4 ms·

I have usually seen multisig as the recommended way, not Shamir. One Shamir vs multisig article : https://medium.com/clavestone/bitcoin-multisig-vs-shamirs-sec

• e79 6y ago
  [removed]
  • thinkloop 6y ago
    The only thing I don't like about that is that it is dependent on the network. Some cryptos don't have multi-sig for example. It's a full system, you have to be aware of protocol changes and such - Shamir is straight math and works on any type of key independent of the system. Trade-offs as usual I guess.
• neokantian 6y ago
  The problem with SSS as an alternative to multi-sig is that the dealer (the person drawing the polynomial to distribute the secret shares) will also know the secret. Hence, this dealer can leak the secret or abuse it. If you want dealer-free 2of3 secret sharing you need to use Diffie-Hellman-style shared secret sharing like implemented in Monero: https://hackernoon.com/monero-multisignatures-explained-46b247b098a7 https://hackernoon.com/monero-multisignatures-explained-46b2... Therefore, I disagree with the article that SSS would be a legitimate alternative to bitcoin multi-sig. By the way, if SSS really were an alternative to multi-sig, then Monero would have simply implemented SSS and not a (more elaborate) Diffie-Hellman style solution for secret sharing in Monero multi-sig.