWallet material becomes a spending destinationSelect any state to inspect its exact role.

RELATIONSHIP MAPCommitment and derivation tree

01
BACKUPEntropy and policy
Recovery starts from secret entropy plus any passphrase and wallet policy data.
02
TREEDerivation path
A deterministic path selects one child key without changing earlier branches.
03
KEYMultisig and threshold custody
The Multisig and threshold custody step determines what secret or public material is available.
04
SCRIPTSpending condition
The destination commits to a script or witness program, not a human identity.
05
OUTPUTValue and script
A payment creates a new output that can be spent only by satisfying its condition.

Rule shown: A wallet derives keys and scripts; the blockchain records spendable outputs, not a wallet account.

STAGE 1 OF 5BACKUP: Entropy and policy

Recovery starts from secret entropy plus any passphrase and wallet policy data.

Governing relationship: A wallet derives keys and scripts; the blockchain records spendable outputs, not a wallet account. Complete path: 1. BACKUP, Entropy and policy. Recovery starts from secret entropy plus any passphrase and wallet policy data. 2. TREE, Derivation path. A deterministic path selects one child key without changing earlier branches. 3. KEY, Multisig and threshold custody. The Multisig and threshold custody step determines what secret or public material is available. 4. SCRIPT, Spending condition. The destination commits to a script or witness program, not a human identity. 5. OUTPUT, Value and script. A payment creates a new output that can be spent only by satisfying its condition.

1. State transitionWhat exists, what changes, and what results

BEFORE

Vault S uses a 2-of-3 witness script with keys A, B, C. Vault T uses a 2-of-3 threshold group public key.

MECHANISM

Choose how many participants exist and how many must authorize. A lower threshold improves availability but reduces the number of compromises needed to steal.

AFTER

Threshold signing changes key custody and on-chain representation. It does not change the fundamental quorum trust assumption.

Text equivalent: Starting from Vault S uses a 2-of-3 witness script with keys A, B, C. Vault T uses a 2-of-3 threshold group public key. The mechanism begins when Choose how many participants exist and how many must authorize. A lower threshold improves availability but reduces the number of compromises needed to steal. The resulting lesson is Threshold signing changes key custody and on-chain representation. It does not change the fundamental quorum trust assumption.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 5

Define the quorum

Choose how many participants exist and how many must authorize. A lower threshold improves availability but reduces the number of compromises needed to steal.

Complete path: 1. Define the quorum: Choose how many participants exist and how many must authorize. A lower threshold improves availability but reduces the number of compromises needed to steal. 2. Choose script or threshold representation: Script multisig commits individual keys or a script tree. Threshold schemes run distributed key generation or share distribution for one group key. 3. Validate policy independently: Each participant should verify destination, amount, fee, and organizational policy before signing. Cryptography cannot decide whether a payment is legitimate. 4. Produce authorization: Script multisig gathers separate signatures. Threshold signing runs an interactive nonce and share protocol, then aggregates one signature. 5. Plan recovery and rotation: Script key replacement usually moves funds to a new output. Threshold share refresh or membership change depends on the chosen protocol and still requires careful backups and rehearsals.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

Each independent design case applies the same t-of-n approval, availability, collusion, recovery, and on-chain-data questions.

CHANGED CONDITION

Fewer than t participants stalls either design, while t colluders can steal; threshold signing additionally depends on DKG, nonce, share, and coordination safety.

Important distinction: Threshold signing is always strictly safer than script multisig. It can improve privacy and remove a complete-key holder, but adds interactive protocol, nonce, implementation, and coordination risks. The safer design depends on the threat model.

Text equivalent: The accepted path is enforced by Each independent design case applies the same t-of-n approval, availability, collusion, recovery, and on-chain-data questions. If the required condition changes, Fewer than t participants stalls either design, while t colluders can steal; threshold signing additionally depends on DKG, nonce, share, and coordination safety.

Loading lesson visuals...

Learn the idea

Script multisig places several public keys and a signature threshold in the spending condition, so a spend reveals multiple signatures. Threshold signing distributes one key's authority among participants and produces one signature under one group public key. Both can express t-of-n control, but their on-chain appearance, setup, failure modes, and auditability differ.

GUIDED EXPLANATION1/5 ideas inspected

Define the quorum

Choose how many participants exist and how many must authorize. A lower threshold improves availability but reduces the number of compromises needed to steal.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“Threshold signing is always strictly safer than script multisig.”

It can improve privacy and remove a complete-key holder, but adds interactive protocol, nonce, implementation, and coordination risks. The safer design depends on the threat model.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.